Privacy — catlog

catlog never receives your email address

This is not a promise about what we do with your email. It is a statement about what catlog is able to know: your email address is never requested from any identity provider, so it is never sent, so there is nothing to store, leak or hand over.

catlog asks each provider for the narrowest scope that yields a stable account id, and nothing else:

Provider	Scope requested	What catlog reads
Discord	`identify`	your numeric user id
Google	`openid`	the `sub` claim of the id_token
GitHub	none (default)	your numeric user id

None of those scopes grants an email address. The provider's access token is used for exactly one call — the one that reads that id — and is discarded immediately afterwards. It is never stored.

Even the account id is not kept

The id from the provider is immediately hashed into an opaque 32-byte value:

user_key = HMAC-SHA256(pepper, "<provider>:<account id>")

The pepper is 32 random bytes held on the server outside the database and never logged. Only the user_key is stored. There is no column anywhere holding a Discord snowflake, a Google subject or a GitHub id, so a copy of the database does not let anybody walk back from a row to an account at a provider.

What is stored

Your user_key, which provider it came from, and when the account was created.
Your handles, and when you claimed them.
Credential metadata: the public-key thumbprint, the license id, issue and expiry times. Never a private key — catlog is never sent one.
Flight events sent by the mod: what happened, when in sim time, and the measurements the leaderboards are computed from. Kitten names travel with them, because they are on the boards.
The server-side receive time of every event and batch.

What is not stored

Email addresses — see above.
Provider access tokens or refresh tokens.
Real names, avatars, profile URLs, friend lists.
Save files, craft files or screenshots.
Your private key, in any form.

Two accounts, one person, and why nothing links them

catlog permits one person to hold more than one handle, and the point of that is that no outside observer can tell. Three identifiers travelled with your events that would have broken it:

The installation id. Constant for the life of an install and the same whichever handle is shipping. It is never published — not blanked, not replaced, removed.
The career id — which save a record came from — and the kitten id. Both are derived from the installation id, so both are identical across two handles playing the same save or flying a kitten of the same name.

Career and kitten identifiers are relabelled per player before anything leaves the server: they still group your own records together, and they cannot be matched against anybody else's. The label is computed from your player id as well as the value, so two handles looking at the same save see two unrelated labels.

Two things this does not fix, stated rather than hidden. Kitten and vehicle names are the same across a person's two accounts if they name things the same way, and catlog cannot remove them without deleting the content the leaderboards exist to show. Receive times correlate anything shipped at the same moment, which the live feed has published per handle since it existed.

What is public

Your handle, your leaderboard values and their context (body, speed, energy), your rank, and the live feed lines your flights generate. That is the point of catlog. Your raw event log is public too, at /p/<handle>/events: it is what makes a leaderboard checkable rather than merely asserted. Everything else — which provider you used, when you signed in, your quota usage — is visible only to you, on your dashboard.

Flights flagged as cheated — teleports, refuels, resource edits, console use, live tuning edits — are stored and score nothing, and they appear nowhere public: not on a board, not in the live feed, and not in an event log, including your own. catlog would rather record the truth than pretend it did not happen, but a browsable list of whose flights were flagged would be a permanent public mark on a person, and a flag's only effect here is that a flight does not count. There is therefore no page, yours included, that says which of your flights were flagged.

The handle this browser calls “me”

Pressing This is me on a profile stores that handle in this browser, under catlog:me. It is a local preference and nothing more: it is never sent to catlog as an identifier, never appears in a query string on a cached page, never in a Referer, and it is not a login. Two people sharing a machine share it, exactly like a bookmark. Clearing it is the clear control beside it in the header.

Deleting everything

Dashboard › Delete everything catlog holds about me. That deletes every event, batch, stream record and credential, and removes the archived copies.

Two things survive on purpose. A tombstone — the user_key, a reason and a timestamp — so a deleted account cannot be silently recreated, and the retirement of your handles: a handle is never recycled, so nobody can take a name you were known by and be mistaken for you. Neither carries any information about who you are.

Transport and cookies

One cookie, catlog_sess: a signed, HttpOnly, SameSite=Lax session that expires after seven days. There is no analytics script, no third-party script, no tracking pixel and no advertising identifier on this site — every asset it loads, the typeface included, is served from this origin.