CatRealm Privacy Policy

1.Scope of this policy

This policy covers CatRealm's Central services — the shared account, authentication, direct-message, friend-graph, push-notification, and sync system — and the official CatRealm desktop, mobile, and web clients.

It does not cover individual self-hosted CatRealm servers run by other people or organizations. When you join one, that operator independently controls the messages, files, voice sessions, moderation actions, audit logs, and backups that exist on their server, and may run their own logging, retention, and privacy rules on top of this one. Anything below that describes "self-hosted" or "operator" behavior is a description of what the CatRealm software allows an operator to do, not a promise about what any specific server actually does.

2.Information we collect

Account & authentication

• Username, account ID, and profile fields you set (display name, avatar, banner, pronouns, custom status/activity).
• A TOTP two-factor secret and backup codes for Central accounts, which use username + authenticator-app 2FA instead of a password. Passwords only exist for local accounts on a self-hosted server that supports them, and are stored only on that server.
• A WebAuthn/passkey public-key credential if you register a hardware key or device passkey.
• Session/auth tokens (JWTs) stored client-side (for example browser local storage or secure device storage) to keep you signed in. Unfinished registrations auto-expire after about 10 minutes.

Social graph & personalization

• Friend relationships, friend requests, and blocks.
• Nicknames or notes you privately set on other users, visible only to you.
• Personal expression tokens (custom emotes/stickers) you upload. These are stored on Central only; other users resolve them through a public per-user manifest endpoint so they render correctly wherever you use them.
• Your day-streak status, derived from daily "online long enough to qualify" markers (see Section 8) — no location or GPS data is collected for this or any other feature.

Messages & content

• Direct messages become end-to-end encrypted once both participants' devices finish an automatic trust setup step — at that point Central cannot decrypt them. Until that finishes (or if a device hasn't completed it), a DM falls back to a scheme Central could technically decrypt, though it doesn't do so as a matter of operation.
• Group chat messages are encrypted in transit and at rest, but Central technically has the ability to decrypt them: unlike DMs, the encryption key for a group chat is generated and held by Central rather than by your device.
• Messages and files sent in a server you join are stored by that server, not by Central.
• Uploaded media (avatars, banners, chat attachments) is served through signed, time-limited upload URLs rather than permanent public links.
• Your encrypted server list and app settings sync blob, encrypted client-side before it's uploaded.

Notifications & devices

• A push-notification token for each device you enable notifications on, plus your per-conversation, per-server, and friend-request mute/notification preferences.

Bots & integrations

• If you create a token-based bot or install a plugin bot, we store the bot's token/configuration and the specific per-user consent scopes you approve for it to act on your behalf.

Third-party feature data

• GIF search: text you type into the GIF picker is sent to Klipy to fetch results (Section 6).
• YouTube profile verification: if you choose to verify a YouTube channel link on your profile, Google OAuth is used to confirm you own it (Section 6).

Technical & diagnostic data

• Standard request metadata (timestamps, user-agent) may appear transiently in server or reverse-proxy logs depending on how a deployment is hosted. Central does not log or persist client IP addresses; an IP is only held in memory momentarily to key rate limits.
• The official clients do not bundle analytics, advertising, or crash-reporting SDKs, and do not use an advertising identifier (such as IDFA) or track you across other apps or websites.

Device permissions (mobile apps)

• Camera and microphone — for voice/video calls and Theater.
• Photos/storage — to select and share images in chat.
• Notifications, wake lock, and boot-received — to deliver call and message push notifications reliably.
• Each permission is requested by the OS only when the related feature is used, and can be revoked at any time in your device settings.

3.How we use your information

• To authenticate you, keep you signed in, and sync your encrypted server list and settings across your devices.
• To deliver direct messages and route push notifications for them, friend requests, and server activity you haven't muted.
• To operate the social graph, profile customization, personal expression tokens, and day-streak features.
• To protect the service, including rate-limiting, call-abuse detection, JWT validation, and permission-based access checks.
• To provide moderation and audit tooling to server admins, on self-hosted servers that enable it.

We do not sell personal information, and we do not use your data for advertising or ad-tech tracking of any kind.

4.Voice, video & screen sharing

Voice calls, video calls, and screen sharing use WebRTC, relayed through a LiveKit SFU. Media streams are relayed between participants in real time; Central does not record or store call audio or video.

Self-hosted server operators may run their own LiveKit/TURN infrastructure and could configure their own recording or fallback relays — check that server's own policy if this matters to you.

5.Push notifications

Mobile push notifications are delivered through the Expo push notification service to the token registered for your device. You control delivery per conversation, per server, and for friend requests; disabling a scope stops push delivery for it.

6.Third-party services

We share only the minimum data each of these needs to do its job, and don't permit them to use it for their own advertising:

• Klipy (api.klipy.com) — powers GIF search; your search text is sent to Klipy to return results.
• Google / YouTube OAuth — used only if you choose to verify a YouTube channel link on your profile.
• Expo push notification service — delivers mobile push notifications.
• LiveKit SFU and TURN/ICE relay infrastructure — relays real-time voice/video/screenshare media.
• Hosting, CDN, DNS, and TLS providers — underlying infrastructure for whichever deployment (Central, or a self-hosted operator's own choices) you're connected to.

7.Data security

• 2FA secrets, backup codes, and the key used for encrypted server-list sync are encrypted at rest.
• Server-list sync payloads, and direct messages once end-to-end encryption is active for that conversation (Section 2), are encrypted client-side before they ever reach Central. Group chat messages and any not-yet-upgraded DM are encrypted in transit and at rest using a key Central holds.
• HTTPS/WSS protects data in transit wherever a deployment has it enabled.
• Authentication uses JWTs; endpoints are protected by rate limiting and permission-based access checks.
• Uploaded media is served through signed, time-limited URLs rather than permanent public links.

No system is perfectly secure, and we can't guarantee absolute security, but these controls reflect how the software is actually built.

8.Retention & deletion

• You can remove most profile data yourself, in-app: avatar, banner, display name, activity/status, pronouns, nicknames/notes about others, blocks, and personal expression tokens.
• Presence data used to calculate day-streaks is kept on a rolling basis for about 400 days — long enough to re-derive streak milestones — and aged out after that.
• Self-hosted servers set their own message, file, and log retention and backup policies; where a server enables audit logging, entries are kept for that server's configured retention window and pruned automatically afterward.
• If an operator keeps backups, deleted content may persist inside those backups until they rotate out or are removed.
• You can permanently delete your Central account yourself, in-app, from Security settings on desktop or mobile. Deletion is self-service and requires confirming with a 2FA code or backup code, and it's irreversible: it removes your account, your direct messages (for both participants), and your own messages and membership in any group chats you belong to.
• If you own a group chat that still has other members, you'll need to transfer ownership to one of them first — the app tells you which group chats are blocking deletion and lets you transfer ownership right there.
• Files you've uploaded (avatar, banner, custom emotes/stickers) are removed from your account but aren't yet purged from underlying storage — we're working on closing that gap. For anything deletion doesn't cover, or if you can't complete it yourself, contact us (Section 14).

9.Your rights & choices

• Access or correct most of your profile and account data directly in the app.
• Revoke a passkey/WebAuthn credential, regenerate backup codes, or change your 2FA setup at any time from Security settings.
• Mute or disable push notifications per conversation, server, or friend request.
• Depending on where you live (for example under GDPR/UK GDPR or CCPA/CPRA), you may have additional rights to request a copy of, correct, or delete your personal data, or to object to certain processing. We don't sell or share personal information for cross-context behavioral advertising, so there's nothing to opt out of on that front — but you can still reach us (Section 14) to exercise any applicable right.

10.Children's privacy

CatRealm Central accounts are for adults age 18 or older. CatRealm does not currently collect birthdates or independently verify age. An app-store age rating, a device setting, or access provided by a parent or internet provider does not establish eligibility to use Central or replace CatRealm's obligations under applicable privacy law.

If you believe someone under 18 is using Central, email [email protected] privately with the details needed to identify the account. Do not send account secrets or sensitive evidence unless we ask for it through a secure channel. We will review the report and take appropriate steps within Central, including handling personal information as required by applicable law. For an independently operated Realm or a local Realm account, contact that Realm's operator.

11.International users

Central's services may be hosted in a different country than you live in; by using them, your data is processed there. If you connect to a self-hosted server instead, your data is processed wherever that operator has chosen to host it — the CatRealm project has no visibility into, or control over, that hosting location.

12.Self-hosted servers & bots

Every self-hosted CatRealm server is run by its own operator, who independently controls the messages, files, moderation actions, audit logs, retention windows, and backups on that server. Review that operator's own rules and policy — this document does not speak for them.

Bots you install or authorize, whether token-based or plugin-based, act only within the per-user consent scopes you explicitly grant. A bot's own developer or operator controls whatever it does with data off-platform, so review a bot's own disclosures before granting it scopes.

13.Changes to this policy

If we make material changes to this policy, we'll update the effective date above and note it in the Changelog.

14.Contact us

For questions about this policy or an access, correction, or deletion request, email [email protected]. For child-safety or other safety reports, email [email protected]. Please do not include passwords, 2FA codes, or backup codes. For matters hosted by an independent Realm, contact that Realm's operator.