MeowWa Privacy Policy — release candidate

Status: not published; requires operator identity/contact completion and qualified-counsel approval

Version 1.1 · proposed effective date: date of counsel-approved publication

Every factual statement below was checked against the shipped source on 2026-08-18; the engineering proof points are in docs/PRIVACY_DATA_FLOWS.md and docs/PRIVACY_RETENTION_SCHEDULE.md. Being accurate is not being approved: the operator's verified legal identity, contact route, state-rights section, and final wording still require qualified United States counsel.

MeowWa is a Mac app that helps an owner organize observations about a pet, request a probabilistic interpretation of selected recordings or files, and control a pet-linked spending account. This notice describes the United States release candidate. It does not authorize a public launch.

Information MeowWa handles

How MeowWa uses information

MeowWa uses information to authenticate the owner, provide and secure the requested feature, preserve owner approvals, prevent duplicate inference or payment, deliver notifications, provide support, detect abuse, recover from failure, and meet applicable legal duties.

This release runs no product analytics at all: the analytics choice is recorded and nothing reads it, so switching it on collects nothing today, and any future collection needs a new choice rather than this one. Model improvement is off unless the owner makes a separate, revocable choice; withdrawing that choice immediately and permanently deletes the stored recordings kept under it and tells the owner how many were deleted. Household access does not supply either choice — the server refuses a consent change from every household role, not only the app's menu.

Recordings and interpretation providers

Submitting media sends the selected bytes to MeowWa and the configured pet-interpretation provider. “Delete after use” describes storage, not transmission. MeowWa does not retain the raw bytes after the request. What travels with the media is deliberately thin: for dog audio, a per-pet pseudonym derived with a secret key MeowWa holds; for the cat path, MeowWa's internal pet, evidence, and interpretation identifiers, which are opaque digests. Your name, sign-in identity, pet name, pet profile, and free-text notes are not sent to an interpretation provider.

A dog-audio lease expires within 30–300 seconds, and MeowWa asks the publisher to revoke it as soon as the provider answers; the expiry, not the revocation, is the guaranteed bound. No provider may train on MeowWa media, and no interpretation provider may be enabled, unless its contract requires deletion after inference with a 24-hour incident ceiling and the release has independent review. Interpretation is disabled by default in this build and stays disabled until a named release is approved.

Interpretations are probabilistic observations, not literal translations, diagnoses, veterinary advice, or emergency services. Contact a veterinarian or emergency provider when an animal may be ill, injured, poisoned, or in distress.

Sharing and processors

MeowWa shares only what a provider needs for its job.

From MeowWa's servers:

From your device, the sign-in provider's own component may also contact its API and, during sign-in, a bot-challenge service and external-wallet connection endpoints. Those parties receive your IP address and browser metadata directly; MeowWa does not send them your account data.

MeowWa does not sell personal information or share it for cross-context behavioral advertising, and it contains no advertising or third-party tracking code.

MeowWa keeps a register naming each provider, its purpose, its region, and its contract status. Ask through the in-app Help control for the current version. A provider with an incomplete contract or deletion proof stays disabled.

Retention

The controlling schedule is MeowWa's retention schedule (docs/PRIVACY_RETENTION_SCHEDULE.md). Key periods are: no durable raw media; 30 days for retry outcomes and account-closure recovery; no more than 35 days for encrypted backup expiry; two years after resolution/event for support and ordinary security audit; and seven years for minimum pseudonymous financial evidence. Live owner identity and provider-control handles are removed on permanent pet or account deletion rather than kept with financial evidence.

Those periods are not all enforced the same way today, and the difference matters. MeowWa's own code enforces the ones that protect media and short-lived state: raw media is never persisted, the audio lease self-expires, replay ledgers and the deleted-memory undo window drop at 30 days, and the encrypted account state is destroyed 30 days after closure. The support, security-audit, financial, and push-token periods are approved product periods whose automatic period-end sweep is not yet running: today those records are erased by permanent pet deletion or account closure rather than by the clock. Backup and provider-log expiry are contractual, and evidence for both is a release gate.

Choices and deletion

An owner can change separate recording-retention, analytics, and model-improvement choices; inspect and correct pet information; export their data; remove household access; archive or permanently delete an eligible pet; and close the account.

The export is the owner's alone — no household role can run it — and it costs a fresh strong authentication. It is a JSON file containing everything the account stores: pets, memories, interpretations, requests, receipts, wallets, mandates, funding, preferences, household roles, notifications, support cases, the audit log, and memories you deleted that are still inside their 30-day undo window. It deliberately omits replay and notification-deduplication keys and the push credentials, which are machine state rather than your content. It stays available for the whole 30-day closure window.

Permanent pet deletion is blocked while the pet is not archived, the additional signer is still active, a wallet has a balance, a payment, funding, order, refund, or withdrawal is unsettled, or a financial review is open. When it runs it erases the profile, memories, interpretations, preferences, evidence claims, household references, and the live provider-control identifiers, and a durable deletion record then wins over any older stored copy on every load. The final pet is deleted through account closure, which has a 30-day recovery window and then destroys the encrypted account state.

Deletion cannot reach three things, and MeowWa does not claim otherwise: encrypted backups until they expire, which is at most 35 days; copies already held by a provider, which follow that provider's contractual deletion window; and public-chain transactions, which are permanent. Retained pseudonymous financial evidence is also outside profile deletion.

To request access, correction, deletion, appeal a refusal, or ask a privacy question, use the in-app Help control. The publication manifest must add the operator's verified legal identity, postal address, and monitored privacy contact before this notice can go live.

Children and household recordings

MeowWa is for signed-in users aged 16 or older and does not solicit accounts from children under 16. MeowWa does not verify age; this is an eligibility rule, and an account found to belong to a child is closed. A parent or guardian may use an adult account for a family pet; a child does not own an account, wallet, checkout, or household role. The person submitting a recording must have authority to do so and must notify other people who may be captured. State recording-consent rules may differ.

Security, changes, and complaints

The account state MeowWa stores is encrypted with AES-256-GCM under one service key, with the account's identity bound into the ciphertext so one account's record cannot be opened as another's; the wallet's sealed owner identity uses a second key held by a different workload. Database connections verify the provider's certificate, each workload holds its own least-privilege database login, the request path holds no permission to delete financial history, sensitive actions cost a one-use confirmation bound to that exact action, and owner actions are recorded in an audit log. No system is completely secure. A material policy change will be shown before it takes effect; a new optional use requires a new choice rather than being inferred from an old one. The final counsel-approved notice must identify applicable state rights, response timing, appeal/contact channels, controller identity, and any required regulator contact.