Privacy policy

The short version

• Accounts: we keep your email address, your sign-in sessions, your Katman keys (as hashes), your course progress, the projects you choose to sync, what you bought, which files you downloaded, and your billing status. If you buy a PDF without an account, we create one from the email address you give at checkout. You sign in with a link we email you or with Google; with Google we receive only your email address and Google’s confirmation that it verified it.
• Payments: Stripe processes them. We never see or store your full card number.
• Statistics: first-party only, under the UK statistical-purposes exception for cookies, with a one-click switch in every page’s footer. Browsing statistics are never joined to your account, and raw events are deleted after 90 days. No third-party analytics, no advertising pixels.
• The Katman MCP runs on your computer. It talks to katman.pro only to check your Katman key, to report the domain of each audit and when you call katman_sync, and it never sends code, file contents, answers or prompts.
• Visibility runs go from your computer straight to OpenRouter with your own key.
• We don’t sell personal data and don’t use it for advertising.

Who we are

Rnify Limited, a company registered in England and Wales, is the controller for personal data collected through katman.pro and Katman accounts.

• Company number: 16749515
• Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
• Registered with the UK Information Commissioner’s Office (ICO) as a data controller
• Contact: hello@katman.pro

What we collect and why

If we need information to establish, exercise or defend a legal claim, we keep it for as long as that takes. We don’t use your data for automated decisions that have legal or similarly significant effects on you.

Website statistics

katman.pro counts its own visits instead of using a third-party analytics service. The statistics are used only to improve katman.pro, never for advertising, and browsing statistics are never joined to an account. We rely on the statistical-purposes exception in the UK’s cookie rules (PECR), as amended by the Data (Use and Access) Act 2025. It allows first-party statistics cookies when you get clear information and a simple way to object, and you can opt out in one click.

• What a page sends: the event (a page view; scrolling, a second page or 30 seconds on the page; a button click; a checker run; a waitlist sign-up; leaving the page), the page path without the query string and a random visit id. With the first page of a visit, it also sends the referring site’s origin (never its path) and UTM tags. Each event carries only a few fixed properties, such as which button you clicked or how far you scrolled. When you ask for a sign-in link, the request carries the same visit id, so the sign-up start counts in that visit.
• What we store: the time, the event, the page path, the channel of the visit and of your first visit, the referring site’s host name, your landing page, those fixed properties and the random ids. The leave event (scroll depth and time on the page) is used only to tell people from bots and isn’t stored. Visits that look automated are kept but flagged, so reports can show people only.
• Identifiers: a random id in the katman_aid cookie and a random visit id kept in this tab’s session storage. Neither contains your name, email or IP address.
• Not stored: your IP address (a daily-salted hash of it is used in memory for rate limiting only), your user agent, screen size, language, country, the full referring address, query strings, or email addresses.
• Never joined to your account: browsing statistics stay anonymous even after you sign up. Only in-app events (listed above) carry your account id, never together with a visit or visitor id. When you sign up, the first-touch values from katman_ft (channel, referring host, landing page, UTM tags) are copied onto your account; your browsing history before sign-up isn’t.
• Retention: raw events are deleted after 90 days. A nightly roll-up keeps daily counts only.
• Bots are counted per day, bot and page on the server, without cookies or any identifier.
• Opting out: one click on the switch in the footer or on the cookie policy page sets katman_optout, deletes katman_aid and katman_ft, and from then on the page sends nothing and our server drops anything that still arrives. We don’t read Do Not Track or Global Privacy Control signals; the switch is how you object.

The Katman MCP

The MCP server (katman-mcp) is a program that runs on your own computer, inside your AI coding tool. It isn’t a website.

• Your project stays local. It reads files in your project folder, never opens .env files, keys or credentials, and writes its results to the .katman/ folder in your project.
• Contact with katman.pro happens in three cases only:
  1. Licence check. When KATMAN_KEY is set, Katman sends your key and the MCP version to katman.pro at most once a day, and nothing else: no tool names, no project data. It keeps the answer in ~/.katman/license.json under a hash of the key (never the key itself), and if katman.pro can’t be reached, the tools keep working for 7 days after the last successful check, as long as your Katman Pro is still running.
  2. Audit count. For Katman Pro, the MCP reports each audit’s domain to katman.pro, so audits and sites can be counted per month. Nothing else from the audit is sent.
  3. katman_sync, only when you call it with dry_run: false. The dry run shows the exact payload first: aggregates such as gate pass counts, visibility rates, plan progress, top issue titles and dates. Never code, file contents, answers or prompts.
• Without KATMAN_KEY, Katman never contacts katman.pro. Code, file contents, AI answers and your OpenRouter key never leave your machine for katman.pro.
• Other network requests happen only when you call a tool that needs one: your own site (audits), openrouter.ai with your key (visibility runs), api.indexnow.org (only when you submit URLs) and suggestqueries.google.com (keyword research). Those services’ own terms and privacy policies apply; OpenRouter passes your questions to the model providers you choose.
• Your OpenRouter key is read from an environment variable on your computer and is never written to disk, printed or sent to us.

The full list is on Permissions.

Deleting your account

Settings → Delete account. It asks you to cancel a renewing subscription first, because deleting an account doesn’t stop Stripe. Then, straight away:

• your keys are revoked, so the Pro tools stop working;
• your synced projects, course progress, sessions and sign-in links are deleted;
• your email address is replaced with a placeholder, email is switched off, and the first-touch details (referring host, landing page, UTM tags) are removed from your account.

Anything else tied to your account is deleted or anonymised within 30 days.

What stays: billing records we must keep for accounting (see the table above), and in-app events tied to your old account id until the 90-day deletion of raw events. Anonymous browsing statistics aren’t linked to your account, so there is nothing to delete there.

Who processes data for us

The private community runs on Skool. Joining it happens on Skool’s site, under Skool’s own terms and privacy policy; we don’t send Skool your data.

International transfers

Cloudflare, Stripe, Resend and Google may process personal data outside the UK, for example in the United States. Where they do, the transfer is covered by the UK International Data Transfer Addendum or the UK–US data bridge, whichever applies.

Your rights

Under UK data protection law you can ask us to:

• give you a copy of your personal data;
• correct it;
• delete it (you can also delete your account yourself in Settings);
• restrict or object to how we use it, including the website statistics (one click on the cookie policy);
• send it to you or another organisation in a portable format.

You can withdraw consent at any time, and unsubscribe from any email with its one-click link. Email hello@katman.pro to use your rights; we answer within one month. If you’re unhappy with our answer, you can complain to the Information Commissioner’s Office (ico.org.uk).

Children

Katman accounts and Katman Pro are for people aged 16 or over. We don’t knowingly collect personal data from anyone under 16; if you think a child has given us personal data, email us and we’ll delete it.

Changes

When this policy changes, we update the date at the top of the page, and we announce material changes by email to account holders.

The terms for using the site, accounts and Katman Pro are on Terms of use; cookies are covered in the cookie policy.