Catalog Privacy Policy

Effective date: November 17, 2026
Last updated: November 17, 2026

Catalog is a place to keep the books, films, music, podcasts and shows that matter to you, and to share some of them with other people. This policy explains what information Catalog collects, why, who else touches it, and what you can do about it. We've tried to write it the way we'd want it explained to us.

"Catalog," "we," "us" and "our" mean Tommy Shimko, of Brooklyn, New York, which makes the Catalog app and runs catalogthings.app. Questions go to tommy@catalogthings.app.

The short version

• We collect what you give us (your account, your shelves, your posts) and a small amount of technical information to keep the app working.
• We don't sell your information, we don't share it for advertising, and Catalog has no ads and no third-party tracking or ad SDKs.
• Some things are public by design: your profile, posts, comments, likes, follows and diary entries. Your notes are private.
• AI features only run after you say yes, and you can take that back in Settings.
• You can delete your account, and everything with it, from inside the app.

What we collect

Information you give us

• Account details: your email address, and your Apple ID token if you use Sign in with Apple (if you choose "Hide My Email," we only see Apple's relay address). If you sign in with email, we store a securely hashed password or send you one-time codes.
• Profile: display name, handle, bio, and a profile photo you pick from your camera or photo library.
• Your catalog: the titles, creators and types of things you add, how you arrange them on shelves and lists, your progress and diary entries, and your notes. If you save an article, the link you add is sent to our server so we can read the page's title, publication and picture.
• Social activity: posts, comments, likes, follows, @-mentions, club and shared-list membership, and messages you send to other members of a club.
• Community covers: cover images you choose to upload so other people can use them.
• Location you choose to share: if you turn on local picks, the ZIP code you enter, which we turn into a city. We never collect precise location.
• Your subscriptions: if you tell Catalog which streaming services or publications you subscribe to (so it can show what you can watch or read), that list stays on your device.
• Safety actions: people you block and content you report.
• Feedback: anything you send us through the in-app feedback form or email.

Information collected automatically

• Device and app information: device model, operating system version, app version and build, and language.
• Push notification tokens, if you allow notifications.
• Diagnostics: crash and error reports, which we collect ourselves.
• Usage events: first-party records of how the app is used (for example, which screens are opened or which features are tried), so we can tell what's working and what's broken. These stay with us. We don't use third-party analytics or advertising tools, and we don't track you across other companies' apps or websites.

We don't access your contacts, and we don't collect precise location, health, financial or biometric information.

Why we use it

We use your information to:

• Run Catalog for you: create your account, sign you in, store and sync your catalog, show your shelves, and deliver notifications you've asked for.
• Power social features: show your public profile and posts, deliver comments, likes and mentions, and run clubs and shared lists.
• Provide features you turn on: AI features (below) and local picks.
• Keep people safe: review reports, enforce our Terms of Service, prevent abuse, spam and fraud, and respond to legal requests.
• Fix and improve the app: find crashes, understand which features are useful, and plan what to build next.
• Talk to you: answer support requests and send important notices about your account or these policies. We don't send marketing email without your permission.

We only use information for the purpose it was collected for, or for a closely related one you'd reasonably expect.

What's public

Your display name, handle, bio, profile photo, posts, comments, likes, follows, diary and progress entries, and the community covers you upload can be seen by anyone using Catalog. Share cards and QR member cards you export can be seen by anyone you send them to. Notes on your items are private to you. Club messages are visible to the members of that club.

Please think before posting: once something is public, other people may have seen, screenshotted or copied it, and deleting it from Catalog can't undo that.

AI features

Some features use Claude, an AI model made by Anthropic, through our own server. The first time you use one, Catalog asks your permission and explains what will be sent. Nothing goes to the AI before you agree, and you can withdraw consent at any time in Settings (features that need AI will then stop working until you turn it back on).

Per Anthropic's commercial terms, Anthropic doesn't use this data to train its models. We sometimes cache AI results (for example, a summary of a book) so they don't have to be generated twice; those cached results aren't tied to you. AI output can be wrong, so treat it as a suggestion.

Who else handles your information

We don't sell your personal information, and we don't "share" it for cross-context behavioral advertising as California law defines those terms. We share information only with the service providers that help run Catalog, under contracts that limit them to providing their service:

• Apple — Sign in with Apple, push notifications, App Store purchases.
• Supabase — database, authentication and file storage (United States).
• Vercel — hosts our server.
• Anthropic — AI features, only after you consent.
• Expo (EAS) — app updates and push notification delivery.
• RevenueCat — subscription management, only once paid features launch.

To find titles and cover art, Catalog looks things up in public catalogs: TMDB, Open Library, Google Books, Apple iTunes/Apple Music, Deezer, MusicBrainz, Last.fm and Wikipedia. Only the search terms or titles are sent, never your name, email or account. For articles, our server fetches the page you linked (the publisher sees a request from our server, not from you) and keeps its title, publication and picture.

We may also disclose information if the law requires it, to protect someone's safety, to investigate abuse or violations of our Terms, or as part of a merger, acquisition or sale of Catalog (in which case this policy would continue to protect your information, and we'd tell you before it changed).

Categories of personal information

California and several other states ask businesses to describe personal information in standard categories. We're including this even where those laws may not apply to us yet.

We don't collect sensitive personal information as defined by California law, other than account login credentials used only to sign you in.

How long we keep it

• Your account and content: for as long as your account exists.
• After you delete your account: removed from our live systems right away; it may remain in encrypted backups for up to 30 days before being overwritten.
• Crash and error logs: about 90 days.
• Moderation records (reports, blocks, enforcement actions): as long as needed to keep the community safe and meet legal obligations.
• Anonymized or aggregated data that can't identify you may be kept longer.

Your choices and rights

Wherever you live, you can:

• See and edit your profile and catalog in the app at any time.
• Get a copy of your data by emailing tommy@catalogthings.app.
• Delete your account in Settings → Delete account. This deletes your profile, catalog, posts, comments, likes, follows and profile photo, and revokes Catalog's Sign in with Apple access.
• Withdraw AI consent in Settings.
• Turn off notifications in iOS Settings, and stop local picks by removing your ZIP.
• Block or report anyone or anything from the app.

California residents have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of sale or sharing (we don't do either); to limit use of sensitive personal information (we don't use it beyond sign-in); and not to be treated differently for using these rights. Residents of other US states with privacy laws (such as Virginia, Colorado, Connecticut and others) have similar rights. Canadian residents have rights under PIPEDA and provincial law to access and correct their information and to withdraw consent.

To make a request, email tommy@catalogthings.app from the address on your account. We'll verify it's you, respond within 45 days (30 days for Canadian requests), and won't charge you. An authorized agent may make a request on your behalf with your written permission. If we can't help, we'll explain why, and you may appeal by replying to our decision.

Children

Catalog is for people 13 and older. We don't knowingly collect personal information from children under 13. If we learn that someone under 13 has an account, we'll delete it. If you believe a child under 13 is using Catalog, please email us.

Security

Data is encrypted in transit, stored with access controls that limit each person to their own private data, and accessed by us only when needed to run or support Catalog. No system is perfectly secure, so we can't promise absolute security, but we'll notify you and the relevant authorities if a breach affects your information, as the law requires.

Where your information is stored

Catalog is run from the United States, and your information is stored and processed in the US. If you're in Canada, your information will be transferred to and stored in the United States, where it may be accessible to courts, law enforcement and national security authorities under US law. By using Catalog you understand this transfer. Our privacy contact for Canadian users is tommy@catalogthings.app.

New York and California notices

Catalog doesn't respond to "Do Not Track" browser signals because we don't track you across sites or apps in the first place. California's "Shine the Light" law lets residents ask about disclosures to third parties for their direct marketing; we make none.

App Store privacy label summary

This is how Catalog's data use appears on its App Store page:

Data Used to Track You: None.

Data Linked to You:

• Contact Info — email address, name
• User Content — photos, posts, comments, messages, other user content (catalog items, community covers, feedback)
• Identifiers — user ID, device ID (push token)
• Usage Data — product interaction
• Diagnostics — crash data, other diagnostic data
• Location — coarse location (only if you enter a ZIP for local picks)
• Purchases — purchase history (only once subscriptions launch)

Data Not Linked to You: None.

Changes to this policy

If we change this policy, we'll update the date at the top. If a change is significant, such as a new use of your information, we'll tell you in the app or by email before it takes effect, and ask for your consent where the law requires.

Contact

Tommy Shimko
Brooklyn, New York, USA
tommy@catalogthings.app · https://www.catalogthings.app