Privacy Policy

Last updated: September 2026  ·  We don't sell your data. Ever.

The short version

WhiteCat is a tool for parents, built by parents. The thing most people worry about — a record of every site your family looks up — is switched off when the router leaves the factory. You turn it on yourself, in the app, and it fails closed: unless the router can positively read "on", it records nothing.

What the router sends us by default is duller: which devices are on your network, what those devices call themselves, and whether the router is healthy. It goes every 30 to 60 seconds, which means that kept together over a day it does show when each device was at home. Below we list all of it, name every company that receives any of it, and say how long we keep it.

We don't sell data to advertisers, and we never see the content of what your family reads, types or watches. Full stop.


Who we are

For customers in the US and rest of world: White Cat Cloud Inc., 8 The Green, Dover, DE 19901, USA.
For customers in the EU/EEA: Cluster s.r.o., Rusovská cesta 15, 851 01 Bratislava, Slovak Republic — see the GDPR section below.
Questions? Email us at privacy@whitecatcloud.com

What we collect and why

Always on — this is how the product works

What Why
Your email address To create and manage your account
Router health, every 30 seconds: uptime, free memory, firmware version, and the router's own WAN MAC address To show the router as online, and to send security updates to the right device
One line per connected device, every 60 seconds: the device's MAC address, whether it is on Wi-Fi or cable, and signal strength So the app can show who is online right now. Kept together over a day, this does show when each device was at home
When a device first appears: its MAC and IP addresses, the name it announces over DHCP, its vendor class, and the service records it broadcasts on your local network To build your device list and give each device a readable name instead of a hex address. Names people choose for their devices often contain a first name
Crash and error reports from the app and the router firmware To find and fix faults. Reports from the app carry your account identifier
Subscription and billing status (from Apple or Google) To activate your plan features

Off from the factory — nothing is recorded unless you switch it on

What Why
Which domains each device asked for, with the time and whether it was allowed or blocked So you can see what was requested and correct a wrong block. Off by default, switched on per profile, and the router will not record unless that setting positively reads "on"
Screen time and activity overview So you can see time spent per person. Off by default and switched on per person
Anonymous data you choose to share with us To improve the filter lists for everyone. Off unless you opt in
We never see the content of what your family does online. WhiteCat works on domain names. At most it can know that a device asked for "youtube.com" — never which video was watched, what was searched, or what was typed. That content is encrypted and never reaches our servers at all.

Who else receives any of it

These are the companies that receive any part of your data, and there are no others. The first six work under a data processing agreement and may act only on our instructions — none of them may use your data for their own purposes. Apple and Google are independent controllers for the app store purchase itself, and tell us only whether your subscription is active. All of them are based in the United States except Google Ireland Ltd., so those transfers run on the European Commission's Standard Contractual Clauses.

Company Based in What it receives
Anthropic PBC USA To turn a new device into a readable name: its MAC address, the manufacturer we derive from that address, the name and vendor class it announces over DHCP, and the service records it broadcasts locally. This is on by default. Because people name their devices things like "Emma's iPhone", that name can be part of what is sent.
Cloudflare, Inc. USA Our upstream encrypted DNS resolver (1.1.1.2 / 1.0.0.2), so it sees every domain your network resolves to the outside world — there is currently no setting to point somewhere else. Cloudflare is also our reverse proxy for app and router traffic, our CDN, and the object storage that holds our database backups.
Google Ireland Ltd. / Google LLC Ireland / USA Sign-in and push notifications. The "a new device joined your network" notification carries that device's MAC address and name in readable form. Google also receives anonymous visit statistics for this website, and only if you accept them in the cookie banner.
Functional Software, Inc. (Sentry) USA Crash and error reports from the app and from the router firmware, so we can fix faults. On by default; reports from the app carry your account identifier.
650 Industries, Inc. (Expo) USA Delivery of mobile app updates.
DigitalOcean, LLC USA The servers and database the service itself runs on.
Apple Inc. / Google LLC USA Subscription purchase and billing status through the App Store or Google Play. They act as their own controllers for that transaction, not on our instructions.

How long we keep it

What How long
Router operational logs About 34 hours, then overwritten
The per-device domain log, if you switched it on Since September 2026 we no longer store these queries individually in our database — all we derive from them is when a device was last online. The raw batch sits in the operational logs above for about 34 hours
Screen time and activity overview, if you switched it on 30 days
Anonymous data you choose to share with us Deleted within 24 hours
Database backups Up to 12 monthly snapshots — so a copy of your data can survive in a backup for up to a year after you delete it. We use these only to restore the service after a failure
Your device list, router settings and account For as long as your account exists

Children's privacy

WhiteCat is operated by parents — accounts are created and managed by adults only. We do not knowingly collect personal information directly from children under 13. A family member profile in the app (for example "Emma, age 8") is created by you and holds only a name and an icon.

One thing worth knowing: a phone usually announces its own name on the network, and people name phones after their owner. So a child's first name commonly reaches us as part of a device name, and is included in the device-naming step described above. You can rename or delete any device in the app. If you believe we hold data from a child that we should not, email privacy@whitecatcloud.com and we will delete it.

What we never do

  • We never sell your data — not to advertisers, not to anyone
  • We never read the content of your family's internet traffic
  • We never build advertising profiles of you or your children
  • We never share your data with schools, governments or other companies beyond the ones named above, except where the law requires it
  • We never switch on the domain log or the screen time overview for you — that is your decision

Where your data is stored

The service runs on servers in the United States. Backups sit in Cloudflare's object storage, which is configured to choose its own region — so we cannot promise you that a backup stays inside the EU, and we are not going to pretend otherwise.

What does not leave your home is your traffic itself: the router does not proxy, mirror or store the pages, messages or video your family loads. What leaves it continuously is the device and health data listed above — roughly 36 MB a month for a household with nothing switched on, and around 140 MB with activity logging enabled.

Support access to your router

Every WhiteCat router keeps an outbound maintenance connection open to our servers, which lets our engineers log in to the device to diagnose faults. It is enabled on every router we ship, there is currently no switch to turn it off, and the app does not tell you when it is used. We are stating it plainly because it is true, and we regard the lack of a switch and the lack of an indicator as gaps in your control rather than features.

Cookies and this website

Separately from the router: this website uses Google Analytics to count visits. No analytics cookie is set until you accept it in the banner, and you can withdraw that at any time from the same banner. If you write to us using the form below, your name, email address and message reach us by email and are kept only as long as we need them to answer you. None of this has anything to do with your router or your family's devices, and we do not use it for advertising.

Your rights

You can ask us for a copy of your data, ask us to correct it, ask us to delete your account and everything attached to it, or object to a particular use. Email privacy@whitecatcloud.com. There is no self-service export button in the app yet, so we handle these by hand: we acknowledge within 5 business days and complete the request within 30 days. After a deletion, a copy of your data can remain in a monthly backup snapshot for up to a year, until that snapshot expires.

You can also switch the domain log and the screen time overview off in the app at any time. They take effect immediately and stay off until you turn them back on.

Changes to this policy

If we make meaningful changes to this policy, we will notify you by email and update the date at the top of this page. We will never quietly change what we do with your data.

Questions about your privacy?

For EU customers (GDPR)

This section supplements our general privacy policy with information required by the EU General Data Protection Regulation (GDPR / DSGVO).

Data Controllers

  • For EU customers: Cluster s.r.o., Rusovská cesta 15, 851 01 Bratislava, Slovak Republic. Full details: Imprint.
  • For US/other customers: White Cat Cloud Inc., 8 The Green, Dover, DE 19901, USA.

Data categories

Account email · router health telemetry every 30 seconds, including the router's WAN MAC address · per-device telemetry every 60 seconds (device MAC address, connection type, signal strength) · device discovery data (MAC and IP addresses, DHCP hostname and vendor class, locally broadcast service records) · crash and error reports · subscription status · and, only where you have switched it on, per-device DNS query records, the screen time overview, and anonymous data shared to improve the filter lists.

Legal basis

  • Art. 6(1)(b) — contract: your account, the device list, policy enforcement and router health.
  • Art. 6(1)(a) — consent: the per-device DNS query log, the screen time overview, the anonymous data you choose to share, and analytics cookies on this website. All are off by default and you can withdraw consent at any time, with immediate effect.
  • Art. 6(1)(f) — legitimate interest: network security, and crash and error diagnostics to keep the product working.

Data location and transfers

Service infrastructure runs in the United States (DigitalOcean). EU customer data is therefore transferred to the United States, and we rely on the European Commission's Standard Contractual Clauses (SCCs) as the transfer mechanism.

Our processors under Art. 28 GDPR are: DigitalOcean, LLC (USA, hosting) · Cloudflare, Inc. (USA, upstream DNS resolution, reverse proxy, CDN and backup object storage) · Anthropic PBC (USA, automated device naming) · Google Ireland Ltd. (Ireland) and Google LLC (USA) (authentication, push notifications and website analytics) · Functional Software, Inc. trading as Sentry (USA, crash and error reporting) · 650 Industries, Inc. trading as Expo (USA, mobile app update delivery). Apple Inc. (USA) and Google LLC act as independent controllers for App Store and Google Play purchases and report only your subscription status to us.

Our backup storage buckets are configured to let the provider select the region, so we cannot currently assert that backups are held only in the EU.

Your rights

Under GDPR you have the right to access, rectify, erase, port, restrict the processing of, and object to the processing of your personal data, and to withdraw any consent you have given. We handle these requests manually: we acknowledge within 5 business days and complete them within 30 days. You also have the right to lodge a complaint with a supervisory authority — in Slovakia: Úrad na ochranu osobných údajov. EU customers may additionally file with their own national authority.

No selling, no advertising profiles

We do not sell personal data. We do not use your family's data for advertising, and we do not build profiles of your children.

We do use one automated step, and we would rather name it than let you find it: when a new device appears on your network, its identifiers and the names it broadcasts are sent to a model operated by Anthropic PBC so it can propose a readable device name. It produces a label for a piece of hardware. It makes no decision about a person and has no legal or similarly significant effect within the meaning of Art. 22 GDPR. There is no self-service switch that turns this off for your account today — every newly discovered device goes through it. You may object under Art. 21 GDPR and we will handle that by hand, and you can always set your own name for a device in the app, which takes precedence over the generated one.

Privacy contact

For privacy requests, please email: privacy@whitecatcloud.com