Privacy
MeowStreets is a game, not an advertising business. This page says what the city stores, who else sees it, and how long it lasts. It is written against the code that does the storing.
What an account holds
A cat name, an email address, and a password. The password is stored only as a scrypt hash and cannot be read back. The email address is never verified and never mailed: it exists so you can sign in with it and so an account can be recovered, and nothing sends you anything.
Everything else on an account is the game itself — cash, stats, inventory, crew, the lot.
What a visit records
Signing in writes a session row holding your IP address and browser user agent. That is what lets the city tell one connection from another and what makes a ban enforceable. Sessions expire after seven days and the sweep deletes them.
Chat is stored so the room has history. Messages are deleted after thirty days, except a message that was reported or hidden — moderation history has to survive the message it is about.
Who else sees any of it
- PostHog — product analytics. It receives aggregates and events, never chat contents, never a password or recovery code, and never free text you typed. Session replay masks every input and the chat transcript. A browser sending Global Privacy Control or Do Not Track is opted out before the first event is queued, and nothing in the game asks you to change that.
- Reddit — if you arrived from a Reddit ad, the sign-up is reported back so the ad can be counted. What is sent is the click identifier that came in the link and a browser user agent. It is sent from the server; there is no Reddit tracking script on this site.
- Discord — a private operator feed mirrors sign-ups and activity to the people who run the city. A sign-up carries the cat name, email address, IP address and user agent.
- Cloudflare — DNS and TLS sit in front of the site, so it handles the traffic in transit, and it injects its own analytics beacon into pages served through it.
Nothing is sold, and nothing is shared with anyone not listed above.
Cookies and local storage
One cookie, meow_session: it is what keeps you signed in, it is HttpOnly and SameSite=Strict so no other site can read or send it, and it lasts seven days. There is no advertising cookie, and no consent banner, because there is nothing to consent to.
Two things are kept in your browser's own storage rather than sent: PostHog's analytics identifier, and — only if you arrived from an ad — the click identifier from that link, for thirty days.
How long things are kept
- Sessions — seven days, then deleted.
- Chat messages, city events and the staff action log — thirty days.
- Attacks, finished trades, heists, deposits and loans — ninety days.
- Moderation decisions and the money ledger — one hundred and eighty days.
- The account itself — until it is deleted.
The sweep runs every minute, so these are the real ages of the data rather than a policy nobody enforces.
Deleting an account
Ask, and the account is deleted: the name is freed, the email address and password go, and what is left of the cat in shared history is anonymised so other players' records still make sense. Write to [email protected] from the address on the account.
The same address is the one to use for a copy of what is held, or for anything else on this page.
Children
MeowStreets is not directed at children under 13 and accounts are not knowingly created for them.