OwlCat Club — Privacy Policy

1. Controller

OwlCat Club, operated by Owl & Cat, is the data controller for all OwlCat apps (Stories, Films, Games, Habits, Shop, Accounts) served under owlcat.club and its subdomains. One controller, one policy, across the ecosystem.

2. Data we collect

• Identity & account: email, display name, authentication identifiers (Google, Telegram), and identifiers we assign. A Telegram chat id is used server-side only, for notifications, and is never exposed to the browser.
• Usage & content: prompts, generated stories/images/audio/video, uploaded reference images (including a photo you provide to base a character on, which may be a photo of your child), voice samples and cloned-voice references, game and habit activity.
• Billing: your subscription and its usage allowance, purchases and the ledger behind them. Card details are handled by Stripe — we do not store card numbers. Telegram Stars payments are handled by Telegram.
• Technical: IP address, device and browser information, and cookies (§7) for security and preferences.

3. Why we process it (purposes & legal bases)

• Provide the services you request (contract).
• Process payments and subscriptions (contract).
• Security, fraud prevention, and abuse / IP-safety filtering (legitimate interests, legal obligation).
• Notifications you opt into (consent).
• Improve the Platform using de-identified data (legitimate interests).
• Comply with legal obligations.

4. Third-party processors

AI providers. To produce the content you ask for, your prompts and the media you upload — including photos you provide — are sent to the AI providers that run the generation: Google (text, image understanding, image generation, speech), Microsoft Azure OpenAI / OpenAI (text and image generation) and ElevenLabs (voice generation and transcription). We have data-processing agreements with these providers under their business terms.

Operational providers. We also use Stripe (payments), Telegram (authentication, Stars, notifications), Lulu (print-on-demand), PostHog (product analytics, EU hosting, only with your consent), YouTube / Google (the public gallery, §10) and our hosting and infrastructure providers. Each receives only the data its function needs — we do not send them your children's photos or your generated stories.

5. International transfers

Some processors are outside your country or the EEA. Where required we rely on appropriate safeguards — for providers in the United States the European Commission's Standard Contractual Clauses, together with the provider's own certification under the EU–US Data Privacy Framework where it holds one.

6. Retention

We keep personal data only as long as needed for the purposes above or as required by law. Generated content and account data are retained while your account is active; you may delete your account in settings. Some records (for example billing) are retained for statutory periods.

Uploaded reference photos are transient. A photo you upload to base a character on is used only to generate that character and is deleted right after processing; we keep only the generated, stylized result — not your photo. It is still sent to the AI providers in §4 to perform the generation. This holds in every OwlCat app that accepts a photo.

7. Cookies & similar technologies

We ask for your cookie choice once for the whole OwlCat ecosystem — a single consent recorded on the parent domain (.owlcat.club) applies across all subdomains, because they are operated by one controller and use the same cookie categories and vendors. If we ever add a new category or vendor, we will ask again. See the Cookie page for the full category breakdown.

Categories:

• Essential (always on, no consent required): authentication and session (the owlcat-id SSO cookie; per-app session cookies), CSRF / anti-forgery, and short-lived flow cookies (for example sso-attempted). The Platform cannot function without these.
• Functional (consent): preferences such as theme (owlcat-theme) and language (owlcat-locale), and your consent record itself (owlcat-consent).
• Analytics (consent): PostHog (EU hosting) — product analytics that only run after you accept this category. It records which screens and actions are used, never the content you generate.
• Embedded video (consent): the gallery plays stories from YouTube; the player loads only when you press play (§10).

You can change or withdraw your choice at any time via the cookie settings link in any app. We keep a record of your consent (version, categories, timestamp) as proof.

8. Your rights (GDPR)

You have the right to access, rectify, erase, restrict, port and object to the processing of your personal data, and to withdraw consent. Write to info@owlcat.club; you may also complain to your local data-protection authority.

9. Children

We follow the GDPR provisions for children's data and COPPA principles. We do not knowingly collect a child's data without verified parental consent. Content depicting minors requires the consent of a parent or guardian (see the Terms, §11 and §16).

A child is not a user here: there is no sign-up, no sign-in and no profile a child operates (Terms §3). What we hold about a child is what a parent entered so that content could be made for them, and a parent can correct or erase it at any time.

9a. Photos & special-category data (Art. 9)

When you upload a photo to base a character on, that photo is a facial image and is treated as special-category data (GDPR Art. 9) — for a child, biometric data of a minor. Our only legal basis for processing it is your explicit consent as the parent or legal guardian (or with the depicted person's explicit permission), which we ask for and record at the moment of upload (versioned and timestamped).

The raw photo is transient: it is used only to generate the stylized character and is deleted shortly after processing — never published or shared. We keep only the generated, stylized illustration (not a photographic copy), and we do not create or store biometric templates or run facial recognition. You can withdraw consent and have the generated character and any residual photo erased at any time (see §8). The image providers that render the illustration are listed in §4; a Data Protection Impact Assessment for this feature is maintained internally.

10. YouTube

Our public gallery runs on YouTube API Services. When you ask us to publish a story, we render it to a video and upload it to our own YouTube channel with our own credentials: the video, its title, description, tags and language are sent to YouTube. We never ask for access to your YouTube account, we do not read or store YouTube account data, and we do not use the API to collect anything about the people who watch.

Playback is embedded from youtube-nocookie.com and only after you press play, so YouTube sets nothing in your browser until you choose to watch. Once the player loads, YouTube processes the data described in the Google Privacy Policy as an independent controller, and the YouTube Terms of Service apply to your use of the player. If you have ever granted an app access to your Google account, you can review and revoke it at Google account permissions.

Publishing is opt-in and reversible: a story goes public only with your explicit consent, and a request to info@owlcat.club removes the video from the channel and the story from the gallery.

11. Changes to this policy

We may update this policy; material changes are announced in the app and by email, with a new version and effective date. See the Terms, §19, for how re-acceptance works.

12. Contact

info@owlcat.club · Owl & Cat. Write to the same address for any privacy request — it reaches the person responsible for data protection.