Privacy Policy

Katwars is built to be fun and low-friction. We collect the minimum data needed to run the voting loop. This policy describes what we store, why, and what your choices are.

1. What we store

• Kitten images and metadata. When you upload a kitten, we store the image in object storage and a small row in our database with the kitten’s name, optional bio, optional owner emoji, and the timestamp of upload.
• Votes. For each vote we record the winning and losing kitten IDs, a hashed device identifier (see “Device cookie” below), and an idempotency key so the same vote isn’t counted twice. We do not store your IP address.
• Reports. When you report a kitten, we store a hashed copy of your device cookie and a hashed copy of your IP address (we never store either in raw form). This is used to rate-limit reports and to count distinct sources when deciding whether to auto-hide a reported kitten.

2. Image processing

Uploaded photos are processed automatically before they appear in any vote:

• EXIF + GPS strip. We re-encode every upload through Cloudflare Image Transformations with metadata=none, which removes the camera model, timestamps, and GPS coordinates that phones sometimes embed.
• Automated screening. We run each photo through an automated classifier (Cloudflare Workers AI llava-1.5-7b-hf) to detect non-cat content (human faces, NSFW imagery, watermarks). Photos that fail this check are removed before going live.
• Animated images rejected. Animated formats (GIF, animated WebP, APNG, HEIC sequences) are rejected at upload. Only still photos are accepted as fighter portraits.
• No facial recognition. The classifier described above scores whole-image content (cat / not-cat, safe / unsafe). It does not identify individuals.

3. Device cookie

We set a single first-party cookie named kw_did. It contains a random identifier and an HMAC signature that lets the server verify the cookie was issued by us. The cookie isfunctional only: it is what makes “your” kittens recognisable as yours on this device, lets us deduplicate votes, and powers the silent “don’t show me kittens I reported” filter. It is not a tracking cookie, and we do not share it with third parties or load advertising scripts. We do use a privacy-friendly, cookieless analytics tool — see Analytics below.

4. Analytics

We use Umami (Umami Cloud) to understand aggregate traffic — page views, referrers, and coarse device/browser information. Umami is a privacy-friendly, cookieless analytics tool: it sets no cookies and does not build cross-site advertising profiles. It derives an approximate country from your IP address but does not store the raw IP. Because this routes data to a third-party processor (Umami Cloud), we disclose it here — it is the only third-party script the site loads. You can block it with any standard content or script blocker without affecting the voting loop.

5. Age requirement (COPPA)

Katwars is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has uploaded a kitten or otherwise sent us data, contact us (see “Contact” below) and we will remove that data within 30 days.

6. Your rights

You can delete your kitten at any time from the kitten’s manage page (you need the claim code we showed once at upload to prove ownership). The delete is GDPR-grade: we remove the image from object storage and scrub the device-hash field on every vote the kitten participated in.

If you are an EU/UK/California resident exercising data-protection rights (access, deletion, correction), email the address below and include enough information to identify the kitten or device you’re asking about.

7. Retention

• Kitten rows: until you delete them.
• Votes: kept for ranking and statistics; device hashes are scrubbed when the corresponding kitten is hard-deleted.
• Reports: kept for moderation audit. Hashed identifiers expire when the underlying kitten is hard-deleted (cascade).

8. Contact

Email xertive@gmail.com.