Privacy Policy

1. About this policy

meow meow scratch ("we", "us", "our") is operated from Australia. This privacy policy explains how we collect, use, disclose, and protect personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

By using meow meow scratch — including our website, API platform, and iOS app — you agree to the collection and use of information as described in this policy.

2. Information we collect

2.1 Account information

When you create an account we collect your username, email address, and password (stored as a one-way hash). You may optionally provide a first and last name.

2.2 Social login

If you sign in with Google, GitHub, Discord, or Twitch, we receive your name, email address, and profile identifier from that provider. We store an OAuth token so you can stay signed in.

2.3 Organisation and team data

If you create or join an organisation, we store the organisation name, your membership role, and the date you joined.

2.4 Apps, endpoints, and user-created content

We store the apps, API endpoints, collection fields, data records, static payloads, proxy configurations, dashboards, and widgets you create. This is the core content you build on the platform.

2.5 API keys

API keys you generate are stored as irreversible SHA-256 hashes. We keep an 8-character prefix, the key name, scopes, and a timestamp of last use.

2.6 Billing and payment

Payments are processed by Stripe. We never store your full card number or payment details on our servers. We retain your Stripe customer ID, subscription status, and billing period dates.

2.7 Emails and communications

We send transactional emails (verification, password reset, billing) through Resend. We log the recipient address, subject, content, and delivery status for audit purposes.

2.8 Chatbot conversations

If you use the chatbot/agent feature, your messages and the assistant's responses are stored. Depending on the agent configuration, conversation content may be sent to OpenAI or xAI for processing. Ollama-based agents process data locally on our servers.

2.9 Provider integrations

If you configure template variables (e.g. weather, Minecraft, Roblox), we store your provider settings which may include usernames or location data you provide.

2.10 Analytics and usage data

We use Google Analytics to understand how visitors use our public website and to improve the platform. Google Analytics may collect information such as pages viewed, interactions, referral source, approximate location, and browser or device information using cookies or similar technologies.

3. Information we do not collect

We do not sell personal information, serve targeted advertising, or use Google Analytics data to build advertising profiles. We do not use third-party advertising pixels. The iOS app does not transmit advertising identifiers.

4. How we use your information

• To provide and operate the meow meow scratch platform
• To authenticate you and secure your account
• To process payments and manage subscriptions via Stripe
• To send transactional emails (account verification, password resets, billing notifications)
• To provide chatbot/agent functionality using third-party LLM providers when you choose to use that feature
• To understand website usage and improve the platform using Google Analytics
• To respond to support enquiries

We do not use your information for advertising, profiling, or automated decision-making.

5. Third-party services

We share information with the following third parties only as necessary to operate the platform:

6. Cookies and session data

We use essential cookies for Django sessions and CSRF protection. We also use Google Analytics, which may set analytics cookies or use similar technologies to distinguish visits and measure website usage. We do not use our own advertising cookies. On the web, your authentication token is stored in session storage (cleared when you close the browser). On iOS, the token is stored in the device Keychain.

7. Data security

• All connections use HTTPS with HSTS enabled in production
• Passwords are hashed using PBKDF2/bcrypt (one-way)
• API keys are stored as SHA-256 hashes (irreversible)
• Rate limiting is applied (120 requests/minute anonymous, 600 authenticated)
• Input validation and sanitisation is applied to all user-submitted data

8. Data retention and deletion

We retain your account data and most user-created content for as long as your account is active. Collection endpoints retain a rolling number of recent records according to your plan, so older records are automatically deleted as new records arrive. If you configure a record expiry time (TTL), records may be deleted sooner. Email logs are retained for audit purposes. If you delete your account, all associated data — including apps, endpoints, retained records, API keys, and organisation memberships — is permanently deleted.

9. Your rights under Australian law

Under the Australian Privacy Principles you have the right to:

• Access the personal information we hold about you (APP 12)
• Request correction of inaccurate information (APP 13)
• Request deletion of your account and personal data
• Complain to the Office of the Australian Information Commissioner (OAIC) if you believe we have breached the APPs

To exercise any of these rights, contact us at the address below.

10. Children's privacy

meow meow scratch is an educational platform designed for learners of all ages, including children. We collect only the minimum information necessary to operate the platform. We do not serve advertising, perform behavioural tracking, or share data with advertisers. We encourage parents and guardians to supervise their children's use of the platform. If you believe a child has provided personal information without appropriate consent, please contact us and we will delete it promptly.

11. International data transfers

Some third-party services we use (Stripe, Resend, OpenAI, xAI, OAuth providers) are based in the United States. By using our platform, you acknowledge that your data may be transferred to and processed in countries outside Australia. We take reasonable steps to ensure these providers maintain adequate data protection standards.

12. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email or by posting a notice on our website. The "last updated" date at the top of this page indicates when the policy was last revised.

13. Contact us

If you have questions about this privacy policy or wish to make a complaint, please contact us at:

me@meowmeowscratch.com