Privacy Policy
Marvin Knapp-Tietz
c/o Impressumservice Dein-Impressum
Stettiner Strasse 41
35410 Hungen, Germany
Phone: +49 6183 8039368
Email: tech@cat-knows.com
Cat-Knows is a server-based web application. The user interface is served from our server (frellow.de) and runs in your browser. All Skool data we process for you (members, posts, comments, profiles, likes, chat messages, events, courses, and related analytics) is stored on our server in a MySQL database operated by our hosting provider in Germany (see Section 6).
Because Skool's API is protected by browser-level cross-origin restrictions, we additionally provide a small companion tool called the Fetcher. The Fetcher exists in two variants and you may use either one:
chrome.cookies API (scoped to skool.com
hosts only) and never injects scripts into any page.
In both variants the Fetcher calls the Skool API on your behalf and uploads
the raw responses to our server. The Fetcher itself (in either variant)
does not maintain a local database of your community data; the server
performs all extraction, storage and analysis. The Chrome extension
variant additionally stores a small amount of state in
chrome.storage.local: your catknows. session token, the
configured server URL, the last fetch state and a capped activity log
(max. 100 entries).
Cat-Knows is multi-tenant: each Skool community you operate corresponds to a
separate team on our server. Every record we store is tagged
with a team_id, and every API request is scoped to the team you
are currently using, so data from different communities is kept isolated.
The following sections describe in detail which categories of data are processed, where they are stored, and on what legal basis.
| Item | Details |
|---|---|
| Purpose | Verify your license and entitlements |
| Data transmitted | Skool username (slug), email address, list of your Skool communities |
| Frequency | At Fetcher start, then weekly |
| Can be disabled? | No – required for the software to operate |
| Legal basis | Art. 6(1)(b) GDPR (performance of contract) |
| Retention | Until account deletion |
License records (license key, customer email, customer name, activated devices with device ID and device name) are stored on our server as part of the license management system. License tokens issued to the Fetcher are digitally signed with Ed25519 so the Fetcher can verify their authenticity.
If you are a member of a Skool community whose owner uses Cat-Knows, a license may be automatically created for you during the owner's license check, provided you do not already have one. In this case, your Skool username and email address are stored.
Note: Since these users do not provide their data directly, they are informed about the processing in accordance with Art. 14 GDPR through this privacy policy. The legal basis is Art. 6(1)(f) GDPR (legitimate interest) – the interest being to provide community owners with a unified license management system.
| Item | Details |
|---|---|
| Purpose | Stability monitoring and error detection |
| Data transmitted | Fetcher version, operating system, fetcher status, error buffer (up to 50 entries), license slug, community slug, uptime |
| Not transmitted | No logs, no configuration, no credentials, no content |
| Frequency | 60 seconds after launch, then every 6 hours |
| Default | Disabled (opt-in) |
| Can be enabled? | Yes – during Fetcher first run or in the Fetcher's privacy settings |
| Legal basis | Art. 6(1)(a) GDPR (consent) |
Telemetry is disabled by default. When you first start the Fetcher, you are shown a data processing notice with an optional checkbox to enable anonymous usage data collection. The heartbeat is only activated if you explicitly consent. You can change this setting at any time in the Fetcher's privacy settings.
Right to object (Art. 21 GDPR): You have the right to withdraw your consent to the telemetry heartbeat at any time by disabling it in the Fetcher. Upon withdrawal, no further telemetry data will be transmitted.
| Item | Details |
|---|---|
| Purpose | Automatic error detection and resolution |
| Data transmitted | Error details, context, up to 200 lines of logs, system information |
| Frequency | At most once per 5 minutes when an error occurs |
| Default | Disabled (opt-in) |
| Can be disabled? | Yes – in the Fetcher's privacy settings |
| Legal basis | Art. 6(1)(a) GDPR (consent) |
| Item | Details |
|---|---|
| Purpose | Investigate and fix errors you report |
| Data transmitted | Your error description, up to 2 screenshots, up to 500 lines of log files, redacted configuration (credentials removed), system information, database statistics |
| Trigger | Only by your explicit action (button click) |
| Legal basis | Art. 6(1)(a) GDPR (consent through explicit action) |
In all error reports, sensitive configuration values (keys, passwords,
tokens, cookies) are automatically replaced with [REDACTED] before transmission.
AI features are accessed exclusively through our server, which acts as a proxy in front of the upstream AI provider (currently OpenAI). There are two paths that reach the same proxy:
ai_request_log.ai_usage_log.| Item | Details |
|---|---|
| Purpose | AI-powered analysis and chat features |
| Data transmitted | Your chat messages (full conversation), selected AI model |
| Logged on server | User/team or license ID, provider, model, token counts, duration, status |
| Forwarded to | OpenAI |
| Legal basis | Art. 6(1)(b) GDPR (performance of contract) |
Chat content is not persisted by the AI proxy itself — only the metadata above is logged for quota management and abuse prevention.
However, the web app additionally offers a feature to save AI chat sessions
for your later use. If you explicitly start a saved chat session in the web
app, your messages and the AI responses are stored on our server in the
ai_chat_session and ai_chat_message tables, scoped
to your team. You can delete saved sessions from the web app at any time.
If you do not use the saved-session feature, no message content is retained.
| Item | Details |
|---|---|
| Purpose | Automatic categorization of communities |
| Data transmitted | Community name, slug, and description (max. 500 characters) for up to 50 communities |
| Forwarded to | OpenAI for classification |
| Frequency | Automatically every 7 days or manually |
| Legal basis | Art. 6(1)(f) GDPR (legitimate interest) |
Classification results are cached globally on our server so that the same community does not need to be re-classified for every customer.
| Provider | Purpose | Data | Location | DPA |
|---|---|---|---|---|
| OpenAI, Inc. | AI chat, community labels | Chat messages, community descriptions | USA | OpenAI DPA |
| ALL-INKL.COM – Neue Medien Münnich Hauptstraße 68, 02742 Friedersdorf, Germany |
Server hosting (frellow.de) | All server-side processed data | Germany | DPA per ALL-INKL contract terms |
When communicating with our server, your IP address is transmitted for technical reasons. We anonymize your IP address before storing it:
The anonymized IP is used for rate limiting (max. 2 hours) and in audit logs.
| Data | Retention period |
|---|---|
| Telemetry heartbeats | Automatically deleted after 7 days |
| Bug reports & error reports | Automatically deleted after 90 days |
| Audit log PII (IP, email) | Automatically pseudonymized after 90 days |
| AI usage statistics | Automatically deleted after 12 months |
| Inactive device activations | Automatically deleted after 180 days |
| Deactivated licenses | Automatically anonymized after 180 days of inactivity |
| Rate limiting data | Automatically deleted after 2 hours |
| Active license data (email, slug) | Until account deletion or deactivation |
Automatic data retention is enforced by a scheduled cleanup process on our server. You can also request immediate deletion of all your data at any time via the self-service deletion page.
This section gives an overview of which data is stored on our server versus on your own computer.
All of the above is multi-tenant and isolated by team_id; only
members of a team can access that team's data through the API.
As the community owner you can invite team members (e.g. a community
manager) to Cat-Knows under your account. Invited team members get
access to the visualised product — the connectivity
graph and the member / post / edge cards that are part of it — for
the team they have been added to. They cannot create or delete teams,
cannot delete community data, and cannot download data unless you have
explicitly granted them the download permission in the Team tab of the
settings modal (per-seat download_access flag, off by default).
Within the visualised product, invited team members can see the same member information that you, the owner, can see — including the membership-survey answer that Skool stores on each member's profile. In many Skool communities this survey answer is the member's email address (because the question is used as a join gate, e.g. “Enter your email to join”). This means an invited team member can read the email addresses of the other community members the Fetcher has collected for that community.
Information under Art. 14 GDPR: if you are a community member whose profile has been fetched by an owner who uses Cat-Knows and that owner has invited additional team members, your survey-stored email address may be visible to those invited team members through the Cat-Knows interface. The legal basis is the community owner's legitimate interest in running and analysing their own community (Art. 6(1)(f) GDPR). You can object to this processing or request deletion via the self-service deletion page or by contacting the community owner directly.
DM payloads (chat messages, direct messages), the raw Skool API responses
stored in fetch.raw_data, and the team-scoped SQL backup are
strictly owner-only and are not made visible to invited
team members even when the download permission has been granted.
chrome.cookies permission,
scoped exclusively to the skool.com hosts declared in
the extension manifest (www.skool.com and
api2.skool.com). The extension forwards the relevant
cookies to our server so the server can perform the corresponding
Skool API calls. The extension does not persist or duplicate the
cookie jar.
chrome.storage.local: your catknows. session token, the
configured server URL, the last Skool build ID, the last run ID, the
last tick timestamp, and an activity log capped at 100 entries.
No Skool member or community data is stored locally by the extension.The connection to Skool.com is made on your behalf through the Fetcher and, where applicable, through our server using the cookies the Fetcher uploads. Our server only sees your Skool cookies for as long as it needs them to perform the requested fetch task; cookies are not displayed in any user interface and are protected against unauthorised access by the same controls that protect the rest of your data.
You have the following rights regarding your personal data:
You can delete your data yourself at: Request data deletion. After email confirmation, the following will be deleted:
team_id).
Audit logs and diagnostic logs (audit_log, debug_log, skool_raw_log)
are pseudonymized — your IP, user ID and personal identifiers are removed —
but the rows are retained on the basis of legitimate interest (Art. 6(1)(f) GDPR) for security
auditing and debugging within the retention periods listed in Section 8.
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority for us is:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI)
Postfach 3163, 65021 Wiesbaden, Germany
Phone: +49 611 1408-0
Website: datenschutz.hessen.de
For all privacy-related inquiries, you can also contact us directly at tech@cat-knows.com.
When you use the AI chat features, data is transferred to OpenAI, Inc. in the United States.
OpenAI is certified under the EU-US Data Privacy Framework (DPF), which ensures an adequate level of data protection as recognized by the European Commission (adequacy decision of 10 July 2023). In addition, OpenAI’s Data Processing Addendum includes EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) as a fallback mechanism.
We implement the following technical and organizational measures:
team_id, and every API request is scoped to the requesting user's team membershipWe reserve the right to update this privacy policy to reflect changes in the law or changes to the software. The current version is always available on this page.
Last updated: 27 June 2026 (v2.2)
v2.2 adds an explicit description of the Chrome extension variant of
the Fetcher in Sections 2 and 9 (cookie reading via
chrome.cookies scoped to skool.com; state
stored in chrome.storage.local; no script injection),
in preparation for the Chrome Web Store submission of the
catknows. Fetcher extension.
v2.1 added the Section 9 disclosure that invited team members can see community members' membership-survey answers (in many cases: email addresses) — Art. 14 GDPR information for affected community members.