1. Data Controller
MiauMiau is operated from the Netherlands. For the purposes of the General Data Protection Regulation (GDPR), MiauMiau acts as the data controller for all personal data processed through our application and website.
Contact: [email protected]
2. What Data We Collect
We collect only the data necessary to provide and improve our service:
Account Information
Email address and display name (provided during sign-up via email, Google, or Apple OAuth). We do not store passwords — authentication is handled via OAuth providers or magic links.
Cat Health Data
Cat profiles (name, breed, age, weight), health records (vaccinations, medications, vet visits), daily check-ins, feeding logs, AI health advisor conversations, and media you choose to upload (photos, videos, and audio notes). This data is stored solely to provide the service and is never sold.
Usage Analytics
On this website we use PostHog, hosted in the EU, to measure page views, where visits come from, and which links lead to app downloads. Only if you choose "Accept" on the cookie banner does PostHog store a random identifier in your browser (a cookie and local storage) to tell repeat visits apart, and do we remember which campaign brought you to the site. If you decline, or haven't chosen yet, the visit is counted without storing anything in your browser. IP addresses are anonymized, we do not build profiles of website visitors, and we do not use this data for advertising. In the mobile app, optional product analytics, crash, performance, and masked session diagnostics are collected only if you enable Analytics & Improvements. Mobile analytics may be associated with your app account after you opt in, but we do not use it for advertising or cross-app tracking.
Install Attribution
To understand which marketing campaign led you to install the app, we measure attribution using Apple Ads (via Apple's AdServices API), Apple's SKAdNetwork, and campaign parameters carried from our own website links, and we store the resulting campaign, source, and keyword with RevenueCat, our subscription provider. If you choose "Accept all" in the app's privacy choices, we also use Tenjin, a mobile measurement provider, to connect installs, trial starts, purchases, and renewals to the campaigns that led to them. For this, Tenjin receives a device identifier (the identifier for vendor, IDFV), your IP address, Apple's attribution data, and subscription events from RevenueCat. We do not use the advertising identifier (IDFA), we do not ask for App Tracking Transparency permission, we never track you across other companies' apps, and we never sell your data or share it with data brokers. You can switch this off at any time by choosing "Essential only" in the app's privacy choices.
Food Search Queries
Search terms entered in our cat food database are logged anonymously to improve search relevance and product coverage. These queries are not linked to user accounts.
3. How We Process Your Data
Core account, cat, and health records are processed on servers located within the European Union. Our primary infrastructure is hosted on Hetzner Cloud in Germany. Selected third-party providers may process limited data outside the European Economic Area when needed for authentication, subscriptions, diagnostics, storage, email, or AI features; those transfers are covered by appropriate contractual and security safeguards.
Data is encrypted in transit (TLS 1.3) and at rest. Photo metadata (EXIF data including location) is stripped upon upload.
4. Third-Party Services
We work with a minimal number of carefully selected third-party providers:
PostHog
Website analytics and optional mobile product analytics (EU-hosted)
Website: page views and referral source; a random browser identifier is stored in a cookie and local storage only if you accept cookies. IP addresses are anonymized. App: events, screen views, device/app information, and account identifier when Analytics & Improvements is enabled. Not used for advertising or cross-app tracking.
Resend
Transactional email delivery
Email address only, for sending account-related emails (email verification and magic-link sign-in).
Google OAuth / Apple Sign In
Authentication
We receive your name and email from the OAuth provider. We do not access any other account data.
RevenueCat
Subscription management and install attribution
App user ID, product identifiers, entitlement status, purchase status, and marketing attribution (the campaign, source, and keyword that led to your install). When you choose Accept all, also your device identifier (IDFV) and IP address, and RevenueCat forwards subscription events to Tenjin and PostHog for measurement. Payment card details stay with the app stores. Not used for cross-app tracking; no advertising identifier (IDFA) is collected.
Tenjin
Optional install attribution for our marketing campaigns
Device identifier (IDFV), IP address, Apple attribution data, and subscription events (trial starts, purchases, renewals), only when you choose Accept all. No advertising identifier (IDFA); not used for cross-app tracking.
Cloudflare R2
Private media storage
Photos, videos, and audio notes you upload, stored under user-scoped object keys.
Sentry
Optional crash and performance diagnostics
Device, app, error, performance, and masked session diagnostic data when Analytics & Improvements is enabled.
OpenRouter
AI gateway powering the AI advisor and scan analysis. OpenRouter routes requests to underlying large language model providers on our behalf.
Prompts, cat context, uploaded media, and generated responses when you request AI-powered features. Processed only with your consent; you can withdraw consent at any time by deleting your account.
Google Gemini Embedding 2
Embedding generation for semantic memory, personalization, and image/vector search.
Text and media-derived embedding inputs needed to index or retrieve your own app content. Gemini is not used for chat or vision analysis outside embeddings.
5. Data Retention
Account data (profile, cat health records, AI conversations) is retained for as long as your account is active. When you request account deletion, all personal data is permanently erased within 30 days.
Optional website analytics are anonymized and aggregated. Optional mobile analytics and diagnostics are retained by our processors for product improvement and reliability, and can be disabled at any time in the app privacy settings.
6. Your Rights Under GDPR
As a data subject, you have the following rights:
- Right of Access — Request a copy of all personal data we hold about you.
- Right to Rectification — Request correction of inaccurate or incomplete data.
- Right to Erasure — Request deletion of your personal data ("right to be forgotten").
- Right to Data Portability — Receive your data in a structured, machine-readable format.
- Right to Restriction — Request limitation of processing in certain circumstances.
- Right to Object — Object to processing based on legitimate interests.
To exercise any of these rights, email [email protected] or use the data management options in the app settings. We will respond within 30 days.
7. Cookies
We do not use advertising or cross-site tracking cookies. We set strictly necessary session cookies for authentication when you are logged in, and we remember your cookie choice in your browser. Analytics cookies are optional: only if you choose "Accept" on the cookie banner does PostHog store a random identifier in a cookie and in local storage, and do we store which campaign brought you to the site. IP addresses are anonymized and the data is not used for advertising. To change your choice, clear this site's data in your browser and the banner will ask again.
8. Children's Privacy
MiauMiau is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.
9. Changes to This Policy
We may update this privacy policy from time to time. We will notify you of significant changes via email or an in-app notification. The "last updated" date at the top reflects the most recent revision.
10. Contact
For any privacy-related questions or concerns, contact us at [email protected].
If you are unsatisfied with our response, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your local supervisory authority.