Privacy Policy
This policy explains what personal data Kromacat collects, why, and what rights you have over it.
Short version: We collect only what we need to run the platform. We never sell your data. You can export or delete everything at any time.
1. Who We Are (Data Controller)
Kromacat is operated by Marc Alexander Diaz Quilia, an individual registered in Peru, who is the data controller for personal data processed through the platform and its apps. In this policy, "Kromacat", "we" and "us" refer to that operator.
For anything about your data, write to privacy@kromacat.com.
2. Data We Collect
| Category | Data | Why |
|---|---|---|
| Account | Email address, hashed password | Authentication and account recovery |
| Profile | Display name, username, bio, social links | Public profile page |
| Photos | Image files, alt text, tags, descriptions | Core platform service (Grid/Feed/Pitch) |
| Avatar | Profile photo, crop coordinates | Identity representation |
| Social graph | Who you follow / are followed by | Feed chronology |
| Session | Auth tokens, session ID | Keeping you signed in (via Supabase Auth) |
| Technical | IP address, browser/OS, timestamps | Security, abuse prevention, consent audit |
| Analytics | Page URL and dynamic path, referrer, filtered query parameters, country / region / city (derived from IP — IP itself is never stored), device OS & version, browser & version, device type (mobile / desktop / tablet), event timestamp | Understanding platform usage and improving the service. Data is aggregated only — it cannot identify or re-identify any individual. Collected via Vercel Web Analytics (cookie-less; session hash discarded after 24 hours). |
| Billing | Web and iOS: name, billing address, country, transaction IDs (via Lemon Squeezy). Android: Google Play order ID and purchase token only — payment details stay with Google. | One-time Style purchase processing and VAT compliance (Grid only) |
| Support & reports | Messages you send through Help & Support, and content reports you file | Answering your request; reviewing reported content |
| Removal requests | Name, contact details, signature and details you send to request removal of an intimate image, including from people without an account | Removing the content; legal obligation (US TAKE IT DOWN Act) |
| Sign-up channel | The short code of the link you arrived from (for example ?r=rd), saved once with your account when you sign up. Until then it is kept only in the page's memory — never in a cookie or on your device. | Aggregated statistics on where sign-ups come from; never shown to anyone |
| Consent log | Record of checkboxes accepted, document versions, IP at consent time | Legal compliance — GDPR Art. 7(1) |
In the Android app
- Photos are chosen with the system photo picker. Only the photos you select are uploaded, and location and camera metadata (EXIF) are removed on your device first.
- The app does not use your camera, microphone, location or contacts, and does not read your photo library beyond the photos you pick.
- The app contains no advertising or third-party analytics SDKs. Purchases go through Google Play Billing.
Age
Kromacat is for adults aged 18 and over and is not directed at minors. We do not knowingly collect data from anyone younger; if we learn we have, we delete the account.
3. Legal Basis for Processing
| Processing purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the platform service | Art. 6(1)(b) — contract performance |
| Sending email confirmations & password resets | Art. 6(1)(b) — contract performance |
| Security monitoring & fraud prevention | Art. 6(1)(f) — legitimate interest |
| Tax record keeping | Art. 6(1)(c) — legal obligation |
| Marketing emails (optional) | Art. 6(1)(a) — consent (you opted in at registration) |
| Consent audit trail | Art. 6(1)(c) — legal obligation |
| Aggregated, cookie-less analytics | Art. 6(1)(f) — legitimate interest (understanding platform usage and improving the service). No cookies are set, no IP address is stored, and data cannot identify individuals — the privacy impact is minimal. |
4. Third-Party Processors
We use the following sub-processors. All have been assessed for GDPR adequacy:
| Processor | Role | Location |
|---|---|---|
| Supabase Inc. | Database, authentication, file storage | United States (SCCs in place) |
| Vercel Inc. | Application hosting, edge network, cookie-less web analytics | United States (SCCs in place) |
| Google LLC (Google Play Billing) | One-time Style purchases made in the Android app | United States |
| Lemon Squeezy LLC | One-time Style purchases made on the web and iOS (merchant of record) | United States |
| Transactional email provider | Account confirmation, password reset emails | EU/US (DPA in place) |
We do not sell your data to third parties. We do not share data with advertisers.
5. Data Retention
| Data type | Retention period |
|---|---|
| Account & profile data | Until account deletion + 30 days (backup purge) |
| Photos & Grid content | Until you delete them or close your account |
| Consent log | Account lifetime + 5 years (legal obligation) |
| Tax invoices | 7 years (EU/UK statutory requirement) |
| Moderation records | As long as necessary for ongoing proceedings |
| Anonymised analytics | Indefinitely (not linked to individuals) |
6. Your Rights
Under GDPR Arts. 15–21 and CCPA, you have the following rights:
| Right | What it means | How to exercise |
|---|---|---|
| Access (Art. 15) | Receive a copy of all your personal data | Email privacy@kromacat.com or use the in-app settings. We respond within 30 days. |
| Rectification (Art. 16) | Correct inaccurate personal data | |
| Erasure (Art. 17) | Request deletion of your data ("right to be forgotten") — see how to delete your account | |
| Restriction (Art. 18) | Limit how we process your data | |
| Portability (Art. 20) | Export your data in machine-readable format | |
| Object (Art. 21) | Object to processing based on legitimate interest | |
| Withdraw consent | Revoke marketing email consent at any time | Unsubscribe link in every email, or account settings |
7. Security
- All data transmitted over HTTPS/TLS 1.3
- Passwords hashed with bcrypt (Supabase Auth)
- Database encrypted at rest (AES-256)
- Row-level security (RLS) enforced on every table
- Breach notification to supervisory authority within 72 hours (GDPR Art. 33)
- Affected users notified without undue delay if high risk (Art. 34)
8. Cookies & Analytics
We use only strictly necessary cookies for authentication. No advertising or tracking cookies are set. See our Cookie Policy for the full list.
We use Vercel Web Analytics to understand how the platform is used. This service is entirely cookie-less — it sets no cookies and stores no IP addresses. Visitors are identified by a temporary hash derived from the incoming request; that hash is automatically discarded after 24 hours. All data is aggregated and cannot be used to identify any individual.
9. Complaints & Supervisory Authority
If you believe we have mishandled your personal data, you may:
- Contact us first via our complaints process
- Lodge a complaint with Peru's data protection authority (Law No. 29733): ANPD — Autoridad Nacional de Protección de Datos Personales
- If you live in the EU/EEA or the UK, with the data protection authority of your country
Privacy contact: privacy@kromacat.com — we aim to respond within 5 business days.