Privacy Policy

Data we collect

Account data (your name and email; passwords are handled by our sign-in provider), profile data, listing data for breeders, transaction data, the messages you exchange on the platform, and buyer screening answers. We also collect technical logs needed to run and secure the service, product-usage events to understand and improve it, and advertising-measurement data described below.

Sign-in & social login

Sign-in is handled by our authentication provider (Amazon Cognito); we never see or store your password. If you sign in with Google — or Apple, when available — we receive your name, email address, and basic profile information from that provider — exactly what you allow in your privacy settings with them. We use it to create and authenticate your account, and we don't share it beyond what this policy describes.

Verification data

Breeders seeking verification provide cattery registration details and documents, health-test documents, and show-title documents. We authenticate these against their issuing sources and public registries (such as OFA and PawPeds), and we match health documents to the specific cat by microchip number.

Where a document itself is shown to buyers, it is shown redacted and only to buyers who have expressed interest in that breeder. Verification records are kept while the badge they support is live and as needed for fraud prevention.

How we use it

To operate the marketplace: showing listings, connecting buyers and breeders, processing transactions, verifying breeders and documents, preventing fraud, providing support, and sending transactional emails. We use PostHog for product analytics and OpenAI and Google for measuring the effectiveness of TrueKitten's ads. We also use Meta for advertising measurement and optimization, subject to the controls described below.

Message review & fraud prevention

Messages you send on the platform are screened by automated checks that look for scams, fraud, and attempts to move payments off the platform. A message flagged by those checks may be reviewed by our team. This review exists to protect you and to enforce our terms — never to build marketing profiles; message content is never shared with advertisers and never sold.

Payment data

Payments are processed by Stripe. Your card or bank details go directly to Stripe; we never store your card number on our systems. We receive from Stripe only what we need to run the transaction, such as payment status.

Photos

Photos you upload are processed before storage: we strip embedded EXIF data, including location metadata, so an uploaded photo can never reveal where it was taken.

Location

Breeders can put their city and state on public profiles and listings. IP addresses received when your browser connects to our service and measurement providers can imply a coarse location. We do not request precise GPS location, and GPS data embedded in photos is stripped on upload (see Photos above).

Cookies

We use cookies and similar storage to keep you signed in, protect the service, understand usage, and measure ads. You can block or delete cookies in your browser; some features may stop working. Your appearance preference is saved with your account.

Advertising measurement

OpenAI helps us measure whether ads lead to visits, buyer and breeder registrations, offers, live video requests and purchases. It receives browsing and purchase activity, including page, listing, registration, request and transaction references, purchase values, and browser and ad-click identifiers.

OpenAI may also automatically collect contact and location details from the page to match activity to ads. Names, email addresses and phone numbers are hashed in your browser before sending; country, city, state and postal code may be sent without hashing. We exclude private messages, preferred call times, screening answers, documents and payment credentials from conversion events.

Google helps us measure whether ads lead to newly saved breeder profiles, successfully submitted offers, live video requests and completed purchases. It receives browser and ad-click identifiers, breeder-registration and live video request references without contact details and, for purchases, an order reference that contains no contact details and a purchase value based on our platform fees. Google may use cookies for this measurement. We do not send offer IDs, offer prices, preferred call times, messages or screening answers to Google. We do not send your name, email address, phone number or address to Google for matching.

Breeder-registration conversions are separate from buyer registrations and purchases and have no monetary value. For breeder-registration conversions, we respect Global Privacy Control, Do Not Track and an advertising-storage or advertising-data denial reported to us by a consent manager.

Meta advertising measurement

For Meta measurement, we respect Global Privacy Control, Do Not Track and an advertising-storage or advertising-data denial reported to us by a consent manager. A previously saved Meta refusal in your browser continues to apply. You can use these browser controls or contact us to request that we stop sharing your activity with Meta. These controls apply to Meta; the OpenAI, Google and PostHog practices described in this policy are separate. Blocking or deleting browser storage can limit measurement but does not by itself stop delivery of activity already linked to your account; contact us for help with that request.

When measurement is enabled and these controls permit it, Meta receives public page views, newly saved breeder profiles, successfully saved offers and completed sales to measure and improve TrueKitten's ads. Shared fields are event times, opaque event references, public page addresses or the breeder onboarding page address, your IP address and browser user agent, and Meta browser and ad-click identifiers when available. A completed-sale value is based on TrueKitten's platform fees after applicable credits, not the kitten's full price or our profit. Meta may use this information to match activity to ads and optimize advertising under its own privacy policy.

We do not enable automatic advanced matching for Meta. We do not send Meta your name, email address, phone number, street address, private messages, screening answers, documents, payment credentials or session recordings. Our browser measurement context and server attribution are valid for at most 90 days. A saved refusal remains in your browser until you clear it. We remove our server matching data on withdrawal or expiry and keep opaque delivery references to prevent duplicate reporting. Meta's storage and processing are governed by its own privacy policy.

What's public

Some information is public by design: a breeder's cattery name, profile, photos, badges, city and state, their listings, and the Verified Owner Stories and reviews written about them. Buyer accounts are not public. After you delete your account, your profile details are replaced with anonymized placeholders (see Retention & deletion below).

Sharing

We share data with service providers who process it for us — Stripe (payments), Amazon Web Services (hosting, sign-in via Cognito, and email via SES), Sentry (error monitoring), and PostHog (product analytics) — under contracts that limit what they may do with it. We also share the advertising-measurement data described above with OpenAI, Google and Meta, subject to the controls described above. Your transaction counterparty sees what the product shows them: for example, a breeder sees your display name, screening answers, and messages, and when a sale contract is signed, each party sees the name the other provided on it. We may share data with our professional advisors (such as lawyers and auditors) when needed, and we may use and share aggregated data that identifies no one (such as demand counts).

If TrueKitten is ever part of a merger, acquisition, or sale of assets, personal data may transfer with the business — and the successor stays bound by this policy's promises, including the never-sell commitment below.

We never sell your personal information.

Legal requests

We disclose data when required by law: in response to valid legal process, to enforce our terms, to investigate fraud, or to protect the safety of our users or the public. If we receive a legal request for your data, we will attempt to notify you before disclosing it, unless we are legally prohibited from doing so.

Security & breach notice

We protect your data with encrypted connections, isolated environments, and least-privilege access, and your card details go directly to Stripe — they never touch our servers. No online service can guarantee absolute security, but if a breach affects your personal data, we will notify you and the required authorities as applicable law requires.

Retention & deletion

You can delete your account yourself from your account settings. When you do, we remove your profile details — your name, email, location, and screening answers — replacing them with anonymized placeholders. We keep records we are legally or financially required to retain, such as completed transactions, contracts, and tax records; these no longer carry your contact details. Buyer–breeder messages follow the existing delayed cleanup schedule after account deletion. Support conversations with the TrueKitten team, including their contact email and page context, are retained for now, including resolved conversations; there is no automatic age-based expiry. You can contact us about a verified privacy request.

If your account is in the middle of a transaction, deletion is queued and completes once that transaction finishes, so a live deal is never left stranded. Records are always soft-deleted and redacted, never silently kept in full.

Your rights & requests

We grant these rights to every user, wherever you live: you can ask what data we hold about you, correct it (most of it directly in your account settings), and delete your account yourself from settings — or email contact@truekitten.com for any of these. For emailed requests we verify your identity first, and we respond within 45 days. If we decline a request, we will tell you why, and you can appeal by replying — a person will take a second look. An authorized agent may submit a request for you with proof of your authorization.

Exercising these rights never costs you features, pricing, or service quality. And where the law of your state grants you more than this policy does, you keep it.

Children

TrueKitten is not directed to anyone under 18, and we do not knowingly collect data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.

US only

TrueKitten is offered in the United States and intended for people who live here. Our marketplace systems are hosted in the United States.

Changes to this policy

We may update this policy. If a change is material, we will notify you before it takes effect, and the “Last updated” date above always reflects the current version.

Contact

TrueKitten is operated by NorthPeak Software, Inc. (opens in a new tab) Privacy questions: contact@truekitten.com or (302) 587-7787, 9 AM – 5 PM ET, Monday – Saturday.