Privacy Policy
Effective September 16, 2026
Cato is built to hold as little of your life as possible.
What lives only on your phone
Your orders, your proofs, your record (the wall), your stats, your kept quotes, and your preferences are stored on your device. Proof text is never uploaded. Deleting the app deletes this record.
What we process
- Your answers, to write your orders. Only with your explicit permission, your onboarding answers (including your first name), stats, and a seven-day summary of completions, reductions and order feedback are sent to our order service, which passes them to Anthropic, the AI provider that writes the orders. Our own servers keep nothing you write: the request is used to generate that day's orders and kept no longer. To stop one person running up the bill for everyone, our order service counts requests per day against a salted, shortened one-way hash of the network address the request arrived from, plus a running daily total. That counter holds no answers, no proof text, no phone number and no raw address, and it is removed after fourteen days. Anthropic handles what it receives under its own privacy terms. Decline to use the bank, or withdraw permission in Settings. Proof text and your phone number are never sent to Anthropic.
- Your phone number. Verifying your number creates your account and identifies your account. Your record stays on the current phone; there is no cloud record recovery. It is stored by our authentication provider (Supabase) and verified through Twilio. We never sell it, and no one calls you.
- Purchases. Handled by Apple and RevenueCat. We never see your payment details.
What we do not do
No ads, no ad SDKs, no tracking across apps, no selling of data and no analytics. The app contains a dormant weekly active-use ping that is switched off in every shipped build; if it is ever switched on, this policy and the App Store privacy labels will say so first. Data is shared only with the service providers described above.
Deleting your account
Settings → Delete account. This removes your number from our systems and erases the record on your phone. It cannot be undone.