Punch Cat

Privacy

This page is written to be read, not to protect us. Here is exactly what happens when you punch the cat.

What we store

  • Your country code, decided on the server from your IP address. That code is what reaches the leaderboard.
  • How many punches were in each batch, with a timestamp.
  • One HMAC-SHA256 hash of your IP address, keyed with a server secret plus today's UTC date. That hash is used for rate limiting and nothing else.

Because the key changes every day, today's hash cannot be linked to yesterday's. A long-term profile cannot be built, not even if our database leaked.

What we never store

  • Raw IP addresses. An IP exists in process memory for the length of one request, inside one hashing function, and is then dropped. It never reaches the database, the logs, the cache or any third party.
  • Cookies. Not one, not even a “functional” one.
  • Analytics, tracking pixels, browser fingerprints, accounts and email addresses.

What your browser keeps

  • sessionStorage holds your session token and your local punch count, so the number survives a reload. Both disappear when the tab closes.
  • localStorage holds nothing at all. The site has no settings to remember and no identity to keep.

For how long

Raw punch events and their hashes are deleted after 30 days. What remains is the per-country and per-day totals, and those contain no hashes at all.

How your country is decided

The server reads the country header from the edge when there is one, and otherwise looks your address up in a local GeoLite2 database. Nothing is asked of a third party while you play. Your browser never sends a country code, which also means you cannot pick one.

Just for fun

Punch Cat is a memecoin project created purely for fun, memes, and entertainment. We do not promise or guarantee any profits, financial returns, or increase in token value.