Privacy Policy
Effective 23 October 2026
The short version
Compression Cat analyses your app file entirely inside your web browser. The file is never uploaded, never transmitted, and never stored. There is no server to send it to.
We do not use cookies. We do not use local storage. We do not run analytics, advertising, or crash-reporting software. There are no accounts, so there is nothing to sign up for and nothing to delete.
The one exception, stated plainly because it would be dishonest to omit it: like every website, the server that delivers this page keeps ordinary access logs. Section 3 explains exactly what those contain.
1. Who this policy is from
This policy describes how Eugene Antonov (an individual) ("we", "us") handles information in connection with the Compression Cat website and tool at compressioncat.com (the "Service").
Email: nvprompts@gmail.com
This Service is operated from the United States. It has no establishment, staff or equipment in the European Union or the United Kingdom, and it is not directed at, marketed to, or targeted at people there. It offers no EU or UK language versions, no local pricing, and runs no advertising or search campaigns aimed at either.
Section 7 sets out how we handle requests from people in those places regardless. We would rather answer the request than argue about whether we have to.
2. What the tool itself collects: nothing
When you drop a build artifact (an .apk, .aab, .ipa or .zip file) into Compression Cat, the entire analysis runs on your own device, inside your browser tab, in a Web Worker.
- Your file is not uploaded to us or to anyone else.
- Your file is not copied, retained, cached or written to disk by us.
- No part of the analysis — no file name, no file path, no size, no result — is transmitted anywhere.
- When you close or reload the tab, everything is gone. There is nothing to delete because nothing was kept.
This is enforced technically, not merely promised. The page is served with a Content-Security-Policy containing connect-src 'none', which instructs your browser to refuse any network connection the page attempts. You can verify this yourself: open your browser's developer tools, watch the Network tab, and analyse a file. Once the page has finished loading — the analyzer itself is fetched from this site a moment after the page appears — you may disconnect from the internet entirely and analysis will continue to work in that tab.
Reports you export (Markdown, CSV or JSON) are generated in your browser and saved by your browser to your own device. They are not sent to us.
3. What the web server logs
The Service is delivered by a hosting provider (Netlify, Inc.). Like effectively all web servers, it records ordinary access logs when your browser requests a page or asset. Those logs typically contain:
- your IP address;
- the date and time of the request;
- which file was requested and the response status;
- your browser's user-agent string and, where your browser sends one, the referring page.
These logs are created by the act of requesting a web page. They are not created by using the tool, they contain nothing about your app file, and analysing a file adds no entry to them.
An IP address can constitute personal data under the GDPR (Recital 30; Case C-582/14, Breyer v Bundesrepublik Deutschland) and personal information under the CCPA where it can reasonably be linked to a person. We treat it as such.
Purpose and lawful basis: we rely on our legitimate interests (GDPR Article 6(1)(f)) in delivering the site securely and reliably, diagnosing faults, and protecting against abuse. We do not use these logs to build a profile of you, and we do not combine them with any other source.
Retention and access: these logs are created and held by Netlify, Inc. on its own infrastructure, under its own retention schedule, for its own security and operational purposes as well as ours. We do not run the server, and on our hosting plan we do not receive, export or archive raw access logs — so we could not build a history of any visitor even if we wanted to.
Netlify, Inc.'s Data Processing Addendum states that access logs are retained online for 90 days and offline for one year. We reproduce that figure rather than assert our own, because it is their schedule and not ours; it is stated in a security annex covering their infrastructure generally, and you should confirm it against their current documentation rather than rely on this page.
5. Do Not Track and Global Privacy Control
California Business & Professions Code § 22575(b)(5), added by AB 370, requires an operator to say how it responds to Do Not Track signals. Whether that chapter reaches a free tool that collects nothing is genuinely arguable — § 22577(d) defines a "consumer" as someone who acquires goods or services "by purchase or lease", and nothing here is bought. We publish this policy anyway, in full, because the argument is not worth having and you are entitled to know either way.
We do not track you across time or across third-party websites, and we have no mechanism that could do so. A Do Not Track header, or a Global Privacy Control signal, therefore requires no change in our behaviour: the outcome those signals ask for is the only behaviour available here.
We do not permit third parties to collect personally identifiable information about your activity across different sites through the Service, because no third party receives anything from the Service at all.
6. Your California privacy rights
California Consumer Privacy Act, as amended by the CPRA. The CCPA applies to a for-profit business that collects California residents' personal information and meets at least one of three thresholds: annual gross revenue above $26,625,000 (the inflation-adjusted figure announced by the California Privacy Protection Agency, effective 1 January 2025); buying, selling or sharing the personal information of 100,000 or more consumers or households annually; or deriving 50% or more of annual revenue from selling or sharing personal information.
We believe we do not currently meet any of those thresholds. We nonetheless set out the following so you know where you stand:
- Categories of personal information collected in the preceding 12 months: internet or other electronic network activity information, limited to the server access logs described in Section 3. No other category is collected.
- Sources: your browser, when it requests a page.
- Purposes: delivering the site, security, and fault diagnosis.
- Categories of third parties it is shared with: our hosting provider (Netlify, Inc.) alone, which handles it as a service provider in order to deliver this site. No advertiser, data broker, analytics provider or ad network receives it, because we use none. Nothing is shared for any purpose other than delivering and securing the Service.
- We have never sold or shared personal information, as those terms are defined by the CCPA, and we do not do so now. We therefore publish no "Do Not Sell or Share My Personal Information" link, because there is nothing to opt out of.
- We do not collect sensitive personal information.
- We do not use personal information for automated decision-making or profiling.
You may exercise your rights to know, delete, correct, and to non-discrimination by writing to nvprompts@gmail.com. Because the only data that exists is a server log entry, a request will usually be answered by confirming what that log contains and, where we are able, deleting it.
"Shine the Light" (California Civil Code § 1798.83). We do not disclose personal information to third parties for those third parties' own direct marketing purposes. If that ever changes, this policy will be updated before it happens.
7. Your rights under the GDPR and UK GDPR
Whether the GDPR reaches a site in our position is a question we would rather not make you argue. Our answer is simpler: we will handle a request from anyone, anywhere, the same way — so the scope question does not have to be settled before you write to us.
If you are in the European Economic Area, the United Kingdom or Switzerland, that means requests for access to, rectification of, or erasure of your personal data; to object to or restrict processing carried out on the basis of legitimate interests; and to data portability where applicable.
Write to nvprompts@gmail.com to exercise any of these. You also have the right to lodge a complaint with your local supervisory authority.
Given that the only personal data we hold is a time-limited server log entry, we may be unable to locate a specific record without further information from you, such as an approximate time of access and the IP address in question.
International transfers: the Service is delivered by Netlify, Inc., whose content-delivery network is global, so the page you are reading was probably served from a machine near you. Netlify, Inc. states that its processing occurs outside the EEA, the UK and Switzerland, and relies on the EU–US Data Privacy Framework and its UK Extension, with Standard Contractual Clauses as a fallback. Nothing beyond the access logs described in Section 3 crosses any border, because nothing else is ever collected. Your app file, in particular, is not transferred anywhere at all — it never leaves the tab.
8. Children
The Service is a developer tool. It is not directed to children under 13, it is not designed to appeal to them, and we do not knowingly collect personal information from them.
If you believe a child has provided us with personal information, contact nvprompts@gmail.com and we will act promptly. In practice the Service provides no means for anyone, of any age, to submit personal information.
9. Security
The strongest security measure available to us is not holding your data in the first place, and that is the design of this Service.
For the site itself we serve every page over HTTPS and set a restrictive Content-Security-Policy that forbids network connections, framing, and third-party resource loading. No security measure is perfect, and we make no guarantee that the Service or its transmission is free from interception or unauthorised access.
10. Reviewing or changing your information
California Business & Professions Code § 22575(b)(2) requires us to describe the process by which you may review and request changes to any personally identifiable information we maintain.
We maintain none, other than the transient server log entries described in Section 3. To ask what those contain, or to ask us to delete them, write to nvprompts@gmail.com.
11. Changes to this policy
This policy is effective as of 23 October 2026. If we make a material change, we will revise the effective date at the top of this page and, where the change affects how we handle information, describe it here.
We encourage you to re-read this page before relying on it. Continued use of the Service after a change takes effect constitutes acceptance of the revised policy.
12. Contact
Eugene Antonov