Privacy Policy

1. Purposes of Processing

The Company processes personal data for the purposes below, and does not use it for any purpose beyond those stated (for signed-in account data, see 2.3).

• Providing and improving the service — Only when a user opts in, we collect anonymous usage statistics to understand which features are actually used and which errors occur, and to improve service quality.
• Public trends — Aggregated results of the anonymous statistics are published on the public trends page (/trends).
• Account operation — We process account data (2.3) to authenticate Agent Cat accounts and maintain sign-in sessions. We do not process new paid-subscription billing.
• Handling inquiries and rights requests — We process data-deletion requests, questions, and similar inquiries received by email.

2. Categories of Personal Data Processed

2.1 Anonymous information collected automatically from opted-in users

• An anonymous identifier (a random UUID, stored in the device's macOS Keychain or an equivalent secure store)
• App usage events (11 anonymous event types such as app launch/quit, menu-bar clicks, mascot changes, and settings opens)
• Product metadata (app version, locale, selected mascot, CPU usage, process count, token counts, etc.)

2.2 Information collected when you contact us by email

• Your email address (to respond to inquiries and process rights requests)
• Any information you voluntarily include in the body of your message

2.3 Agent Cat account data

When you sign in to Agent Cat, we process the following to run your account. We do not sell paid subscriptions.

• Email address, name, and profile picture (avatar) URL received from Google sign-in
• Session cookies (HttpOnly) to keep you signed in and for CSRF protection
• We do not collect payment-card data for new subscriptions. Existing paid subscribers may still have historical billing records held by the original processor.
• Daily usage summaries synced from your device (provider, model, token counts) and their account linkage, to provide your account dashboard

2.4 Information we do not collect

The Company never includes any of the following in the anonymous usage statistics (2.1), and never links them to a Pro account.

• IP address or location information
• Device hardware identifiers (Hardware ID)
• Prompts, responses, transcripts, code, or file contents
• Project directory names, Git repository names, branches, or commit messages

3. Processing and Retention Periods

• Anonymous event data: 13 months from collection, after which it is deleted automatically.
• Daily aggregated data (not personally identifiable): retained indefinitely.
• On opt-out or deletion request: all data linked to the relevant anonymous identifier is deleted immediately.
• Email inquiry records: retained for 1 year after the inquiry is resolved, then destroyed.

4. Provision to Third Parties

The Company does not sell or otherwise provide personal data to third parties, except where permitted under applicable privacy law (such as with the data subject's consent or under specific legal provisions). For the processors we rely on to operate the service, see section 5.

5. Outsourcing of Processing

To operate the service, the Company entrusts the processing of data to the parties below. In accordance with applicable privacy law, the relevant terms are set out in each contract so that the data is handled securely.

Separately, the web funnel analytics we run ourselves (agentcat-telemetry) is first-party analytics measuring visit flow on the marketing and data pages, not an external processor.

6. Your Rights and How to Exercise Them

You may exercise the following rights with respect to the Company at any time.

• The right to access your personal data
• The right to correct errors
• The right to deletion
• The right to restrict processing

You can exercise these rights by opting out immediately via App Settings → Data → the "Send anonymous statistics" toggle, or by emailing the contact below. On opt-out, all data linked to the relevant anonymous identifier is deleted immediately.

7. Security Measures

• Data minimization: for the anonymous telemetry stream, we do not collect identifiable personal data and process it using an anonymous identifier only; Pro account and billing data is covered in 2.3.
• Marketing-site measurement: marketing-site visitor and funnel measurement runs on page load. It is separate from the app's anonymous telemetry setting; see the Cookie Policy for details.
• Encryption in transit: all data transfers are encrypted with HTTPS (TLS).
• Access control: database access is restricted to authenticated administrators.
• Local processing first: your code, prompts, and responses never leave your device.

8. Automated Decision-Making

The Company does not carry out automated decision-making (including profiling) using personal data.

9. Data Protection Officer

The Company has designated the following Data Protection Officer to take overall responsibility for personal-data processing and to handle complaints and remedies from data subjects in connection with that processing.

• Name: Seokyong Kim
• Title: CEO
• Email: meow@agentcat.app

10. Remedies for Rights Infringement

To obtain relief for an infringement of your personal-data rights, you may apply to the following Korean authorities for dispute resolution or consultation.

• Personal Information Dispute Mediation Committee — www.kopico.go.kr · +82-1833-6972
• Privacy Infringement Report Center — privacy.kisa.or.kr · 118 (within Korea)
• Supreme Prosecutors' Office — www.spo.go.kr · 1301
• National Police Agency — ecrm.police.go.kr · 182

11. Changes to This Policy

This Policy applies from its effective date. If there are changes due to law or policy, we will announce them on this page.

12. Company Information

• Company: Trappist
• Representative: Seokyong Kim
• Email: meow@agentcat.app

13. Overseas Transfer of Personal Data (Korea — PIPA §28-8)

To operate the service, the Company transfers personal data overseas (for processing or storage) as set out below, in accordance with Article 28-8 of the Korean Personal Information Protection Act (PIPA).

Time and method of transfer: transmitted over the information network (HTTPS) at the time of service use. You may refuse the overseas transfer; refusal may limit certain features. To refuse or inquire, contact meow@agentcat.app.

14. International Data Transfers (EU/UK → US)

Where the personal data of users located in the European Economic Area (EEA) or the United Kingdom is transferred to the United States, the Company applies appropriate safeguards under Article 46 of the GDPR and the UK GDPR. The transfer mechanism for each recipient is as follows.

A copy of the appropriate safeguards is available on request at meow@agentcat.app.

15. GDPR / UK GDPR Rights

If you are located in the EEA or the United Kingdom, you have the following rights under applicable law.

• Access — request access to the personal data we process about you
• Rectification — request correction of inaccurate personal data
• Erasure — request deletion of your personal data (the right to be forgotten)
• Data portability — receive or transfer your data in a structured, machine-readable format
• Restriction — request that processing be restricted
• Objection — object to processing based on legitimate interests or to direct marketing
• Withdraw consent — withdraw consent at any time where processing is based on consent (this does not affect the lawfulness of processing before withdrawal)
• Right to lodge a complaint with a supervisory authority — lodge a complaint with the data protection authority where you reside (the ICO in the UK)

To exercise these rights, contact meow@agentcat.app.