Privacy Policy
Effective Date: April 19, 2026
Last Updated: April 19, 2026
Table of Contents
1. Introduction
Catto Intelligence Platform ("Catto", "we", "us", or "our") operates a real-time open-source intelligence (OSINT) aggregation platform (the "Service"). We are committed to protecting your privacy and handling your personal information with care and transparency.
This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use Catto. By accessing or using the Service you acknowledge that you have read and understood this Privacy Policy.
Key points:
- We collect only the minimal personal information required to operate the Service.
- We do not sell your personal information to third parties.
- Payment processing is handled by Stripe; we do not store credit-card details.
- You may access, correct, export, and delete your personal data at any time.
2. Information We Collect
2.1 Information You Provide Directly
Account Registration
When you create a Catto account we collect:
- Email address — required for authentication and service communications.
- Username — display name visible within your account.
- Password — hashed with bcrypt per-user salt; never stored in plain text.
OAuth Authentication
If you register via Google or GitHub OAuth, we receive:
- The email address associated with your OAuth account.
- Basic profile information (display name, avatar URL) permitted by the provider.
- The provider's user ID, used solely for authentication.
We do not store OAuth access tokens beyond the initial sign-in. Passwords remain with your OAuth provider.
Subscription and Payment Information
All payment processing is handled by Stripe, Inc. When you subscribe to Catto PRO:
- We do NOT store: credit-card numbers, CVV codes, or full payment details.
- We receive from Stripe: customer ID, subscription status, card brand, last four digits, expiry date, and billing email.
- See Stripe's Privacy Policy for how Stripe handles payment data.
User Preferences and Settings
We store your customisation preferences, including:
- Startup map location, zoom, and layer toggles.
- VIP aircraft and vessel watchlists (PRO).
- Custom keyword monitors (PRO).
- Alert thresholds and panel layouts (PRO).
- UI theme and display preferences (including Matrix HUD).
Two-Factor Authentication (2FA)
If you enable TOTP 2FA we store:
- Your TOTP secret, encrypted using AES-256 Fernet encryption.
- Backup recovery codes, hashed with bcrypt and single-use.
- Enablement timestamps and verification state.
2.2 Information Collected Automatically
Usage Data
- IP address — security, fraud detection, rate limiting.
- Browser type, version, and operating system.
- Device type (desktop, mobile, tablet).
- Pages visited, features used, and timestamps of activity.
- Referrer URL.
Authentication and Security Logs
For security purposes we log:
- Login attempts (successful and failed).
- IP addresses and user agents of login sessions.
- Session tokens and expiry times.
- 2FA events (setup, verification, disable, backup-code usage).
- Password reset events.
- Account creation and deletion events.
Intelligence Query Logs
We log queries and interactions with intelligence feeds to:
- Provide search history (retention based on subscription tier).
- Improve search relevance and feed quality.
- Debug technical issues.
- Monitor for abuse or policy violations.
Intelligence queries are never shared with third parties and are retained for 7 days on the Free tier and unlimited for PRO subscribers.
2.3 Information from Third-Party Sources
Catto aggregates intelligence from 50+ publicly available OSINT feeds covering geopolitical events, aviation and maritime tracking, cyber threat intelligence, seismic and emergency activity, and regional sources. This intelligence data is not considered your personal information, and is correlated with your account only to deliver alerts based on preferences you have configured.
3. How We Use Your Information
3.1 To Provide and Maintain the Service
- Authenticate your identity and manage your account.
- Process subscription payments and manage billing through Stripe.
- Deliver intelligence feeds and alerts matching your preferences.
- Store your search history, watchlists, and preferences.
- Provide customer support.
3.2 To Communicate With You
- Send service-related notifications (trial start, payment succeeded or failed, subscription cancelled).
- Alert you to security events (2FA enabled or disabled, password changed, password reset, new sign-in).
- Respond to support requests.
- Send administrative notices about changes to our terms or policies.
Marketing: we do not currently send marketing email. If we introduce marketing communications in the future you will be able to opt out.
3.3 To Improve the Service
- Analyse aggregate usage to improve features and UX.
- Develop new capabilities and intelligence feeds.
- Diagnose and fix bugs.
3.4 Security and Fraud Prevention
- Detect and prevent unauthorised access.
- Monitor for suspicious activity and brute-force attempts.
- Enforce our Terms of Service.
- Comply with legal obligations and lawful requests.
4. Data Sharing and Disclosure
4.1 We Do NOT Sell Your Personal Information
Catto does not sell, rent, or trade your personal information to third parties for marketing purposes. Your data is used only to provide and improve the Service.
4.2 Third-Party Service Providers
Stripe (Payment Processing)
- Shared: email, name, customer ID.
- Purpose: process subscription payments, manage billing, handle refunds.
- See Stripe's Privacy Policy.
Gmail SMTP (Email Delivery)
- Shared: your email address and notification content.
- Purpose: deliver transactional emails (security notices, payment receipts, password reset).
4.3 Legal Requirements
We may disclose your information if required to do so by law or in response to:
- Valid legal process (subpoena, court order, search warrant).
- Requests from law-enforcement or government agencies.
- Protection of our rights, property, or safety, or those of users or the public.
- Investigation of fraud, security issues, or Terms violations.
Where lawful, we will notify affected users of legal demands for their information.
4.4 Business Transfers
In the event of a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred to the successor entity. We will notify you by email and via a prominent notice on the Service before your information becomes subject to a different privacy policy.
4.5 Aggregated Data
We may share aggregated, anonymised statistics (e.g., feed popularity, region of interest rankings) that cannot be used to identify you personally.
5. Data Security
5.1 Technical Measures
- Data in transit: TLS encryption for all connections.
- Data at rest: database encryption.
- Passwords: bcrypt hashing with per-user salts.
- TOTP secrets: AES-256 Fernet encryption.
- Backup codes: bcrypt-hashed, single-use.
- JWT sessions with expiry and rotation.
5.2 Operational Measures
- Rate limiting on authentication endpoints.
- Brute-force detection and automated account lockout.
- Audit logs for authentication and admin actions.
- Automated security patching of dependencies.
- Encrypted off-site backups.
5.3 Security Incident Response
In the event of a data breach affecting your personal information we will:
- Notify affected users within 72 hours of discovery where feasible.
- Describe the nature of the breach and data affected.
- Outline remediation steps and preventive measures.
- Notify relevant authorities as required by law (e.g., PDPA in Singapore).
5.4 Your Responsibilities
- Keep your password confidential.
- Enable two-factor authentication (strongly recommended).
- Safeguard your backup recovery codes.
- Report suspicious activity to [email protected].
- Use an up-to-date browser.
6. Data Retention
6.1 Account Data
- Active accounts: retained while the account remains active.
- Deleted accounts: personal data permanently deleted within 30 days.
- Dormant Free accounts: accounts inactive for 2+ years may be deleted after 90-day notice.
6.2 Intelligence History
- Free tier: 7 days of intelligence-query history.
- PRO tier: unlimited history until account deletion.
- Deleted accounts: all history removed within 30 days.
6.3 Payment Records
- Invoices and receipts retained for 7 years as required by tax law.
- Stripe customer data retained per Stripe's retention policies.
- On account deletion, payment records are anonymised (email removed) but retained for legal compliance.
6.4 Security and Audit Logs
- Authentication logs: 90 days.
- Admin audit logs: 1 year.
- Security incident logs: 2 years.
7. Your Rights and Choices
7.1 Access and Portability
You may request a copy of your personal data at any time. PRO users may export their intelligence history in JSON format from the History panel. Email [email protected] with subject "Data Access Request" to receive a complete export.
7.2 Correction and Update
Update your account information at any time via Settings → Profile.
7.3 Deletion
You may delete your account via Settings → Account → Delete Account. Personal data is permanently deleted within 30 days. Some records (e.g., payment history) may be retained anonymised as required by law.
7.4 Opt-Out of Communications
- Service emails: cannot be opted out (required for security and subscription management).
- Marketing emails: not currently sent. If introduced, you will be able to opt out via an unsubscribe link.
7.5 Withdraw Consent
Where processing is based on consent, you may withdraw consent at any time by disabling optional features or deleting your account. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
7.6 Complaints
If you believe we have mishandled your personal data you may contact us at [email protected] or file a complaint with the Personal Data Protection Commission of Singapore at pdpc.gov.sg.
9. International Data Transfers
Catto is operated from Singapore and our servers and backups are primarily hosted within the Singapore region. If you access Catto from outside Singapore, your information may be transferred to and processed in Singapore. By using the Service you consent to this transfer.
For users in the European Economic Area, United Kingdom, or Switzerland we rely on Standard Contractual Clauses approved by the European Commission and, where applicable, adequacy decisions. Stripe and Gmail may process data in additional jurisdictions under their own compliance frameworks.
10. Children's Privacy
Catto is not intended for users under 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, contact [email protected] and we will delete such information within 30 days. By creating an account you represent that you are at least 18 years old.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements.
- Material changes will be notified by email at least 30 days before the effective date.
- Minor changes will be posted on this page with an updated "Last Updated" date.
Continued use of the Service after the effective date constitutes acceptance of the updated Privacy Policy. If you do not agree to the changes, you must stop using the Service and may request account deletion.
12. Contact Information
For questions about this Privacy Policy or our data practices, email [email protected]. We aim to respond to all privacy inquiries within 7 business days.