Privacy policy

Who we are

MeowMap (meowmap.fun) is run by an individual developer based in Thailand, who decides how the data described here is used ("we", "us"). Contact: privacy@meowmap.fun.

We handle personal data under Thailand's Personal Data Protection Act B.E. 2562 (2019), and under the data protection law that applies where you live where it gives you more rights.

What is public

MeowMap is a public map. Everything in a report is visible to anyone, including through each report's share link and the site's public data feed:

• the location of the pin or the drawn area, and the time of the report;
• the photo, description, number of cats, colour, breed, collar, status and tags;
• updates posted under it, with their notes and times;
• your display name, if you were signed in when you posted the report or the update.

Your email address, phone number and account id are never published. Please do not put anyone's personal details in a report: no faces, house numbers, licence plates or names, and do not pin the inside of a private home.

What we collect

When you create an account:

• your display name, email address and password (stored only as a one-way hash by our authentication provider);
• if you sign in with Google, the name, email address and profile picture Google shares with us;
• if you add a phone number for sign-in, the number and whether it has been verified;
• session records that keep you signed in, including the time, IP address and browser of each sign-in.

When you report a cat or post an update: the content listed under "What is public", and which account posted it (none, for an anonymous report).

Photos larger than 1,600 pixels are shrunk in your browser before upload, which removes embedded metadata such as the GPS position and camera model. Smaller photos, and any photo the browser cannot process, are uploaded as they are, metadata included, so check photos taken at home before you share them.

When you use the map:

• place searches you type, and the map area shown while you choose a report location, which our server sends to a place-search service to find matching places and addresses;
• technical data every web server sees: IP address, browser, device type, pages visited and referring site, used to run, secure and rate-limit the service;
• usage statistics, described under "Cookies and similar storage".

Your location

Your browser asks for permission before MeowMap can read your position. We use it on your device to centre the map, show the distance to cats in the list, and check for cats near you for nearby alerts. Those checks run on your phone against reports it has already loaded, and your position is not sent to us for them.

Your position is only stored if you use it as a report's location, and then it is published as the place the cat was seen. You can withdraw location permission at any time in your browser settings.

Why we use it

• To run the map and your account: showing reports, letting you edit your own and post updates, keeping you signed in. We rely on this being necessary to provide the service you asked for.
• To keep it safe: blocking bots and spam, rate limiting, moderating reports, and investigating abuse. This is our legitimate interest in running a trustworthy public map.
• To improve it: aggregate usage statistics about which features are used and how fast pages load. Also a legitimate interest; you can opt out as described below.
• To contact you about your account, such as a sign-in code or an answer to your email. We do not send marketing.

We do not sell personal data, and we do not use it for advertising.

Services that process data for us

MeowMap is built on these providers, who process data on our behalf:

• Vercel: hosts the site, keeps server logs and provides privacy-friendly page analytics.
• Neon: the database that stores reports and updates, and the authentication service that stores accounts and sessions. Hosted in the United States.
• Cloudflare: stores report photos (R2) and runs the bot check shown to anonymous reporters (Turnstile).
• Google: sign-in with Google, if you choose it, and Google Analytics usage statistics.
• Mapbox, or OpenStreetMap as a fallback: map tiles. Your browser requests them directly, so these services see your IP address and the area of the map you view.
• Photon by komoot: place search and address lookup. Requests go through our server, so komoot does not see your IP address.
• Twilio: delivers sign-in codes by text message, only if you use phone sign-in.
• Product Hunt: serves the badge image shown in the footer of these About, Privacy and Terms pages. Your browser requests it directly, so Product Hunt sees your IP address.

Some of these providers store or process data outside Thailand, mainly in the United States. We rely on their contractual data protection commitments for those transfers.

Cookies and similar storage

• Sign-in cookies keep you signed in. They are required for accounts to work.
• A language cookie remembers the language you chose.
• Your browser's local storage keeps your theme, which tips you have dismissed, whether nearby alerts are on, and which nearby cats you were already told about (cleared after 24 hours). This stays on your device.
• Google Analytics sets cookies to count visits and understand how the site is used. You can block them with your browser's cookie settings or Google's opt-out add-on without losing any feature.
• Vercel's page analytics does not use cookies.

How long we keep it

• Reports and updates: until you or a moderator deletes them. Deleting a report deletes its updates.
• Account data: while your account exists. When you ask us to delete your account, we delete it and remove your name from anything you posted, or delete those posts if you ask.
• Server logs and analytics: for the retention period set by the provider, generally no more than 14 months for analytics and much less for logs.
• Backups: deleted data can remain in backups for a short time until they expire.

Your rights

You can ask us to:

• give you a copy of the personal data we hold about you;
• correct it, or delete it;
• restrict or object to how we use it;
• move it to another service in a common format;
• withdraw any consent you gave, without affecting what happened before.

You can change your display name and delete your own reports and updates yourself. For everything else, including deleting your account, email privacy@meowmap.fun from the address on your account. We reply within 30 days. If you are not satisfied, you can complain to Thailand's Office of the Personal Data Protection Committee (pdpc.or.th) or to the data protection authority where you live.

Children

You must be at least 13 to create an account. If you are under the age of majority where you live (20 in Thailand), ask a parent or guardian before you do. If you believe a child under 13 has given us personal data, email us and we will delete it.

Security

The site is served only over HTTPS, passwords are stored as one-way hashes by our authentication provider, and access to the database and photo storage is limited to the operator. No system is perfectly secure; if a breach affects your data, we will tell you and the regulator as the law requires.

Changes to this policy

When this policy changes, the date at the top of the page changes with it. If a change affects how we use data you have already given us, we will say so on the site before it takes effect.