Privacy Policy · AlleyCat

AlleyCat is run by ALLEYCAT LABS LLC. This policy explains what the app collects, why, and what you can do about it. It covers the AlleyCat iOS app and this website.

What we collect

Your phone number. AlleyCat has no passwords — your phone number is your account. Our sign-in provider (Firebase Authentication) holds it against your account, and we store a one-way SHA-256 hash of it so friends who have your number in their contacts can find you.

A recovery email, if you add one. You can optionally add an email address so you can get back into your account if you lose access to your phone number. We keep it with your sign-in record, use it only to email you a sign-in link, and never show it to anyone. Resend sends those emails for us.

Your profile. First and last name, username, profile photo, and hometown. Your name, username, and photo are shown to other people alongside anything you post.

What you save and write. Ratings, saved places, review text, and review photos.

Posts and lists you import from. If you use the Instagram or TikTok import, or import a Google Maps list, we process what you share to find the places in it. See “Importing places” below.

Contact matching, if you allow it. See the section below — this one deserves its own explanation.

Location, while you are using the app. See the section below.

Device and usage data. A device identifier used to deliver push notifications, an analytics identifier, and records of in-app actions such as screens viewed and the length (not the text) of searches. If the app crashes or hits an error, a report with the error message and technical stack trace is sent to us.

Subscription status. If you subscribe to Locals Only, we record whether your subscription is active. See “Who we share data with.”

Your email, if you join the Android waitlist. If you enter your email on this website to hear when AlleyCat comes to Android, we keep it only to tell you when it does. It is not linked to an app account. Every email we send has an unsubscribe link, or email support@alleycatmap.xyz to be removed.

We do not collect your payment card details (Apple handles payment), health data, or browsing history, and the app contains no advertising.

Contact matching

If you choose to find friends from your contacts, AlleyCat reads the phone numbers in your address book, normalises them, and converts each one to a SHA-256 hash on your device. Your raw contacts, names, and email addresses are never uploaded.

The hashes are uploaded, and we store them, linked to your account — up to 5,000 of them. We use them for two things: to look up whether a matching account exists, and to keep a lookup list of which accounts have which number saved. That list lets us send a push notification such as “Sam joined AlleyCat” to people who already have a new member’s number saved in their contacts.

A hash is not anonymous. Phone numbers are short and predictable, so anyone with access to the stored hashes could work out the numbers behind them by guessing. We keep the hashes on our servers only and do not show them to anyone, but we want you to understand that limit.

Turning off Contacts access later stops new uploads. It does not delete hashes we already stored. Deleting your account removes them (see below), or email support@alleycatmap.xyz and we will remove them.

You can decline contact access, and AlleyCat works without it — you just have to find friends by searching for them.

Importing places

AlleyCat can pull places out of things you share with it.

Instagram and TikTok. When you paste or share a post, the app reads its caption, title, preview images, and in some cases the video, and sends them to our servers. We send that content to Google’s Gemini model (through Google Cloud) to read the restaurant and bar names in it, then look those names up in Google Places. We keep a record of the posts you imported and the places they led to, along with a copy of the post’s preview image.
Google Maps lists. When you paste a shared list link, the app sends the list’s title and the places in it to our servers so we can match them against Google Places and save them for you.

We use this only to run the import, never for advertising.

Analytics and error reports

To understand which features are used and to find bugs, AlleyCat sends product analytics and error reports to PostHog. Events are tied to your account ID and record things like which screen you opened, which feature you used, your general metro area, and counts or yes/no flags (for example, how many people you follow, in ranges). PostHog also receives your IP address as part of the connection, as any internet service does.

We deliberately do not send the text you type or write, and we do not record your screen, taps, or sessions.

We use analytics only to improve the app — never for advertising — and we do not sell it.

Location

AlleyCat asks for location only while you are using the app. There is no background location collection.

We use your location to centre the map, show places near you, and label which city you are in. When you search, your location is sent to Google Places so results are relevant to where you are. We do not store your coordinates on our servers.

Two other services see location in a coarser or separate form: our analytics record your general metro area, never your coordinates, and Mapbox collects its own location data as part of providing the map. See “Who we share data with.”

You can turn location off at any time in iOS Settings. The map still works; it just will not start where you are.

What other people can see

AlleyCat is a social app, so some of what you do is visible to others by design:

Your profile — name, username, photo, and hometown — is public.
Your ratings, saved places, and reviews are visible to people who follow you, and appear in their feed.
Your reviews are shown to anyone viewing that place, alongside your name, username, and photo.
Your phone number is never shown to anyone.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We use these service providers to run the app:

Google — Firebase for sign-in, database, file storage, and app verification (App Check); Google Cloud’s Gemini model to read places out of posts you import; Google Places for restaurant data, search, and photos.
PostHog — product analytics and error reports.
Mapbox — maps. Mapbox collects its own usage and location analytics as part of providing the map.
RevenueCat — manages Locals Only subscriptions. It receives your account ID and your purchase and subscription status. Apple processes the payment; we never see your card.
Resend — sends recovery-email links, and the Android waitlist emails.
Expo — push notification delivery.
Unsplash — city photos. We fetch them from our servers, so Unsplash receives only the name of a city, not information about you.
Vercel — hosting and analytics for this website.

We may also disclose information if the law requires it.

Deleting your account

You can delete your account at any time from Settings. It takes effect immediately, and you do not need to email us to finish the job.

Deleting your account removes:

Your profile — name, username, photo, hometown, and phone number — along with the one-way hash that let friends find you by number, and your username, which becomes available again.
Your recovery email, if you added one, along with the rest of your sign-in record.
The contact hashes you uploaded, and your entry in the lookup list that tells us who has which number saved.
Your ratings, saved places, reviews, and review photos, including the copy of each review shown on the place you reviewed.
Your posts, and the comments and likes other people left on them.
Comments and likes you left on other people’s posts.
Your contribution to each place’s rating and Most Loved counts.
Your follows, in both directions, and any accounts you blocked.
Your notifications — both the ones you received and the ones other people received from you — and the device tokens used to send you push notifications.
Your Locals Only entitlement record, your import history for Google Maps lists, and your Instagram and TikTok share credentials.
Your sign-in credentials.

Some things are not covered by that, and we would rather say so than imply otherwise:

Reports you filed about someone else’s content stay. A report is a safety record about another person’s content rather than about you, and deleting it would remove something we may still need to act on. Reports about you are deleted along with everything else.

Instagram and TikTok import records are not removed automatically. The record of which posts you imported, and the preview images we saved from them, stay after you delete your account. Email support@alleycatmap.xyz and we will delete them. A separate shared record of a post’s places, which is not linked to your account, also stays.

Data held by our providers is not removed by in-app deletion. That includes analytics events held by PostHog, your subscriber record at RevenueCat, and Apple’s own purchase records. Email support@alleycatmap.xyz and we will ask them to remove what they hold about you where we can.

How long we keep things

We keep your account data for as long as your account exists. When you delete your account we remove it immediately, apart from the exceptions described above.

Your rights

Depending on where you live, you may have the right to see the data we hold about you, correct it, delete it, or receive a copy of it. If you are in California, you also have the right not to be discriminated against for exercising those rights.

To make a request, email support@alleycatmap.xyz. We may need to verify that you control the phone number on the account before acting.

Children

AlleyCat is not for children under 13, and we do not knowingly collect data from them. If you are in the European Economic Area or the United Kingdom, you must be at least 16.

If you believe a child has created an account, email support@alleycatmap.xyz and we will remove it.

Changes to this policy

If we change this policy we will update the date at the top of this page. If the change is significant, we will tell you in the app before it takes effect.

Contact

AlleyCat is operated by ALLEYCAT LABS LLC, California, United States.

Questions about this policy, or about your data: support@alleycatmap.xyz