Privacy Policy

1. Who is responsible for your data

MeowKuda AI (“the service”, “we”, “us”) is a Hong Kong horse-racing analysis product. This Privacy Policy explains how we handle personal data when you use the website, the mobile app, or subscribe. The data controller is: MeowKuda AI. Contact details are in section 10.

2. What we collect

• Google account data (sign-in). When you sign in with Google, we receive your Google account email address and a Google identifier for your account. We do not receive your Google password.
• A device push token. If you enable alerts, your device or browser registers a push token with Firebase Cloud Messaging so we can deliver notifications to that device.
• Subscription status. Through our payment processor we learn whether your subscription is active, its plan, and its expiry — not your card details, which the processor holds.
• Basic technical and usage data. Ordinary server logs (IP address, timestamps, the pages and API calls you make, and errors) and a small amount of in-app preference data (for example, whether you show the tote columns).
• Your acceptance record. When you accept the Terms and this Privacy Policy, we record the time and the version you accepted.

3. Why we use it

• Authentication and access. To sign you in and to know which account is which.
• Delivering alerts. To send you race-result and next-meeting notifications you have asked for.
• Entitlement checks. To decide whether your account may see the full card, or only the free Race 1.
• Security and operation. To keep the service working, prevent abuse, and diagnose problems.

We do not sell your personal data, and we do not use it to build advertising profiles about you.

4. Who else is involved

We share data only as needed to run the service, with these named third parties:

• Google — sign-in. Your Google account is used to authenticate you. Google's own privacy policy applies to that sign-in.
• Whop — the payment processor. Handles subscription payments and tells us your subscription status. Your card details go to Whop, not to us.
• Firebase Cloud Messaging (Google) — push notifications. Your device push token is used to deliver alerts to your device.
• Google AdMob — advertising shown to non-subscribers. For free and anonymous users, AdMob may collect device and advertising identifiers to serve ads. Subscribers see no ads.
• Our hosting provider — [OPERATOR: hosting provider name — to be completed] — stores and serves the service and its logs.

Each of these providers handles data under its own privacy terms. We may also disclose data where the law requires it, or to protect the rights and safety of the service and its users.

5. Cookies and session storage

We use a session cookie to keep you signed in — it is HttpOnly, SameSite=Lax, and lasts up to 30 days. We also use your browser's local storage for small in-app preferences and for the app's offline behaviour. We do not use third-party advertising cookies on the site itself; ads shown to non-subscribers are served by AdMob under its own rules.

6. How long we keep it

We keep account data while your account exists. Server logs are kept for a limited period for security and troubleshooting. Subscription records are kept as long as needed for accounting and legal obligations. When data is no longer needed, we delete it or anonymise it.

7. Your rights

Depending on where you live, you may have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct data that is wrong;
• ask us to delete your data (subject to legal and accounting obligations);
• object to, or ask us to restrict, certain processing;
• withdraw consent you have given, such as for alerts;
• complain to your local data-protection authority.

To exercise any of these, contact us using the route in section 10. We may need to verify who you are before acting. Turning off alerts in the app stops push notifications to that device; cancelling your subscription stops the related processing. You can delete your account yourself at any time from the app (Settings → Delete my account) — see Delete your account for the steps and exactly what is removed.

8. Security

We take reasonable steps to protect your data: passwords are stored only as salted hashes, sessions use signed cookies, and access to subscriber records is restricted. No system is perfectly secure, and we cannot guarantee absolute security.

9. Children

The service is for adults only. It is not directed at children, and we do not knowingly collect data from anyone under 18 (or the age of majority where they live). If you believe a child has provided us data, contact us and we will remove it.

10. Changes and contact

We may update this Privacy Policy. When we do, we publish a new version number and effective date at the top of this page, and significant changes are re-presented for acceptance before you next subscribe.

For any privacy question or request, contact us at: [OPERATOR: contact email / channel — to be completed]. You can also reach us through the product's About & contact page.