Privacy Policy

Who this policy covers

This policy applies to the NapCat Mac app, napcat.app, records of earlier purchases, and support. NapCat is an independent product operated by Huzaifa Saleem, who is the controller of the personal data described here. For privacy questions or requests, email hi@napcat.app.

What stays on your Mac

NapCat reads the local process list and the local session files that supported agent tools already create. It stores your settings and Activity history locally. Prompt text, responses, project names, file paths, and session content are not sent to NapCat’s servers.

You can keep local Activity history for 90 days, 180 days, one year, or two years, and clear it from the app. Removing the app does not automatically remove its local Application Support data.

Optional app connections

• Product analytics is off by default. If you turn it on, NapCat sends fixed event metadata such as an event name, provider, app version, plan state, delivery result, duration, and a random, pseudonymous installation identifier. It has no fields for prompts, responses, projects, paths, email addresses, license keys, or session IDs. These events go to a NapCat endpoint that validates the fixed schema before forwarding them to PostHog for retention and feature analysis. They are retained for up to 400 days. Turning analytics off stops new events and clears the unsent local queue.
• The optional Claude usage meter uses Claude Code’s existing local login to request usage information directly from Anthropic. Neither the credential nor the response is sent to NapCat’s servers.
• Update checks contact napcat.app to look for and download new versions. As with any network request, hosting systems may temporarily process an IP address and basic request data for delivery, reliability, and security.

Website analytics and storage

napcat.app uses Vercel Analytics and Speed Insights to understand page views and performance without advertising cookies or cross-site identifiers. PostHog starts only after you select Analytics only or Accept all. If accepted, it can measure downloads, clicks, scroll depth, navigation, browser and device characteristics, referrers, and approximate network information. It uses a first-party cookie and local storage identifier and may record a masked replay of a visit. Form inputs are masked.

When the Mac download is requested, NapCat records one aggregate download requested event even if optional analytics is off. It contains the release version and file type but no cookie, campaign query, IP address, or durable visitor identifier. This is used only to count file requests; it cannot prove that installation completed. Signed Polar webhooks also record pseudonymous purchase, refund, and transactional license-email delivery outcomes. Those events never include the buyer’s email address, license key, order ID, or webhook body.

Meta Pixel and the Meta Conversions API start only after you select Accept all. NapCat then sends advertising-measurement events for page views, product views, downloads, and newsletter signups. Depending on the event, Meta may receive the page URL, product details, IP address, user agent, Meta cookie identifiers, and a one-way hash of the signup email. NapCat never sends Meta a license key, checkout proof, agent content, prompt, response, project, path, or session identifier. Browser and server events share an event ID so Meta can deduplicate them.

You can reject all optional cookies, allow analytics without Meta, or accept both. Change your choice at any time with Cookie settings in the footer. Withdrawing stops new optional events and attempts to remove first-party PostHog and Meta identifiers; you can also clear website storage in your browser. Rejecting does not prevent downloading. Read the providers’ policies at PostHog, Meta, and Vercel.

Newsletter

If you sign up for release news, NapCat sends your email address to Resend, stores it as a newsletter contact, and emails occasional product updates. Newsletter signup is separate from cookie consent and from downloading the app: NapCat does not add anyone to marketing email automatically. Every marketing email includes an unsubscribe option. Unsubscribing marks the contact as unsubscribed so future marketing campaigns exclude it; support replies may still be sent when requested.

Earlier purchases

NapCat no longer sells licenses. For purchases made before it became free, Polar ran checkout and payment processing, and NapCat received the email address, license key, order and customer identifiers, and license status for each order. Those records remain stored with Supabase to answer questions about the purchase and to meet tax, accounting, and legal obligations. NapCat never received or stored full payment-card details. Polar may retain transaction data for payment, tax, fraud-prevention, and legal obligations under its own privacy policy. Resend delivered license emails and handles opted-in newsletter email under its privacy policy.

Support messages

If you email support, NapCat receives your email address and whatever you include in the message. Please do not send prompt content, passwords, or other secrets unless they are necessary to solve the issue. Support messages are kept only as long as needed to answer the request, maintain a useful support history, or meet legal duties.

Why information is processed

NapCat processes support and security data to operate and protect the service; optional app analytics with your choice in the app; website analytics to understand and improve the site; advertising measurement and newsletter marketing with consent; and records of earlier purchases needed to answer questions about them and to meet tax, accounting, fraud-prevention, and other legal obligations. The applicable legal basis may be contract, consent, legitimate interests, or legal obligation, depending on the data and your location.

Sharing and international processing

Information is shared only with providers needed to run NapCat, including Polar and Supabase for records of earlier purchases, Resend for email, Vercel for hosting and performance, PostHog for product and website analytics, Meta for consented advertising measurement, and service providers used for infrastructure. These providers may process data in countries other than yours under their contractual and legal safeguards. Information may also be disclosed when required by law or needed to protect users, NapCat, or the public.

Your choices and rights

You can leave app analytics off, disable the Claude usage meter, clear local Activity history, unsubscribe from marketing email, and reject or withdraw website analytics or advertising cookies from Cookie settings in the footer. Depending on where you live, you may also have rights to access, correct, delete, restrict, object to, or receive a copy of personal data, and to withdraw consent. Email hi@napcat.app to make a request. NapCat may need to verify that the request belongs to you. You may also complain to your local data-protection authority.

Security, children, and changes

NapCat uses reasonable technical and organizational safeguards, but no storage or transmission system is completely secure. The product is not directed to children under 13, and NapCat does not knowingly collect their personal information. This policy may change as the product or law changes; the effective date above will be updated when it does.