Privacy
In force from 21 September 2026. This is the first version.
CatalogBay holds photographs and descriptions of the inside of your home or workshop. That is personal to you, and this page says plainly what is collected, where it is kept, who else touches it, and how to get it back or have it removed.
Who is responsible
The controller of your personal data is Wojciech Zurek, who operates CatalogBay as an individual. For anything on this page — a question, a copy of your data, a deletion, or a complaint — write to privacy@catalogbay.com.
What is collected, and why
If you join the waitlist
Your email address, the exact consent sentence shown to you when you typed it, and the date. Nothing else — not your IP address and not your browser. It is used once, to tell you when CatalogBay opens, and for nothing else. Ask and it is deleted.
If you have an account
Sign-in is handled by Auth0, which holds your credentials. CatalogBay receives your verified email address, an identifier for your account, and — if you provide one — your name. CatalogBay never sees your password. Mail that sign-in has to send you — confirming your address, or resetting your password — is delivered by Resend, which therefore handles your email address for as long as it takes to deliver the message. No marketing mail is sent, and there is nothing to unsubscribe from.
What you put in your catalog
Whatever you record: containers, items, quantities, notes, descriptions, suppliers, labels and projects. This is content you create, and the service holds it so it can give it back to you.
Photographs and other evidence
Photographs you take, and text you dictate or type as evidence. Photographs are stored as files separately from the database. Bear in mind that a photograph of a drawer may show more than the drawer — this is worth knowing before photographing a room.
A record of changes
CatalogBay keeps an append-only log of every change: what changed, when, and which account made it. That log is how the phone and the desk stay in step, and how you can undo something. It means edits are not silently overwritten — the history is part of your catalog, and it is deleted when your catalog is.
Server logs
Ordinary web-server logs, kept by Google Cloud: the time, the path, the response, the timing, the user agent and a network address. Two honest details about that address, both measured rather than assumed. For a request from a browser to this website or the web app, the address recorded is Google's own front-end server, not yours, because the request is relayed. For a request straight to the API — the iPhone app, or a program using a token — the address recorded is the caller's. Logs are kept for a short period for operating and debugging the service, and are not used to build a profile of you.
Visits to this website
catalogbay.com counts visits with Cloudflare Web Analytics, which sets no cookie,
stores no identifier on your device, and does not follow you to other websites. It reports
totals — pages, referrers, countries — and not people. It runs on this website only.
What is deliberately not done
- No advertising, and nothing is sold or shared for marketing.
- No tracking cookies, here or in the web app. The web app keeps your sign-in token in your browser's session storage so you are not asked to sign in on every page; it is cleared when you close the tab.
- No catalog content is sent to any AI provider. CatalogBay can describe an unknown part using an AI model, but that is switched off in the live service and no photograph, note or description leaves for that purpose. If it is ever turned on it will be a choice you make, this page will say so first, and the provider will be named.
- Nobody reads your catalog to improve the product. The operator can reach the database in order to run and repair the service, and does not browse it otherwise.
Where it is kept, and who processes it
CatalogBay is a small service and uses a few well-known providers rather than running its own machines. Each is a processor acting on instructions:
| Who | What they hold | Where |
|---|---|---|
| Google Cloud | The service, the catalog database, and this website | United States (Oregon) |
| Cloudflare | Photographs and evidence files; visit counts for this website | Distributed; see Cloudflare's terms |
| Auth0 (Okta) | Sign-in, and your credentials | United States |
| Resend | Delivering sign-in mail — confirmation and password reset | United States; see Resend's terms |
Your data is therefore processed in the United States. If you are in the United Kingdom or the European Economic Area, that is a transfer outside it, made under the standard contractual clauses each of those providers offers. If this matters to you, it is a fair reason not to use the service, and the decision is yours to make with the facts.
How long it is kept
- Your catalog — for as long as you have an account, and until you ask for it to be deleted.
- Waitlist addresses — until CatalogBay opens and you have been told, or until you ask for removal, whichever comes first.
- Backups — the database is backed up daily and can be restored to any point in the previous seven days. So for up to seven days after a deletion, your data still exists in a backup, and then it does not. This is stated because it is true of every service that keeps backups and is rarely admitted.
Your rights
If the UK GDPR or the EU GDPR applies to you, you have the right to see your data, to correct it, to have it deleted, to receive a copy in a portable form, to object to processing, and to complain to your data-protection authority. You can exercise any of them by writing to privacy@catalogbay.com.
One thing to be straight about: CatalogBay does not yet have a button for exporting your catalog or deleting your account. Both are being built. Until they exist, ask by email and it is done by hand — a copy of your data, or its deletion, within 30 days and usually much sooner. Saying you can do it yourself today would not be true.
What is stored on your own devices
The iPhone app keeps a full copy of your catalog on your phone, so it works with no signal. That copy lives in the app and goes when you delete the app. The web app keeps your sign-in token in session storage, as above. Neither is readable by other websites.
Security
Traffic is encrypted in transit. Each account's rows are separated in the database by the database itself, not only by the application. Photographs are reached through short-lived signed links rather than being public. No service can promise it cannot be breached; if one happens and it affects you, you will be told, and the supervisory authority within 72 hours where that is required.
Children
CatalogBay is not intended for children, and accounts are not knowingly created for them.
Changes
If this page changes in a way that affects you, the new version will say when it came into force, and — if the change is significant and you have an account — you will be told directly rather than left to notice.