Your privacy at Witcat

1. Who is responsible

Hector Gonzalez is the controller responsible for personal data processed by Witcat. He operates in Mexico, postal code 97205. This notice covers the Witcat iPhone app, the service that creates and stores courses, and witcatapp.com.

For privacy and data rights, contact privacy@witcatapp.com. For app or purchase support, contact support@witcatapp.com. You can use either channel without an active account.

2. Information we receive

Profile and sign-in: account and session identifiers, and the name and email Apple or Google shares when you register, including an Apple relay address. We do not receive your Apple or Google password. We use the available name as your editable initial profile name; we do not deliberately add it to AI requests.
Guest access: an identifier and session credentials connect your library, purchases and progress. Local credentials are protected in the device keychain. You do not need to provide an email to explore as a guest.
Material and courses: text, files, photos, audio and links you choose to submit; file names and metadata; captions, transcripts, extracted content, plans, questions, answers and generated explanations.
Activity: selected courses, answers, progress, level, experience points, streaks, coins, avatar, language and preferences. These support your study activities.
Purchases: purchase and customer identifiers, product, dates, trial or subscription status, renewal and restoration. Apple handles payment. Witcat does not receive your full card number.
Device and service: a notification token if you allow notifications, app version, job status, errors and technical connection, security and usage records. Infrastructure providers may process IP addresses and basic request information.
Optional measurement: pseudonymous installation and session identifiers, key app actions such as onboarding, paywall views and lesson completion, subscription events and amounts, app and operating system versions, and technical crash reports. AppsFlyer may derive approximate country, region or city from the connection IP address. When app attribution is enabled and linked, RevenueCat includes a pseudonymous account identifier in subscription events sent to AppsFlyer, including when iOS tracking is declined. The advertising identifier (IDFA) and individual sharing with advertising partners require iOS tracking permission. We disable IDFV collection in this integration.
Support: contact address, message and attachments you choose to send us.

We do not request contacts, precise location, medical information, identity documents or biometric data. Uploaded material may contain personal information. Review it and remove unnecessary sensitive information or other people's data. Do not use Witcat to submit medical records, passwords, private financial information or unauthorized recordings.

3. How we use information

Necessary purposes are authenticating you, maintaining your profile or guest session, receiving authorized material, generating and displaying courses, saving progress, verifying Plus and usage limits, delivering notices you request, providing support, handling rights and deletion requests, preventing fraud and securing the service. We also address legal obligations and legitimate claims.

We use optional product analytics to understand onboarding, feature use and retention; diagnostics to fix errors; and advertising measurement to attribute installations and subscription outcomes and improve Witcat campaigns, including on Instagram and other Meta services. These tools apply in app versions where they are enabled; an earlier version may not include them or their controls.

We do not send study material, questions, answers, file names, source links or email addresses to PostHog, Sentry or AppsFlyer as analytics payloads. We do not sell personal information for money. Sharing identifiers and conversion events with advertising partners may qualify as sharing or sale for targeted advertising under applicable state law. The choices below let you stop that sharing. We do not use your answers to make employment, credit, insurance, school admission or other legally significant decisions.

Generation is optional. The app asks for permission to process material with AI before sending it. You can go back without submitting it. Choosing not to request new generation prevents new material submissions; you can also delete courses or request account deletion. Withdrawing permission does not undo processing already lawfully performed.

4. Who processes information

We share information needed for each function with the following services, according to their roles and applicable obligations:

Convex and Railway: Convex maintains accounts, libraries, progress, temporary files and job status. The generation server runs on Railway and processes material to create courses.
Clerk, Apple and Google: They support the sign-up and sign-in option you choose. Clerk receives identity information shared by Apple or Google. To revoke Sign in with Apple when you delete your account, we temporarily store an encrypted Apple credential and remove it after completing that operation.
OpenRouter and AI providers: OpenRouter intermediates generation requests. OpenAI models generate plans and activities. NVIDIA Nemotron transcribes audio through DeepInfra and OpenRouter. Material, transcripts and necessary excerpts may be included in these requests. We do not deliberately attach your email, profile, sign-in credentials or purchase receipts.
Supadata: Receives the YouTube video identifier you provide to retrieve existing captions used to create the course. It does not receive your Google account or access your YouTube history.
Apple and RevenueCat: Process purchases, subscription status, restorations and associated identifiers to activate and verify Plus. When app attribution is enabled and linked, RevenueCat also sends subscription events, pseudonymous customer and AppsFlyer identifiers, currency and estimated amounts after store deductions to AppsFlyer. Sandbox purchases are excluded from the production integration.
PostHog: Processes a limited set of product events under a pseudonymous installation identifier to understand usage and retention. We disable session replay, automatic screen and interaction capture, person profiles and IP-based location enrichment. The app does not send your account UUID or email to PostHog.
Sentry: Processes limited app crash and error reports, and unexpected generation-server errors. Reports are stripped of user identity, study content, arbitrary error messages, request data and breadcrumbs; diagnostic stacks, error categories and app versions help locate failures. The app error-report switch controls device reports, not necessary server operation or security records.
AppsFlyer and Meta: AppsFlyer measures installations, sessions, limited progress milestones and subscription events supplied by RevenueCat. Approximate location can be derived from IP even when IP masking is enabled. With iOS tracking permission and usage measurement enabled, eligible events and identifiers can be shared with Meta to measure and optimize Witcat ads. We do not embed the Meta SDK or send your study material to Meta. Apple also supplies aggregate attribution reports through SKAdNetwork and AdAttributionKit.
Apple Push Notification service: Delivers authorized notifications using a device token and notification content.
Cloudflare and Namecheap Private Email: Cloudflare serves and protects the website. Namecheap hosts messages sent to our support and privacy addresses.

Witcat does not train models on your material. We request AI routes that do not use content for training and do not voluntarily enable that use. This does not mean zero retention: providers may keep security, abuse prevention, billing or legally required records. See OpenRouter, OpenAI and DeepInfra.

Providers may process data in the United States and other countries where they operate. We do not promise Mexico-only hosting. Processors receive instructions to provide their services; transfers to independent controllers are subject to applicable law and any required consent. We may also disclose information strictly needed to comply with a legal obligation, protect rights or address a real emergency. Users' private materials are not offered in a public catalogue.

5. Retention and deletion

Account, courses and progress: kept while you maintain the profile or session and courses. Deleting a course or account starts removal from active systems. Plans and derived excerpts that support later units remain part of a course even after the original file has been removed.
Generation files: removed when the processing that needs them finishes. An incomplete upload normally expires after 30 minutes. Failed-source cleanup normally has a 24-hour technical window; a paused job may need its material kept until it resumes, is cancelled or is deleted. These describe normal operation, not a promise of instant deletion during an outage.
Security and usage: minimal purchase, allowance, incident and deleted-account records may remain to prevent fraud, duplicate charges or reactivation by old events. They are separated from content when account linkage is no longer needed and kept for the corresponding need and applicable legal obligations.
Analytics and diagnostics: pseudonymous events and technical reports are retained for the period needed to analyze usage, campaign outcomes or incidents, subject to provider retention settings and valid deletion requests. We review continued need and remove data that is no longer needed. Turning measurement off does not delete previous reports. Recent PostHog and AppsFlyer identifiers remain on this device so you can copy them for a privacy request.
Support and backups: messages are retained while handling a request and as needed to document its resolution or a legal obligation. Backups may contain information predating a deletion during their retention and recovery cycle; they are not used to return that information to ordinary service. Recovery must respect accepted deletions.

Signing out or uninstalling the app does not request deletion of server data. Deleting your Witcat account does not erase records Apple must retain or automatically cancel a subscription. You can manage renewal with Apple.

6. Your choices and rights

You can edit your name and preferences, delete courses, use Delete account in Profile → Settings, and turn off permissions in iOS Settings. Contact us if you can no longer sign in.

Analytics and advertising choices

In versions with measurement, usage and ad measurement and device error reports start off. Before these tools collect data, we ask you to choose each option. You can continue with both off. To change your choices, tap the privacy link on the entry screen and open Analytics and privacy, or Profile → Settings → Analytics and privacy. These choices do not change Plus access or the price. iOS tracking permission is an additional, optional choice; you can refuse it or revoke it in iOS Settings. Without that permission, we disable IDFA and user-level partner sharing through this integration. Apple can count ad-driven installations without identifying you even when these options and ATT are off. Witcat registers the initial installation through Apple’s aggregate attribution API; this does not initialize the optional analytics SDKs or send a user ID. Apple may send privacy-preserving postbacks to the ad network and a copy to AppsFlyer.

Local controls stop new optional usage and error reports from the device. Subscription and partner preferences are synchronized with RevenueCat when the app can connect. If you revoke tracking in iOS Settings, reopen Witcat so the change can reach those services; server renewals may continue using the last synchronized preference until then. Previously sent events and Apple postbacks already scheduled cannot be recalled by a local switch.

For access or deletion of measurement history, copy the measurement IDs from that screen and contact privacy@witcatapp.com. The device keeps up to eight recent IDs per provider; a reinstall or cleared device storage can remove these references. Account deletion covers the account systems, but does not automatically locate every historical anonymous event in PostHog or AppsFlyer. Include the available IDs so we can process a provider deletion request. You can still contact us if you no longer have them; we will explain what can be located with proportionate verification.

You may also use that contact to opt out of sale or sharing for targeted advertising. A browser signal is not automatically linked to an installation in the app. Our public website does not send advertising events or identifiers, including when Global Privacy Control is enabled.

In Mexico, you can exercise access, rectification, cancellation and objection rights (ARCO), withdraw consent and limit data use or disclosure by contacting privacy@witcatapp.com. Describe your request, the account or session concerned and how to reply. For corrections, specify the change. We verify identity or representation using proportionate information; do not send passwords or complete identity documents before we explain a suitable method.

We will communicate our decision within 20 business days after receiving a complete request and, where approved, implement it within the following 15 business days, subject to justified extensions allowed by law. We will explain any exception. You may contact Mexico's competent data protection authority.

In the United States, depending on your state and whether its law applies, you may have rights to access, correct, delete or obtain a portable copy of data and to appeal a decision. Use the same email, including through an authorized agent where applicable. We follow applicable deadlines and conditions and do not penalize you for exercising a right. You may request review of a denial by explaining your appeal.

7. Teens and families

Witcat is intended for people aged 13 and over. Users under 18 need permission from a parent or legal guardian to use the service and its AI features. It is not intended for children under 13. The store age rating does not replace these requirements.

Minors should not upload classmates' data, identity documents, intimate information or third-party recordings without the necessary permissions. Parents and guardians can contact privacy support to ask about data processing or request account closure, subject to verification of their relationship and applicable rights. If we discover data from a child under 13, we will take steps to stop further processing and delete it, except where retention is legally required.

8. Security, permissions and the website

We use account-based access controls, encrypted connections, limited permissions and credential protection. Operational access to information is limited to necessary service, support and security tasks. No system offers absolute security. If we identify a breach requiring notification, we will act in accordance with the law.

Camera, photos, microphone and notification access depend on the feature you choose and iOS permission. Access to a photo does not publish your library. Disabling a permission may prevent that feature from working.

The public website uses HTML, CSS and local scripts for presentation and media, without advertising cookies, a Meta pixel or our own cross-site tracking tools. Cloudflare may process network information needed for security and delivery. A YouTube player loads only when you choose to play its video, using the privacy-enhanced domain. Website controls and browser signals do not replace the app measurement and iOS permissions described above.

9. Changes to this notice

We publish updates here with their date. Material changes to purposes, recipients or processing will be communicated through an appropriate channel, and we will request fresh consent when required. The English and Spanish versions are intended to provide the same information; a translation does not reduce your statutory rights.