Privacy Policy

1. Who we are

Desksquattaz ("we", "us", "our") is a Windows desktop application operated by:

Gloria Cai
Hermann-Müller-Würtz-Straße 36, 76189 Karlsruhe, Germany
hello@desksquattaz.com

We are the data controller for personal data processed through the Desksquattaz app and website (desksquattaz.com).

2. What we collect

• Account data (website and app): email address, authentication provider (Google, Apple), account creation date, subscription status. An account is not required to download the installer. Sign-in is asked inside the app.
• On-device app data: the chat history and the cat's memory, plus cat runtime state and icon-role assignments, are stored as plain text in state.json in the app's local data folder. The Supabase sign-in token is the only field taken out of that file and encrypted (Electron safeStorage, in secrets.enc). The memory is not encrypted. We do not keep a server-side database of your cat's memory of you.
• Cat-net calls (app): Cat-net calls are not chats with your cat. During a call the app sends lines of text (the cat's or yours, up to 280 characters), a display name, a call id, a device session id, and invite codes. They are stored in our Supabase database, in the tables cat_call_lines, cat_calls, cat_presence, cat_invites, and cat_friends. The two accounts on the call can read that call's lines. We can read the stored rows, because the Cat-net function uses a server key. Other accounts cannot read the tables. Invite codes stop working after 45 minutes. The code does not delete call lines automatically, so they are kept until deleted.
• Cat Plan chat (in transit): the app sends the current message and a memory brief through our Supabase llm-proxy. The proxy reads the Supabase user id from the sign-in token. The server chooses the lane. The code's default models are OpenAI gpt-6-luna on the global lane and DeepSeek deepseek-v4-flash on the mainland China lane. When the message cues a stored memory, that brief is cut to 400 characters. Other briefs are not cut to that length in the code. The chat history is not sent. Image prompts for postcards and paintings go to OpenAI gpt-image-2.5-flare. The proxy does not log or store request or response bodies. It records a cost figure and a call count against the user id. App-watch comments may include an app or process name, not window titles or document contents.
• Browser raid: on an allowlisted page, the app opens the address and scrolls. To expand a Google overview it reads the button's label (its text or aria-label). Page text is not uploaded.
• Logs and crash reports: diagnostic notes and crash dumps stay on the device. The crash reporter is started with upload turned off, so those bodies are not uploaded.
• Approximate location (optional): if you click "Use this machine" next to the weather city in the app's settings, the app asks Windows for this computer's location once. It rounds the coordinates to about 1 km and sends them to OpenStreetMap's place-name service (see section 5) to find the nearest town. Only the town name is kept, in local app data; the coordinates are discarded. Nothing is sent unless you click the button, and you can always type a city yourself instead.
• Subscription / payment data: subscription status and billing period dates. Card details are held by Dodo Payments (merchant of record), not by us.
• Download waitlist (website): if you join the waitlist on the download page, we store the email address you enter, whether it was entered on a phone or a computer, and the date. We use it only to send you the download link when Desksquattaz opens to the public.
• Mac waitlist (website): if you leave an email on the Mac page, we store that address and the date. We use it only to tell you when a Mac build exists.
• Campaign measurement (website): an anonymous id kept in this browser’s local storage, plus the campaign parameters on the link you followed (source, medium, campaign, content). We store which of a fixed set of actions happened: a page view, opening the playground, finishing it, or clicking toward the download. No cookies, no advertising identifiers, and no cross-site tracking.
• Install measurement (app): after you sign in, the app sends an anonymous install id, the operating-system version, and the calendar day, once on the day you install and once on each later day you open it. We attach that to the campaign already stored on your account at download. It does not include your name, your files, or anything on your screen.
• Website statistics: aggregated, cookieless page-view and button-click counts (for example, how many visitors opened the download page). No cookies, no advertising identifiers, and no cross-site tracking. We cannot identify you from them.
• In your browser only: the website remembers a motion preference and which website easter eggs you have found in your browser's local storage. Those two stay on your device. The anonymous campaign id in the campaign-measurement item above is the exception: that one is sent to us.

3. How we use your data

We process data under GDPR Article 6 on these bases:

• Account and subscription data — performance of contract (Art. 6(1)(b)): to provide the service and manage billing.
• Chat / AI processing — performance of contract (Art. 6(1)(b)): to generate responses when you use chat.
• On-device memory and desktop features — performance of contract / legitimate interests (Art. 6(1)(b)/(f)): core product behaviour.
• Download waitlist and Mac waitlist — consent (Art. 6(1)(a)): you give it by submitting the form, and you can withdraw it at any time by emailing us.
• Campaign and install measurement — legitimate interests (Art. 6(1)(f)): knowing which link led to a download and whether the desk is still running a day and a week later. The records are the anonymous ids and campaign labels described above.
• Website statistics — legitimate interests (Art. 6(1)(f)): understanding which pages help people decide, using cookieless aggregate counts only.
• Legal compliance — legal obligation (Art. 6(1)(c)) where required.

We never sell your data. We do not use your chats to train our own AI models.

4. Desktop access

With your consent during onboarding, the app may read and reposition desktop icons, and it places three shortcuts on the Desktop: My Stash, Litterbox, and Cat Bowl. Each one opens a folder that stays on your device. On Cat Plan, and only if you allow it in Settings (off until you turn it on), it also samples which application is in the foreground (process / friendly name only) for humour patterns. Until you allow it, nothing about your foreground app is read. Those shortcuts, the folders they open, and those patterns stay on your device.

5. Third-party services and transfers

• Supabase (processor) — authentication, subscription profile storage, Cat-net rows, and the usage counts from Cat Plan chat (a cost figure and a call count against the user id). The llm-proxy runs here and forwards chat and image requests. It does not store those request or response bodies. US-based. Transfers covered by Standard Contractual Clauses (SCCs) and, where applicable, the EU–US Data Privacy Framework.
• Vercel — website hosting and cookieless website statistics (Vercel Web Analytics). Transfers covered by SCCs and, where applicable, the EU–US Data Privacy Framework.
• Dodo Payments — web subscription billing. We do not store card details.
• Cloudflare — stores and serves the Windows installer and the in-app updates (Cloudflare R2). It receives your IP address and the file requested each time you download the installer or the app checks for an update. Transfers covered by SCCs and, where applicable, the EU–US Data Privacy Framework.
• Resend — sends the weekly cat photo and painting to the email on your account, only if you turn on "Email new cat pics" in the app (US-based). It receives your email address and the picture. Transfers covered by SCCs.
• OpenAI (processor) — model provider for Cat Plan chat on the global lane (default model gpt-6-luna) and for postcard and painting images (gpt-image-2.5-flare). US-based. The current message, the memory brief, or the image prompt is transmitted to generate the reply or the picture. Transfers covered by SCCs and, where applicable, the EU–US Data Privacy Framework.
• DeepSeek (processor) — model provider for Cat Plan chat on the mainland China lane (default model deepseek-v4-flash). China-based. The server selects this lane when your connection comes from mainland China, when the system or interface language is Simplified Chinese, or when you choose that route in the app. The client cannot name DeepSeek as the provider itself. Everyone else uses OpenAI.
• OpenStreetMap Foundation — runs Nominatim, the place-name service the app asks when you click "Use this machine" for the weather city (UK-based). It receives your rounded coordinates and your IP address for that one request. See the OpenStreetMap Foundation privacy policy.
• Open-Meteo — weather service used when weather comments are on. The app sends it the city name you set, to find the city's coordinates, and then those coordinates, to fetch current conditions (up to every 15 minutes). The Territory app uses the same city lookup to place its map. Your IP address is visible to it with each request.
• OpenFreeMap — map tiles for the street view in the Territory app. When the street map loads, it receives requests for the map area on screen (around your weather city or this machine's location, if you chose "Use this machine" there) and your IP address. Map data © OpenStreetMap contributors.
• Apple / Google — identity providers. You can sign in with one of them inside the app. Downloading the installer does not require an account.

Desksquattaz is distributed as a direct Windows download. We do not sell subscriptions through the Microsoft Store, Apple App Store, or Google Play.

6. Data retention

On-device data, including the plain-text chat history and memory in state.json, remains until you clear app data or uninstall. Cat-net call lines are kept until deleted: the code does not delete them on a timer. Invite codes stop working after 45 minutes. Website account and subscription records are retained while your account exists and as needed for billing / legal obligations. You may request account deletion by emailing hello@desksquattaz.com; we aim to process within 30 days. Waitlist emails are deleted within 30 days after we send the download link, and in any case no later than 12 months after you signed up, or sooner if you ask.

7. Your rights

You may request access, deletion, correction, restriction, portability, or objection where applicable. Contact hello@desksquattaz.com. We respond within 30 days.

8. Data breach notification

Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg) within 72 hours where required, and affected users without undue delay where the risk is high.

9. Supervisory authority

You may lodge a complaint with your local supervisory authority. For us in Germany: LfDI Baden-Württemberg, Königstraße 10a, 70173 Stuttgart — baden-wuerttemberg.datenschutz.de.

10. Children

Desksquattaz is for everyone and has no minimum age. Signing in uses an Apple or Google account, which follow their own age rules; younger children can use an account their parent manages (Apple Family Sharing, Google Family Link). Where the law of your country requires a parent's or guardian's consent for a child to use online services, they need to give it. A parent or guardian can contact us at any time to have a child's account and data deleted.

11. AI transparency

Chat features use artificial intelligence. The in-app chat UI shows a persistent AI indicator (EU AI Act Art. 50).

12. Changes

We may update this policy. Significant changes will be noted on this page or by email. Continued use after the update constitutes acceptance.

13. Contact

Email: hello@desksquattaz.com
Post: Gloria Cai, Hermann-Müller-Würtz-Straße 36, 76189 Karlsruhe, Germany