This is a working draft, and no lawyer has read it.

01

What this is, and what it isn't #

Nothing described here has happened to anybody, because there is nobody yet.

Lapka is not on the App Store. Nothing has been sold, nobody has been charged, and the only account on any of it belongs to the person building it. What follows is a plain description of what the code does today and what it is built to do, written by that person. Read it as a description, not as a notice in force.

One thing changed on 12 August and it changes several paragraphs below: there is now a server, and it is switched on. Until that day the app had nowhere to send anything and this page said so in four places. It is a machine rented for testing, holding one developer's test cats — but it is running, so the sentences about it are written in the present tense now.

02

This website #

Reading this page collects nothing that we ever see.

There is no JavaScript on the front page, on this notice or on the terms, no cookies, no analytics and no trackers. Nothing is stored in your browser. The typeface is a file in the same folder as the page, so loading it sends no request to anybody else. You can check all of that by viewing the source of any of the three — between them they are three HTML files, one stylesheet, four font files and four screenshots of the app, and every one of those is in the same folder as the page it is on. It said six until 5 September, when the last two pictures of screens that no longer exist came off the front page and out of the folder with it.

03

What the app keeps on your phone #

This is where everything about your cat lives, and — until you have an account — the only place.

One SQLite database, lapka.db. It holds the cat, the intake, the deeper questions we wrote for you and your answers to them, the programme, every session report, a small table recording when an urgent-sign check fired, a record of any time you went back a step, and some bookkeeping. The deeper questions used to be inside the word "bookkeeping" on this line, which they are not.

Two tables were added on 13 August, and they are the reason this page was revised. event is a list of things that happened in the app — a name from a fixed list, the time, your day and your time zone, a counter, and a few numbers. It starts filling from the first time you open the app and it sits here, unsent, until there is an account; §4 is where it goes after that. ask is whatever you typed into the box in the app — the thing you want built, or the thing that is broken — kept here in your words so that "see what you've sent" can show it back to you.

There is also a random identifier for this installation, made the first time the app opens and stored with the bookkeeping. It is not your device's identifier, it is not the advertising one, iOS does not know about it and nothing outside our own server matches it. It exists so that a list of screens recorded before you had an account can be joined to the account when you make one — which is the honest reason, and §4 says what that means.

That event list is the only thing in the app that prunes itself. Rows that have been sent are deleted after 30 days, and if it somehow passes 5,000 rows the oldest go first — and the number thrown away is counted and sent along, so a gap in it is something we can see rather than something we quietly report as a fact.

Five preferences are stored separately, and only five: whether you have seen the intro, which colour palette you picked, light or dark, your language, and — if you set a photo of your cat — whether it has reached the server yet.

Your cat's photo is a file in that same documents folder, under one fixed name, and this device's copy is the one the app draws from. That is why the picture appears the moment you choose it, with no signal and before anything has been sent anywhere.

If you sign in, your session token is kept in the device keychain by our authentication provider's own library — not by us, and not in the database above.

Voice notes are audio files in the app's own documents folder, referenced by filename. Once a note has been turned into text, that text is stored in the database above alongside everything else — so on your phone a recording generally exists twice, once as sound and once as words.

And the part nobody likes saying: delete the app and all of that goes with it. iCloud's device backup restores when you restore a device, not when you delete and reinstall, and we are not going to claim otherwise. The documents folder is included in that backup, which is also true of any voice note sitting in it.

04

What leaves your phone, and when #

One thing goes before you have an account. Everything else waits.

This line read "nothing goes anywhere until you have an account" until 5 September, and it had been wrong since 23 August. The app still has exactly one place it can make a network request, and that code still answers "signed out" without sending anything while there is no session token — for every call but one. A voice note recorded on the paragraph screen is uploaded to be turned into text while you are still answering questions, because signing up happens after every question in the intake and the words were otherwise arriving after both of the screens meant to show them back to you. §7 is entirely about that one round trip.

So a person who types about their cat, their home and their family and then closes the app has told a server nothing at all. A person who said it out loud has sent us the recording, and we have written down what was in it.

Seven background jobs run — five until 13 August — and between them they are almost everything the app sends anywhere. Six of them wait for an account; the third does not, and it is the one above:

• one pushes your intake — the answers and the paragraph;
• one pushes your session reports;
• one uploads a voice note to be turned into text — the one that does not wait for an account, and the subject of §7;
• one uploads a photo of your cat, if you set one — the only picture the app ever sends, and only ever the one you chose for their profile;
• one asks the server to write your programme, and sends nothing of yours to do it — the server already has the intake and works from its own copy;
• one sends the things you have asked us for, in your words;
• one sends the list of which screens you reached and when — the intro, question four, the summary — with nothing in it about your cat, and it waits for an account like the other five.

They run when the app is in the foreground and give up quietly when there is no signal. The account comes after the questions, so while you are still answering, six of the seven have nothing they are allowed to do. This paragraph said all seven until 5 September, and it had been six-of-seven since 23 August — the same day, and the same mistake, as the headline at the top of this section.

One thing leaves outside all seven, and it is new. On the screen that waits while your plan is written there is a tell me when it's ready, and pressing it asks your phone for a notification address and sends that address to us on the spot — because a promise to wake you has to survive you closing the app. It is the only send here that is not one of the seven, it happens only when you press, and the system's permission prompt is asked at that tap and never before. §6 says what becomes of the address afterwards, and the answer is not tidy.

The last of the seven bullets is new, and it needs more than a bullet. The list of screens starts being written the first time you open the app, long before there is anywhere to send it, and it waits on your phone. When you make an account the whole backlog goes up at once — with the times it actually happened, not the time it was sent, because a record that says you did the whole intake in one second is worse than no record.

And the part we would rather write down than have you assume: these are not anonymous. The moment you make an account, the installation identifier from §3 is attached to it, and everything on that list — including the part recorded before the account existed — is your account's history from then on. We can look at one person's and see the order they did things in. What we cannot see is anybody who left before signing up, because nothing of theirs ever left their phone; so our own numbers about the intake are a floor rather than a total, and that is a cost we chose on purpose.

What that list says is which screen and when. It does not say what you answered on it. Your answers are in your intake, which is the first bullet and §6, where they always were.

One kind of screen is missing from that list on purpose: the urgent-sign checks. Until 15 August the list recorded that you had reached one, without saying which sign — and that is the same inference with the detail filed off, because the only way to reach one is for something about your cat to have opened it. So no screen of that kind is recorded here at all. What is recorded is the row in §6 that names the sign outright, where you can see it and we are not pretending it is a navigation record.

Until 12 August there was nowhere for any of them to send it. Now there is: a rented virtual machine in Finland, from Hetzner, a German company — reachable over HTTPS and nowhere else. It is not "production" in any sense that matters to you yet; it exists so that the person building this can run the app against a real server and a real database instead of a laptop, and the only cats on it are his test ones. When there is a real release, the answer to where may well be a different machine, and this paragraph is the one that changes.

05

Your account #

Accounts are handled by Clerk, on a development instance.

Email address and password today. Google and Apple sign-in buttons appear on the sign-in screen, and this page used to say neither had been run against this instance. Google has, and it goes further than we said. Since 23 August the instance has been measured rather than guessed at: both providers are switched on, and pressing the Google button really does open Google's consent screen and really does hand an authorised session back. It then stops, because this instance requires a username and a password and Google supplies neither, so no account is made. What that means for you is worth saying plainly: Google learns you tried to sign in to Lapka, even though the sign-in fails. Apple's button has not been walked through the same way. Both are bugs rather than policy, and both are written down as bugs.

06

What the server stores #

This describes the database the code writes to. The only cats in it are the builder's test ones.

You. An internal id, your Clerk id, your language and your time zone.

Your cat. An id, a name, and — only if you chose one — when you last set their photo. One cat at a time, which is not the same as one ever, and this line used to say "one cat per account" and let you assume it was.

If you reinstall the app and there is already a cat here, it asks whether to keep them or to start fresh. Starting fresh retires the old cat rather than deleting them. Their row, their intake and the paragraph in it, any transcript, their programme, every report you filed and their photo file all stay on the disk in Finland, out of the app's reach and out of yours. Nothing prunes them and no button in the app reaches them; §10 is the only thing that takes them, and it takes every cat you have ever had rather than the current one.

Their photo, if you set one. It is optional and the app works exactly the same without it; skip it and you get the drawn cat, which is what most people will keep. If you do set one, your phone crops it to a square and shrinks it to 512 pixels before anything is sent, and what arrives is stored as a single file on the same machine as everything else in this section, named after your cat's id. It is served over HTTPS to your phone and nothing else reads it — no analysis, no breed guessing, no training, nothing. Remove it in the app and both the file and the record of it go.

One thing to say plainly, because it is the honest limit: the address of that file is not secret. It is an unguessable id, not a password, so anybody who somehow had the exact link could open the picture. Nothing publishes the link, but that is the shape of it, and it is the reason the app asks for a photo of a cat and not of anything else.

Your intake. Your paragraph, verbatim — the column carries a comment beside it saying nothing reads it, nothing summarises it and nothing extracts from it. Then every answer you gave, any corrections you made, your language, your time zone, and how far through you got.

About a voice note it stores the length in seconds, the state, and the language. It also stores the transcript, and that is the content of the recording in text rather than metadata about it — every word you said, if you said it instead of typing it. The audio itself never reaches the server's disk at all, and the schema says so on the line. Where the recording does still sit is your phone, which is §3.

Then your subscription state, the generated question set and your answers to it, the programme, every session report, the weekly check-ins, and a ledger of what generating something cost.

And since 4 September, a way to wake your phone. Tap tell me when it's ready while a plan is being written and the row that tracks that one generation also keeps the address your phone minted for notifications, and which language to write to you in. It is not your device's identifier and it is not the advertising one — it is a string Expo will deliver to. It is meant to belong to that one plan, and nothing removes it afterwards. The note beside the column says it clears itself; it does not, and we would rather print that than let you assume a machine is tidying up. So a notification address sits on that row for as long as the row does, which is a retention question with no answer, and it belongs beside the two in §11.

That cost ledger stores a digest of the input and never the prompt — deliberately, so that a paragraph about your home isn't sitting a second time in a table nobody thinks of as personal data. The column is literally commented "a DIGEST, never the prompt".

Four tables were added on 13 August, and the rest of this section is about them.

install. One row for each installation of the app: the random identifier from §3, when that phone first opened it, which account claimed it and when, the app's version and update, whether it is iOS or Android, your language, your time zone, and how many rows the 5,000-row cap threw away.

event. One row per thing that happened. It holds a name from a fixed list written in our source — the intro card was seen, the summary was reached, the paywall was shown, a session was opened and left — the time from your phone's clock, the time it arrived here, your day and time zone, a counter that puts them in order, sometimes your cat's id, and a small bag of numbers and fixed words.

The bag is where to look hardest, so here is all of it. Not a summary of it and not the interesting parts — every single thing an event of any kind is able to carry, in the order the app meets them. This list used to name six of them and say "all", which is worse than saying nothing; it is now checked against our own source by a test that fails the day something is added to one and not the other.

• which of the intro cards you were looking at;
• which screen of the intake you reached, out of five — four of which you can still reach, since the fifth was deleted on 23 August and no new row can carry it — and never an urgent-sign check, which is §4;
• whether you were already signed in when we offered you an account;
• which of the three sign-in buttons you pressed — and again if it worked, and again if it did not;
• and when it did not, which of five reasons;
• which of four places the plans were opened from;
• whether a free trial was on offer that time;
• which of the two subscription plans — starting, finishing, and failing;
• whether a purchase failed and which of six reasons;
• whether restoring a purchase found one;
• how many milliseconds writing your programme took;
• and whether that was longer than the screen is built to keep you waiting;
• or, when it failed instead, which of six reasons;
• which step of a session you opened, and which one you were on if you left it;
• and how many seconds you had been there;
• whether a photo came from the camera or the library;
• whether the box was opened, and then sent, for an idea or for something broken;
• and how many characters you typed into it, never what they were.

Four things an event can carry are missing from that list, and they are the four that say something about your cat. They are two paragraphs down, under a heading that says so, rather than folded in here where they would read as bookkeeping.

What an event never holds, and this is the part worth checking us on: your paragraph, a word of it, or its length beyond a character count. A transcript. A photo, a filename or a link to one. Your cat's name — a row can carry your cat's id, which is a random number, and never their name. Your email address. Any answer you gave in the intake. There is no free-text field in that vocabulary at all: the list of what a value may be has three entries, and "some text" is not one of them, so an event carrying a sentence is not something we decided against — it is something the code cannot express. On top of that the database refuses any row whose bag of numbers is over a kilobyte, on the grounds that a bag that size is a paragraph that got in somehow.

Some events do say something about your cat's health, and we are not going to bury them. When the app shows you one of the urgent-sign checks — breathing, back legs, not eating — and again if your answer stops the app, and again if you go back and say it was a false alarm, a row records which sign. The first of those also records which of two kinds of thing opened it: something you ticked, or a word in your paragraph, and only one of those has ever been possible. Never the word, and never the sentence it was in — one of two fixed labels, and that is the whole of it. The ticked door belonged to the urinary check, which came out of the app on 12 August, the day before any of this started being recorded, so every check that has opened, opened on an English word in something you typed — which is what the terms page has said all along and this line did not. The second door is still in the vocabulary and still named here, because a shape we could fill and do not is worth printing. It is there because the only way to know whether those checks are firing at people whose cats are fine is to count how often they fire, and a check that frightens the wrong person is the worst thing this app can do. It reaches the server the way everything else does — after you have an account, attached to it.

ask. What you typed into the box in the app, kept verbatim, the way your intake paragraph is. Whether it was an idea or something broken, your language, your cat's id, and — for something broken, and only that — a fixed set of context the app tells you about on screen before you send. That set, in full: the app's version, its update and the build under it, which phone and which version of its system, your time zone, the screen you were on, and where your cat had got to on their programme — which plan, where it came from, how far up it, which time round, and how many days you have filed — and whether you are subscribed. Fourteen fields, and the sheet in the app names all fourteen in this order, which is the point of printing them twice. Never your paragraph, never a transcript, never your cat's name, never the photo, never a line of the plan itself. Take one back in the app and both the words and that context are cleared from here; §10 says what is left of the row and why anything is.

It is read by one person and by nothing else. It is not sent to a model — not to write your plan, not to summarise it, not for anything — which is the same rule the intake paragraph has and the same reason. There is no ticketing system behind it, no queue with a number, and nobody replies to it; the app says so before you press send rather than after. Alongside it we keep a status and a private note, both for his own tracking, and there is no way for either to reach you — a status you could see would be a promise about an answer, and there isn't one.

admin_action. A log of the two things that can be done to an account by hand: putting a free month on it, and deleting it. It records who did it, when, the reason they typed, and what was counted going out. The 180-day sweep below lands in it too, so that a retention rule kept by hand leaves a mark saying when a hand was last put to it. §10 is where the rest of this matters, because it is the one row that outlives a deletion.

07

Voice notes #

The recording is never kept on a server. What is kept is the text.

This is the paragraph that changed most on 12 August. Three days ago this section opened "the app never uploads one" and described an endpoint with nothing calling it. It has a caller now, and the key behind it is set, so voice notes are uploaded and turned into text for real. If you read this page before, read this section again.

What happens: the audio is uploaded to one endpoint, held in memory, handed to the transcription service, and dropped. It is never written to disk on our side, there is no bucket, and there is no deletion job because nothing is left to delete. The limits are 6 MB, m4a only, five uploads a minute and twenty an hour. If it fails, the error we log carries neither the audio nor the provider's message, because the only thing either could contain is a fragment of somebody's recording.

The text that comes back is stored — on the phone, and on the server with the rest of your intake. It is the content of what you said rather than a note about it: every word, if you spoke instead of typing. That is the honest trade, and it is why this has a section rather than a clause.

Transcription is the one thing that happens before the paywall, and it is allowed precisely because it interprets nothing: speech into text, no fields, no verdict. Nothing summarises it, nothing pulls answers out of it, and it travels into whatever writes your plan exactly as a typed paragraph would.

It does not need an account either, and until 5 September this page said it did. That was true when it was written: the reason given was that an endpoint forwarding audio to a metered service without an account is an open wallet, and it is still a good reason. It was overruled on 23 August by a worse problem — signing up is the last step of the intake, so with an account required the words came back only after the owner had walked past both screens meant to show them. It is now the one route on our server that carries anything of yours and answers without a token — four others answer without one, and they are two health checks and the two Apple and Google use to tell us a subscription changed, none of which has ever held a word you wrote. The wallet is held shut by rate limits instead: six megabytes, five uploads a minute, twenty an hour, counted per account where there is one and per address where there is not. §4 is the section that headline belongs to, and it says the same thing there.

08

Who else would see any of it #

Eight companies, and the eighth arrived on 4 September without this page noticing. Read it as the important one.

Clerk — your account: your email address, and your way back in. Live, on a development instance.

Hetzner — the machine the server and its database run on, in Finland. They hold the disk rather than read it, which is what a landlord is, but everything in §6 is physically on their hardware and that belongs on this list.

Vercel — these three pages, and since 13 August the sign-in and the panel behind it, which nobody but the builder loads. They see that a page was requested; they see nothing from the app. §2.

Expo — the push service that wakes your phone when a plan is finished. It went live on 4 September and this list still said seven the next morning, which is the failure this section exists to prevent — caught after a day this time, and only because somebody sat down and read the code against the page. What we hand them is the address your phone minted, the two sentences that appear on the notification, and where tapping it should land. One of those sentences has your cat's name in it — "Mochi's plan is ready". Expo passes the message on to Apple's own push service, the way every notification on an iPhone travels, and nothing about the plan, the intake or your paragraph goes with it.

The paragraph above called that the only place a cat's name leaves our own machines, and it was wrong within the hour it was written. It is the second. Their name has gone to whichever model writes the plan since 12 August, in a line of the prompt that reads "The cat is called Mochi.", and neither this section nor §6 had ever said so — on a page that twice goes out of its way to say an event never holds their name. There is a third, and it is yours rather than ours: say their name in a voice note and it is in the audio that reaches Groq. The model entry two below now names the first of those, and this is where the third is written down.

Groq (whisper-large-v3-turbo) — a voice note, to turn it into text. Live. This is the one thing that happens before the paywall, and §7 is about it.

Anthropic (Claude Opus 5) or OpenAI (gpt-5.6-luna) — your intake and your cat's name, to write the deeper questions, the programme and the check-ins. The name is not incidental: the prompt opens "The cat is called Mochi." so that the plan can be written to them rather than to a cat in general, and it has done since 12 August. Only after subscribing. No model sees anything before that, apart from the transcription above.

Google — the support mailbox, lapka.admin@gmail.com. Anything you send us, they hold. It is the easiest name to leave off a list like this, because nobody thinks of an inbox as a processor — and §9 already tells you they hold it, which is precisely why it belongs in the count as well as in the prose.

They are two names for one seam, and which of them your words would reach is a setting rather than a redesign — so both are named here, because a notice that listed only the one switched on this morning would be out of date by a configuration change nobody announced. What they receive is the same either way: your cat's name, what you wrote, what you answered, and what you reported back.

The model keys are set now. Three days ago this section said they were not, and that the app ran local stand-ins in their place. That is no longer true: real programmes have been written by a real model, for the builder's test cats. A stand-in is still what runs when a key is absent, and everything one produces is stamped as a mock in the payload — but it is the exception now rather than the rule.

Nothing on this list got longer on 13 August, and that is the point of saying so. The app now records which screens you reached, and there is a box for telling us what to build — and both of them go to our own server and stay there. The panel that reads them sits on the same site as this page and talks to the same machine in Finland. The name that would normally appear here is an analytics company, and there isn't one — no SDK in the app, no tag on this site, nothing that follows you into somebody else's. Two names on this list are touched by the new work and neither is new to it: Vercel serves the panel's files, and Clerk signs the builder in to it, in his browser and never in yours. Seven, still — and it stayed seven until 4 September, when the push service above became the eighth.

The one thing that would change this count is a support desk, and there is deliberately no path to one: the box in the app sends and does not receive, so it can never become an inbox somebody has to staff with a tool somebody has to buy. If that ever changes, it changes here first.

09

If you email us #

lapka.admin@gmail.com — and it goes to a person.

The address is printed rather than hidden behind the link, because a mail link does nothing at all on a machine with no mail app set up.

It is not a mailing list, there is no automation behind it, and nobody gets subscribed to anything by writing to it. We have your address because you sent it, and we use it to reply. It is read by the person building Lapka and by nobody else.

It is a Gmail address, which tells you two true things. The first is that Google holds that mailbox, so anything you send is on their servers as well as in front of us — that is how email works, and it would be true of any address we could give you today. The second is the honest one: this is a person with an inbox, not a support desk with a rota. It is answered when he reads it.

Since 13 August there is a second way to reach the same person, and it differs in one way that matters. The box in the app — for something you want built, or something that is broken — goes to our own server rather than to Google, and it is read by him and by nobody else. But nothing comes back. There is no reply, no ticket and no notification, the app says so on the screen before you send, and it says it there rather than here because that is where somebody is deciding whether to bother. Use the address above if you want an answer, and the box if you want something changed. If your cat needs help now, neither of these is the right thing — a vet is.

10

Getting it deleted #

There is a button, it works, and it does not yet do all of what its name suggests.

In the app: Settings → Delete my account. It is a page of its own rather than a two-line alert, because the only thing worth saying at that moment is what goes, and an alert has no room to say it. It deletes your account with our authentication provider, and it wipes the database on your phone — the cat, the intake, the programme, every report, any voice note still sitting in the app's folder, and your cat's photo. That part is thorough and it is not reversible.

The photo was the exception until 15 August, and it is worth its own sentence. The wipe asks the database what tables exist, so it cannot miss one — but a photo is a file rather than a row, and it was on a list somebody had to remember to add it to. They did not. So the button took every row about your cat and left their face in the app's own folder, which is the folder §3 says plainly is inside the iCloud backup. This sentence was true on the page and false in the app; the fix was a line of code rather than a line of writing, and there is now a test that fails if anybody removes it.

What it does not do, said here because the button does not say it: it does not remove the rows described in §6 from our server, or the photo file beside them. Deleting your account takes away the key that reaches them, so nobody can sign in and read them — but the intake, the reports, the picture, the list of screens you reached and anything you asked us for are still on the disk in Finland afterwards. The button in the app does not reach any of it, and we would rather print that sentence than let the word "delete" cover for it.

What changed on 13 August is that a real deletion now exists — and it is not a button you can press. It is in the panel §2 describes, so the person who reads the inbox can do the thing the app cannot. When he runs it, it takes the cat, the intake and your paragraph, the transcript, every programme and every report, the subscription row, the photo file, every installation of the app, every one of those recorded screens, and everything you asked us for — and then your account with our authentication provider, so there is nothing left to sign in to. It counts each of those on screen before it runs and makes him type your cat's name to confirm, because the failure worth designing against is deleting the wrong person.

One row is written in order to outlive it, and it is fair that you know what is in it. The log from §6 keeps: that a deletion happened, when, who did it, the reason he typed, the two internal ids of the account, your cat's name, and the counts of what went. It holds no email address, none of the words you wrote, no answer you gave and no picture. It survives on purpose — a record of a deletion that a deletion erases is not a record — and naming your cat in it is the part we would have preferred not to write, so it is written.

Two more tables keep their rows and lose you out of them, and this used to say "one row survives". The cost ledger from §6 — the one holding a digest and never a prompt — and the record of what Apple or Google told us about your subscription both have their link to your account emptied rather than deleted. What is left in the first is a date, a model, some token counts and a price, with nothing pointing at a person. The second also keeps the store's own identifier for the subscription, which is their name for a purchase and not for you, and which nothing on our side can join to anybody once the account is gone. They stay because a cost ledger with holes in it cannot be added up and a payment trail with holes in it cannot be reconciled. The deletion screen has always counted both out loud before it runs, in the same list as everything that is about to go — which is how this page came to be corrected rather than the other way round.

Two things have a way out that the rest does not, and they are worth knowing. "Go back to the drawn cat", in the app, removes the photo file from the server as well as from your phone. And "take it back", on anything you sent through the box, erases what you wrote from the server too — the words, and the set of context in §6 that a bug report carried up with them. Both happen the moment you press, by you, with nobody asked.

A take-back leaves one row behind, and here is all of it: its id, your account, your cat's id, your language, whether it was an idea or something broken, the three times — sent, last changed, withdrawn — and the status and private note from §6. Not one word you typed, and not one field of that context. The list used to read "its id, your account and the two timestamps", which was the right shape and three columns short. It stays for a reason we would rather name than have you find. Three asks a day is the limit, it is counted over that same table, and if taking one back handed the slot back then send-and-withdraw would be the way around it. The emptiness is kept by the database rather than by our good intentions — a withdrawn row with words still in it is a row it will not store.

For everything else, the way to have it gone is still to ask: email lapka.admin@gmail.com and say so. It is done by hand, by the person who reads that inbox, and he will tell you when it is done. Nothing is required of you beyond asking — no form, no reason, no account still open to ask from. What is new is that he now has one press to do it with instead of a database console, which does not change your side of it at all and does change whether it gets done properly.

11

What we haven't worked out #

We would rather list these than write paragraphs that sound like answers.

Three of them were answered on 12 August and a fourth on 13 August. They keep their place in the list and turn a different colour, so that the count of what is open is a number you can arrive at by reading rather than one you have to take from us.

Every one of these has to be settled before anybody can subscribe. Three still are not, and the two that matter most — how long we keep an intake and a report — are a decision rather than a build.

12

Children #

Lapka is for adults training a cat.

13

Changes to this draft #

It will change, and this is where it says how.

5 September 2026. The fourth revision, and it is the one this page should be judged on: three weeks passed in which the app gained a new kind of collection and this page did not mention it. Nothing here was found by reading the page. It was found by reading the code against the page, three weeks late, which is the failure mode §8 was written to prevent and did not prevent.

• §8 — there are eight companies now, not seven. Expo, the service that delivers a notification to your phone, went live on 4 September, and the notification says "Mochi's plan is ready".
• §8 — your cat's name goes to the model, and has since 12 August. The first draft of the Expo entry above called the notification the only place their name leaves our own machines. It is the second: the generation prompt opens "The cat is called Mochi.", and a voice note with their name in it is a third. This page had never said any of that, while twice going out of its way to say an event never holds their name — which is exactly how a completeness claim about one table gets read as a promise about everything.
• §6 — the server stores a notification address, and nothing removes it. It arrives with a tap on tell me when it's ready, it is meant to belong to that one plan, and the note beside the column claims it clears itself. It does not.
• §4, §7 — "nothing goes anywhere until you have an account" was wrong from 23 August. A voice note is uploaded to be turned into text during the intake, on the one route on our server that carries anything of yours and answers without a token. The conclusion §4 was drawing is still true of anybody who types; it was never true of anybody who spoke. It was wrong twice in that section: the headline, and the line under the seven background jobs saying all seven wait for an account. Six of them do. The third one — the voice note — is the same exception, and it is now marked in the list itself.
• §4 — one send is not one of the seven background jobs. The notification address goes up at the moment you press the button, not on a sync pass.
• §5 — Google has been run against this instance, and it fails after Google has seen you. This page said neither provider had been tried. Pressing the button opens Google's consent screen and hands back a session; the account is never made, because the instance wants a username Google does not supply.
• §6 — only one of the two doors on an urgent-sign check has ever been possible. The ticked one belonged to the urinary check, removed on 12 August, the day before any of this began being recorded. The terms page has said so all along and this one did not.
• §2, §6, §11 — three counts corrected. Four screenshots in the folder rather than six; four of the five intake screens still reachable; and the retention question in §11 now names the notification address beside the intake and the report.

15 August 2026. The third revision, and the first one that is a correction rather than an addition. Somebody read this page against the code line by line and found places where the page, or the app, claimed more than the code did. Nothing new is collected and nothing new is sent — what changed is that the sentences below are now true, and the ones that were wrong are quoted rather than tidied away. It was read twice: four things went first, and then the same reading was done again over the whole page and found five more. Both passes are in this list.

• §10, §6 — "take it back" is a real deletion now, and it was not. This page called it one, beside removing a photo, which genuinely deletes the file. What it actually did was mark the row as gone and leave every word you had written sitting in the table, where nothing prunes it. The words and a bug report's context are now cleared on the server; an empty, dated row stays behind so that withdrawing one ask cannot buy you a fourth, and §10 says so in the same breath.
• §6 — the sheet in the app used to name three of the fourteen things a bug report carries. This page had all of them and the sheet did not, which is the wrong way round: the sheet is what you are reading at the moment you decide to send. It names all fourteen now, in this order. Nothing was added to what is sent — a list too long to say is a reason to send less, never a reason to say less — and §6 gains the two it was vague about, the build under the update and what "how far on the programme" actually means.
• §4 — the list of screens no longer records that you reached an urgent-sign check. It recorded which screen without naming the sign, which sounds careful and is not: the only way to reach one is for something about your cat to have opened it, so the row said this cat tripped a check in the part of the log that is meant to say nothing about your cat. It is gone. The row in §6 that names the sign outright stays, because that one is honest about what it is.
• §6 — "here is all of it" now is all of it. That sentence introduced six things an event can carry. There are twenty-eight. Nobody wrote a false list — the list was true when it was written and the app grew underneath it, which is the only way a sentence on this page can stop being true without anybody editing it. All twenty-eight are printed, split into the ordinary ones and the four that say something about your cat, and a test now reads this page against our own source and fails the build when the two disagree — including the counts printed in words, like "which of six reasons".
• §10 — the app's own "delete my account" now takes your cat's photo, and it did not. This is the only item on the list where the page was right and the app was short of it, so the fix is a line of code rather than a line of writing. The wipe emptied every table and left the JPEG in the app's documents folder, which §3 says outright is inside the iCloud backup. There is now a test that fails if the call is taken out again.
• §10 — "one row survives it" was three tables, not one. The audit log was named and the other two were not: the cost ledger and the record of what Apple or Google said about your subscription keep their rows and have the link to your account emptied instead. They are anonymised rather than deleted, the deletion screen has always counted them out loud before it runs, and now so does this page.
• §6 — "one cat per account" was one cat at a time. Reinstall, choose "start fresh", and the old cat is retired rather than deleted — their intake, your paragraph, their programme, every report and their photo file all stay here. The old sentence let you assume the opposite. Nothing about the code changed; §6 now says what it does.
• §6 — a retention promise nobody could keep is gone. The 180-day block said an installation no account ever claimed went at 180 days too. Nothing deletes an installation row at any age, and the sentence could not have described anybody anyway. The event half of that promise is real and stays, with the two qualifiers it always had.
• §10, §6, §3, §2 — four lists that were short. What a withdrawn ask keeps was named as four things and is seven. The list of what is on your phone did not name the deeper questions and your answers to them. "Three HTML files and one stylesheet" left out the fonts and the screenshots. And "they hold no key" was written about admin files that carry our authentication provider's publishable key, which is public by design and is still a key — a reader who opened the file would have found it and been right to wonder what else was rounded off.

13 August 2026. The second revision, and unlike the first it is not the page catching up — it is a new kind of collection, written down before it ships. The app has started recording which screens you reached, and it has a box in it for telling us what to build or what is broken:

• §4 — there are seven background jobs now, not five. One sends what you asked us for; one sends the list of screens. The headline of that section is unchanged and still true: nothing goes anywhere until you have an account. The list waits on your phone until then, and goes up with the times it actually happened.
• §4, §11 — those records are not anonymous. Once you have an account they are your account's history, including the part from before you had one. Said in both places on purpose.
• §6 — four new tables, what a row holds, and the longer list of what one never holds. Including the one event that says which urgent sign fired.
• §6 — the first retention period on this page. 180 days for an event, with the two qualifiers that make it honest: counted from arrival, and pressed by hand rather than run by a machine.
• §8 — still seven companies. The name that would normally arrive with analytics is an analytics company, and there isn't one.
• §10 — a real server-side deletion exists, though not as a button you can press, and one log row survives it. Your cat's name is in that row.
• §2, §9 — an admin panel behind a sign-in on this site, and a second way to reach the same person that never replies.
• §11 — "whether there will ever be analytics" is answered. Yes, ours, no third party. It keeps its place and changes colour; three questions are still open where four were.

12 August 2026. The first revision, and it is mostly the page catching up with three days in which several things were switched on:

• §7 — voice notes are uploaded and transcribed now. This page previously said the app never uploaded one. That was true when it was written and is the most important thing on this list.
• §4 — the server exists and is running, in Finland. It had nowhere to send anything before.
• §8 — the model keys are set, and OpenAI joined Anthropic on the same seam. Seven companies are named now, where three were.
• §3, §11 — nothing is used to train a model, and a voice note is not kept once transcribed. Both were intentions; both are policy.
• §9 — there is an address to write to, which there was not.
• §10 — deleting your account got a section of its own, including the part of it that does not work yet.

Nothing was removed to make the page shorter, on any of the four dates. Where a question got an answer it kept its place and changed colour, which is why §11 still lists seven things and why one paragraph in it now quotes the sentence it replaced — and where a sentence turned out to be wrong it is quoted before it is corrected, which is why §4 and §7 are longer now rather than shorter.