Account security
Sign-in security privacy notice
Effective October 9, 2026
Information recorded
To help protect accounts, Jeannie Meows records successful sign-ins and failed sign-in attempts, including the time, available IP address, browser-provided device details and authentication method. Passwords, authenticator codes, recovery codes and session tokens are not included in this history.
Unmatched sign-in identifiers are stored as a protected fingerprint rather than a readable email address. Browser details may be incomplete or inaccurate. An offline country/region IP-location dataset may be configured to detect significant changes. When absent, location is unavailable and no location-change alerts are generated. IP geolocation is approximate and can be wrong because of VPNs, mobile networks or provider changes. No precise GPS, photographs or video are collected for this feature.
Access and security notices
You can review your own successful sign-ins in Login history. Admin can review successful and failed attempts and investigate reports of unrecognized logins. These security records are retained for investigation and audit history and are not publicly accessible.
A new browser signature creates an in-account security notice, including the first recorded browser. Browser updates can trigger this notice. It also sends a required security email to the current account email address with the sign-in time and available browser, device and IP details; it does not contain your password or authentication codes. When an account owner reports an unrecognized login, active Admin accounts receive a required email alert. Security email alerts cannot be disabled through optional Cat Match notification preferences. Email delivery failures are flagged for staff review; notifications remain visible in the account. Reporting “This wasn’t me” flags the record and notifies Admin for review; reporting by itself does not end sessions or reset your password. You may separately sign out other devices from Login history while keeping your current browser signed in. After a reported login, an authorized Admin can terminate all of the account’s active sessions following a documented review. Sessions are invalidated without recording their secret keys in security history. Verified email accounts can request password-recovery links that expire after one hour and become unusable after a successful reset. Recovery ends all prior sessions and pending MFA challenges, requires normal MFA at the next sign-in, and creates a protected security audit and confirmation email. Requests show the same response regardless of whether an eligible account exists. We do not retain recovery tokens in account security records. Signing out does not reset credentials or prevent a later successful sign-in. When a trusted offline IP-location dataset is configured, sign-ins from a significantly different country or region may create required in-account and email security alerts. The alert reflects an IP estimate, not the user's exact whereabouts.