Your information, plainly explained

Privacy policy

ScrollCat turns aggregate scrolling into a fictional journey. We do not collect the websites you visit through the extension.

Last updated: 13 September 2026. This policy covers the ScrollCat website, companion app, API and Chrome extension.

1. Who is responsible

The controller is DynAgro s.r.o., Company ID 28460677, Lesní 100, 252 28 Vonoklasy, Czech Republic. Contact us at hello@webnik.cz with “ScrollCat privacy” in the subject

2. What we process and why

• Accounts and authentication. Your email address, account identifiers, optional display name, username and friend code let us create and secure your account. Email login uses expiring links. If you choose an available Apple or Google sign-in option, we receive the provider’s account identifier and the profile information it supplies for login, such as email. We store session records and hashed authentication secrets; your browser or device holds the credentials needed to stay signed in.
• Aggregate activity. While connected, the extension normalizes scroll distance locally. Its activity upload contains exactly a batch identifier, bucket start time, bucket duration, normalized stride total and extension version. Authentication associates the batch with your account. We use accepted totals to calculate daily and lifetime game progress and avoid counting retries twice. We do not collect visited URLs, domains, page titles, page content, keystrokes, clicks or individual scroll-event telemetry.
• Your game. We store your cat, appearance, progress, discovered places, current fictional position, route choices, treasure checks and inventory, journal, camp state, materials, preferences and outcomes. These make the journey persistent across visits and devices. Fictional locations are not your physical location.
• Social features. We process friend requests, accepted friendships, limited interactions and notification preferences to provide the features you use. See the visibility section below.
• Service operation. Requests to our own website and API may produce technical logs, such as IP address, request time, response status and browser or device information. The backend records account-linked product milestones, such as signup, first activity and return visits, to understand reliability and use of the service. These are separate from extension activity payloads. The marketing website does not include advertising or visitor-analytics scripts.
• Optional notifications. If you enable an available notification feature, we process device or push identifiers and delivery records. You can change in-app preferences and withdraw operating-system notification permission. Camp outcomes do not require notification permission or attendance.
• Optional cosmetic purchases. Where checkout is enabled, we process the item, price, currency, country needed for tax, order and provider references, entitlement, refund and verification status. Payment providers process payment details under their own policies; ScrollCat does not need your full card number. Payment availability is platform-specific.
• Support and rights requests. We process the contact information and details you provide to answer you, verify account ownership where needed, resolve complaints and document the response.

3. Legal bases

We process account, aggregate activity, game, requested social features and order data to provide the service or purchase you request (GDPR Article 6(1)(b)). Security, abuse prevention, necessary technical logs, service reliability and limited product milestones rely on our legitimate interests in operating and improving a secure service (Article 6(1)(f)), balanced against your rights. Accounting, consumer complaints and legally required records rely on legal obligations (Article 6(1)(c)). Where optional processing requires consent, we request it separately (Article 6(1)(a)); withdrawing it does not affect earlier lawful processing.

The account and activity information necessary to operate the game is required to provide those features. You can browse the marketing site without creating an account. We do not use game calculations to make decisions with legal or similarly significant effects on you.

4. What others can see

Accepted friends may see your username, cat and the limited journey, level, location or recent activity exposed by the friend screens. Friendship does not grant access to your full personal map or account. A global first-discovery record can show the discovering cat’s name and username at a fictional place. Choose names you are comfortable sharing.

Personal discovery fog, ordinary treasure checks and account details are not made public by the marketing collection previews. Removing a friendship stops future friend access. Previously seen information or screenshots held by another person cannot be recalled by the app.

5. Local storage and cookies

The web app uses an essential HttpOnly refresh-session cookie and browser storage for authentication state, cached game data and interface preferences or drafts. The native companion uses device storage and secure credential storage where supported. These are used for the service you request, not advertising.

The extension stores pending aggregate batches and a refresh credential locally, with access credentials in Chrome session storage. Sensitive storage is restricted to trusted extension pages and the background worker. Queued activity is bound to its account. Unmatched legacy activity is quarantined rather than assigned to a new account.

Disconnecting removes local extension credentials and stops collection. Pending activity remains available only to its original account for up to seven days; expired or rejected activity can be held aside for up to seven further days before removal when the extension runs. Uninstalling removes extension-local storage. Clearing browser storage can sign you out or remove unsynced local data but does not delete your server account.

6. Recipients and international processing

Access is limited to authorized people operating ScrollCat and service providers needed for hosting, databases, backup, transactional email and support. Providers that process data on our behalf must act under appropriate data-processing arrangements. Optional identity, notification, store and payment providers receive the information needed when their features are used; they may also act as independent controllers for their own services.

We do not sell your personal data or provide extension activity for advertising. We may disclose necessary information to professional advisers, competent authorities or others when required by law or to establish or defend legal claims.

Processing locations depend on the providers used for the service and optional features; we do not promise EEA-only processing. For transfers outside the EEA requiring safeguards, we use an applicable adequacy decision or appropriate safeguards such as the European Commission’s standard contractual clauses, with additional measures where necessary. Contact us for the applicable recipients, locations and a copy or explanation of the safeguards, subject to legitimate confidentiality protections.

7. How long information is kept

We keep account and persistent game information while your account is active so your cat can continue its journey. On a verified deletion request, we remove or anonymize information no longer necessary, subject to specific legal obligations or claims. Public pioneer attribution can be anonymized while retaining the fictional world’s shared history.

Authentication data is usable only within its configured expiry or until revoked. Expiry prevents use but is not itself a promise that the database row is immediately purged. Pending extension activity follows the local periods described above. Technical logs, support correspondence and operational records are kept only for the period needed for security, diagnosis, completing the request or resolving a relevant claim. Required purchase and accounting records are retained for the applicable legal period. We assess necessity by the data’s purpose, sensitivity, outstanding obligations and legal requirements, rather than retaining all categories indefinitely.

Backup copies may remain until their scheduled rotation; they are restricted to recovery and must not be used to restore a deleted account to active service. Ask us for the retention criteria and periods applicable to your request. We will explain any exception that prevents immediate erasure.

8. Your rights and how to use them

Depending on the applicable conditions, you can request access, correction, erasure, restriction, data portability and information about recipients. You can object to processing based on legitimate interests and withdraw consent to optional processing. Contact us from your account email where possible. We may request proportionate evidence of account control; do not send passwords or authentication tokens.

We respond without undue delay, normally within one month. If the law permits an extension for a complex or numerous request, we explain the reason within that first month. Requests are normally free. You may complain to your local supervisory authority or the Czech Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7.

9. Age and changes

ScrollCat is intended for people aged 16 or over. We do not knowingly offer it to younger children; contact us if an account may belong to someone under 16. This does not replace any local rules about a minor’s ability to enter a contract or make a purchase.

We update this policy when our processing changes and identify the revision date here. We will give appropriate notice of material changes and obtain consent where required. Contact support · Service terms