Privacy
MeowStreets is a game, not an advertising business. We do not sell your data and we never have. We do advertise the game, and that means a little of what you do here is measured — all of it is on this page. Here is everything we hold.
What we collect
- Your account — a cat name, an email address and a password. The password is stored only as a salted hash and cannot be read back. You can sign in with the email address, and we write to it for a link to confirm it is yours and a password reset link when you ask for one. We may also send you occasional marketing email about MeowStreets — news, a bonus on a purchase, or a gift to come back and play. Every one of those has an unsubscribe link, and we keep a record of when you used it so you are not written to again. Unsubscribing never stops the confirmation and reset emails.
- Your birthday, if you give it on the Account page — the day and the month, never the year. On it each year the game sends you one email to say happy birthday, with a link to claim your cat's birthday presents. That email is marketing like the rest: it goes only to a confirmed address, it has the unsubscribe link, and unsubscribing stops it and the presents with it. You set it once; to change it, write to us. It is kept until the account is deleted.
- Your sign-ins — your IP address and browser user agent, each time you sign in, kept as a history for as long as the account exists. That is what makes a ban enforceable and lets us look into cheating and stolen accounts.
- The game itself — cash, stats, inventory, crew, hideout, chat, and the record of what you did to other cats. A multiplayer game is other players seeing what you did. That includes membership: while you hold the Fat Cat Membership, the gold paw and gold name beside your cat show every other player that you are a member. If you played in the city's first days, your cat name may appear on the public front page in its "Recent activity" strip, next to a made-up line about city life. Ask and we take it off.
- Cat Cafe pictures, and only if you upload one — the picture and its caption. We re-encode every upload, which strips the camera's metadata, including any location, and keep only the re-encoded copy. Staff review it before it goes up; once it is on the wall, anyone can see it, with your cat's name, until you take it down.
- Your purchases, and only if you buy a paid extra — what you bought, when, for how much and whether it was refunded, with Creem's references for the order and, for a membership, for the subscription, so a refund or a cancellation can be matched to your account. Never your card details.
- Analytics — which screens you opened each day, and how many of each kind of action you took, counted in blocks of 3 hours. Never your chat, never free text you typed, never a password.
- Your API keys, and only if you make one — the name you give each key, what it may read, when it was made and when it was last used. The key itself is never stored, only a one-way hash of it, and revoking a key deletes all of this. Making or revoking a key is noted in your sign-in history, with the IP address and browser it came from.
- Your Discord account id and handle, and only if you choose to link one. Held until you unlink or delete your account, and used to set your nickname and roles in our Discord server. The code that performs the link is held as a one-way hash and deleted when it expires.
- An advertising click identifier, and only if you arrived from an ad. Your browser keeps it for 30 days or until you sign up, and it goes with each visit and with your sign-up to our analytics, which keeps it on your analytics profile so a later purchase can be matched to the ad. It is never stored on your account.
- Whose link you signed up through, and only if you came in through another cat's link (meowstreets.com/r/…). Kept on your account, with the day the city paid them, so that cat can be paid once when you reach level 10; that cat sees your name, level, look and when you were last seen on their Cat Flap page, as anyone can on your profile.
- Ad measurement — a one-way hash of your email address and of your account number, kept on your analytics profile so that a visit, a sign-up and a purchase can be matched to the ad that brought you. This is on for everyone; the Your choices section is how to object.
We do not ask for your real name, your date of birth, your address or your phone number. If you buy one of the paid extras, Creem takes the payment, so your card details never reach us.
Who else sees it
- Hetzner (Germany) — the server and database run on their hardware.
- PostHog (US) — analytics. Receives events and your IP address. Session replay records only visitors and new players, leaves the chat out entirely and masks every input and every email address and IP address on the page.
- Resend (US) — sends those emails, so it receives your email address, your cat name and the message.
- Amazon SES (AWS) — an additional email delivery provider. When used to send a message, it receives your email address, your cat name and the message.
- Creem — the payment processor, which sells the paid extras to you as merchant of record, and only if you buy one. You give it your email address, your payment details and your billing country directly; it tells us which account made the purchase.
- Cloudflare — DNS and TLS in front of the site, so it handles traffic in transit. It may also add its own Web Analytics script to our pages, which counts page views without a cookie. It also holds our backups, in the European Union. They are encrypted before they leave the server, and Cloudflare is not given the key.
- Discord — a private channel only the operator reads, carrying sign-ups, sign-ins and game activity. Separately, if you link a Discord account, our bot sets your nickname and roles in our server, so Discord sees that your cat and your Discord account are the same person.
- Reddit — told that you visited (while signed out, or from its ad), that you signed up and what you paid for, with the ad click identifier if you came from its ad, a one-way hash of your email address and of your account number, your IP address and your browser details, so it can match you to a Reddit account and show our ads to people like you. Three events and nothing else: it is never told what you do inside the game. There is no Reddit script on this site and no advertising cookie; it is sent from our analytics, and your purchases stop being reported to it when you ask us (Your choices).
Nothing is sold, and nothing goes to anyone not on that list unless we are legally compelled.
How long we keep it
| What | Kept for |
|---|---|
| Email confirmation and password reset links The link and the address it was sent to, deleted when the link expires: after 1 day for a confirmation, 1 hour for a password reset. | 1 day |
| Discord link codes The code that links a Discord account to a cat, held as a one-way hash and deleted when it expires after 10 minutes. Linking then stores your Discord account id and handle until you unlink or delete the account. | 1 day |
| Sign-in sessions The session that keeps you signed in, deleted at expiry. The record that you signed in is kept: see the sign-in history below. | 7 days |
| Duplicate-request receipts Internal bookkeeping that stops an action being applied twice. | 7 days |
| API keys For each key you make: the name you give it, what it may read, when it was made and when it was last used, to the minute. The key itself is never stored, only a one-way hash of it. Revoking a key, resetting your password from an emailed link or recovering the account deletes it. | Until you revoke the key or delete the account |
| The Mews, your notices and the action log Every line of your city log, the notices behind it, the record of each action you took and your contract progress. Deleted with the account. | Until you delete your account |
| Your sign-in history Each time the account was signed in to, with the IP address and browser it came from, each email link or Discord link sent or used, and each API key made or revoked (which key and at what level, not its name). Kept to protect accounts and to look into cheating. The links, codes and keys themselves are not kept. Deleted with the account. | Until you delete your account |
| Fights, trades, heists, bounties, deposits and loans The record of what happened between players and at the bank. When an account is deleted these stay, under an anonymised name, so the other cat's history still makes sense. | Kept, under an anonymised name once you delete your account |
| Your crew's chains Every line of each crew chain: which cat pulled off which crime, won a fight or slipped, when, and the links it added, so the crew can read who added what. Only the crew's own members can read it. Deleted when the crew folds. | Kept while the crew exists, under an anonymised name once you delete your account |
| Your crew's supplies A line for every item a cat put in the crew's supplies, every one used out of them, every piece of gear lent, taken back or sent back when its cat left, and every change of who may use them: which cat, which item and when. Only the crew's own members can read it. Deleted when the crew folds. | Kept while the crew exists, under an anonymised name once you delete your account |
| Your crew's comings and goings A line for each cat who left the crew or was put out of it: which cat, when, and who put them out; and a line when a cat in the crew changes its name, with the name it had. Only the crew's own members can read it. Deleted when the crew folds. | Kept while the crew exists, under an anonymised name once you delete your account |
| Your crew's contracts Each week's contracts: how many cats the crew had who played the week before, how far each contract came, when it was done, and how much each cat put toward it. Only the crew's own members can read it. Deleted when the crew folds. | Kept while the crew exists, under an anonymised name once you delete your account |
| Your heaviest catch each week at Pier Nine The heaviest fish you landed each week, what it was and when, which the noticeboard's weekly biggest reads. Deleted with the account. | Until you delete your account |
| The names you went by before Each name you gave up and when. A name you changed yourself is shown on your profile as "Previously known as"; a name staff changed is seen only by staff. The name itself is free for anyone to take the moment you give it up. Deleted with the account. | Until you delete your account |
| Your companion's journal The log on the Companion page — feeds, missed deadlines, finds and tricks. Deleted when you release the companion, and with the account. | Until you delete your account |
| Cat Cafe pictures that never went up, or that came down The image file itself is deleted the moment a picture is withdrawn, turned down or taken off the wall. Only the row recording that it existed is kept. A picture hanging on the wall stays until you take it down. | Kept, under an anonymised name once you delete your account |
| Moderation decisions and the money ledger The audit trail for a warning, a mute or a suspension, and for every movement of in-game currency. Kept under an anonymised name after an account is deleted. | Kept, under an anonymised name once you delete your account |
| Opened checkouts and payment notifications Which account opened a payment page, and the payment provider's notifications about it, kept so a delayed or repeated notification is applied exactly once and a purchase can be traced. | Kept, under an anonymised name once you delete your account |
| Market price history The share prices the exchange chart draws. It records nothing about any player. | Kept |
The city keeps its history. Until 11 October 2026 most of the record of play was deleted after 30 to 180 days; since then it is kept for as long as your account exists, and that applies to what was already stored on that day. What still expires is in the top rows of the table, and the sweep that enforces those runs every minute, so they are the real ages of the data rather than an intention. Chat is kept the same way: what you say on the Street, in your crew’s room and in a whisper to another cat stays, so a conversation can be read back and a report can be checked against what was said. A whisper is read by the two cats it is between. Our moderators see one only when it has been reported; the operator can read any of them, to look into cheating and abuse. The web server’s request logs, which hold the IP address and the page of each request, and backups of the database are kept as well. Your account is kept until you ask us to delete it. A record of each purchase — what was bought, when and for how much — is kept for as long as tax and accounting law requires, even after the account is deleted.
Your choices
- Delete your account. Write to privacy@meowstreets.com from the address on the account. We free your name, erase your email address and password, and end every session. Your own log goes with it: your Mews, your notices, the record of your actions, your contract progress, your sign-in history and your companion’s journal are deleted, and your Cat Cafe pictures come down. What is left of your cat in shared history — the chat others read, the fights and trades they were part of, the money ledger — stays under an anonymised name so their records still make sense, and your old name is taken out of their logs.
- Get a copy of your data, or correct it. Same address.
- Object to ad measurement or to analytics. Both are on for everyone and there is no switch in the game. Write to privacy@meowstreets.com from the address on your account and we will mark your analytics profile so your purchases are no longer reported to Reddit, erase the hashes it holds, and delete what analytics has recorded about you. Analytics cannot be turned off for a single account, so it goes on counting what you do while you play. We do not read Global Privacy Control or Do Not Track.
- Unsubscribe from marketing email with the link at the bottom of any of them, or by writing to us.
- Complain. Write to us first, but you may go straight to your national data protection authority.
Cookies
meow_session keeps you signed in. It is HttpOnly and SameSite=Strict, so no script and no other site can read it, and it lasts 7 days. Our analytics sets its own cookies, named ph_…, which hold an anonymous analytics identifier so a visit is counted once. No advertising cookie. Your browser also stores a marker recording that your account's hashes have been sent once, a note of what our analytics was last told about your cat — its name, level, hideout and crew — so that it is not sent again on every visit, a note of which screens it has already been told about today, so that each is counted once a day, and — only if you arrived from an ad — that click identifier, for 30 days or until you sign up, and — only if you opened another cat's link — that cat's number, for the same 30 days or until you sign up.
Children
You must be at least 13 to play, and at least 16 in the parts of the EEA that set the age there. We do not knowingly keep an account for anyone younger.
Who runs this
MeowStreets is operated by ORAN. For anything on this page, including any request above, write to privacy@meowstreets.com. We will answer within one month.
Playing is also covered by the terms of service.