OwlCat Club — Privacy Policy

1. Controller

OwlCat Club, operated by [OWNER: legal entity + registered address], is the data controller for all OwlCat apps (Stories, Films, Games, Habits, Shop, Accounts) served under owlcat.club and its subdomains. One controller, one policy, across the ecosystem.

2. Data we collect

• Identity & account: email, display name, authentication identifiers (Google, Telegram), and identifiers we assign. Telegram chat id is used server-side only for notifications and is never exposed to the browser.
• Usage & content: prompts, generated stories/images/audio/video, uploaded reference images (including a photo you provide to base a character on, which may be a photo of your child), voice samples / cloned-voice references, game and habit activity.
• Billing: token balance and ledger, purchases, subscriptions. Card details are handled by Stripe — we do not store card numbers. Telegram Stars payments are handled by Telegram.
• Technical: IP address, device/browser info, and cookies (§7) for security and preferences.

3. Why we process it (purposes & legal bases)

• Provide the services you request (contract).
• Process payments and subscriptions (contract).
• Security, fraud prevention, and abuse/IP-safety filtering (legitimate interests / legal).
• Notifications you opt into (consent).
• Improve the Platform using de-identified data (legitimate interests).
• Comply with legal obligations.

4. Third-party processors

AI providers. To produce the content you ask for, your prompts and the media you upload — including photos you provide — are sent to the AI providers that run the generation: Google (image understanding and image generation), Microsoft Azure OpenAI / OpenAI (text and image generation), and ElevenLabs (voice generation & transcription). We have data-processing agreements with these providers under their business terms.

Operational providers. We also use Stripe (payments), Telegram (auth, Stars, notifications), Lulu (print-on-demand), and our hosting/infrastructure providers. These receive only the data their function needs (e.g. payment, authentication, shipping) — we do not send them your children's photos or your generated stories/content.

5. International transfers

Some processors are outside your country/the EEA. Where required we rely on appropriate safeguards (e.g. Standard Contractual Clauses). [OWNER: confirm mechanisms.]

6. Retention

We keep personal data only as long as needed for the purposes above or as required by law. Generated content and account data are retained while your account is active; you may delete your account in settings. Some records (e.g. billing) are retained for statutory periods.

Uploaded reference photos are transient. A photo you upload to base a character on is used only to generate that character and is deleted right after processing; we keep only the generated, stylized result — not your photo. It is still sent to the AI providers in §4 to perform the generation. [OWNER: confirm this transient-photo handling holds across every OwlCat app, not only Stories.]

7. Cookies & similar technologies

We ask for your cookie choice once for the whole OwlCat ecosystem — a single consent recorded on the parent domain (.owlcat.club) applies across all subdomains, because they are operated by one controller and use the same cookie categories and vendors. If we ever add a new category or vendor, we will ask again. See the Cookie settings page for the full category breakdown.

Categories:

• Essential (always on, no consent required): authentication/session (owlcat-id SSO cookie; per-app session cookies), CSRF/anti-forgery, and short-lived flow cookies (e.g. sso-attempted). The Platform cannot function without these.
• Functional (consent): preferences such as theme (owlcat-theme) and language (owlcat-locale), and your consent record itself (owlcat-consent).
• Analytics (consent): none currently in use. [OWNER: if analytics are added, name the vendor here and it becomes a distinct consent category.]

You can change or withdraw your choice at any time via the cookie settings link in any app. We keep a record of your consent (version, categories, timestamp) as proof.

8. Your rights (GDPR)

You have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to withdraw consent. Contact info@owlcat.club; you may also complain to your local data-protection authority.

9. Children

We follow GDPR provisions for children’s data and COPPA principles. We do not knowingly collect a child’s data without verified parental consent. Content depicting minors requires the consent of a parent/guardian (see ToS §11, §16).

9a. Photos & special-category data (Art. 9)

When you upload a photo to base a character on, that photo is a facial image and is treated as special-category data (GDPR Art. 9) — for a child, biometric data of a minor. Our only legal basis for processing it is your explicit consent as the parent or legal guardian (or with the depicted person’s explicit permission), which we ask for and record at the moment of upload (versioned and timestamped).

The raw photo is transient: it is used only to generate the stylized character and is deleted shortly after processing — never published or shared. We keep only the generated, stylized illustration (not a photographic copy), and we do not create or store biometric templates or run facial recognition. You can withdraw consent and have the generated character and any residual photo erased at any time (see §8). The image providers that render the illustration are listed in §4; a Data Protection Impact Assessment for this feature is maintained internally. [OWNER: confirm DPIA sign-off + Art. 9 consent wording with DPO.]

10. Changes to this policy

We may update this policy; material changes are announced in-app and by email with a new version and effective date. See the ToS §19 for how re-acceptance works.

11. Contact

info@owlcat.club · [OWNER: DPO / legal entity + address].