Privacy policy

The controller for data processed through the Chalify app and this website is:

Raphael Parr
Rheingasse 34
50676 Köln, Germany
info@chalify.app

Write to that address about anything on this page.

Your account. If you sign up with email, your email address and a password, which is stored only as a secure hash. If you sign in with Apple or Google, the account identifier and the email address that provider shares with us. If you continue as a guest, an anonymous account with no email at all.

Your profile. Your username, and if you add them, a display name, a bio and a profile photo, and whether your profile is private.

Your challenges. The challenges you create or join, with their habits, tasks, goals, dates and cover images, and for each day what you ticked off, skipped, logged (an amount or a time) and any note you wrote.

The social side. Who you follow and who follows you, the challenges you are invited to or a member of, and activity like finishing a challenge or reaching a streak milestone, which appears in your followers’ feed.

Notifications. If you allow notifications, a push token that identifies your device for delivery, and your notification settings: which kinds you want and the time of your daily reminder.

We process all of this to provide the service you asked for when you created an account (Art. 6(1)(b) GDPR). Push notifications additionally require your permission on the device, which you can withdraw at any time in iOS Settings.

Each challenge has a visibility you choose: private (only its members), followers, or public. Everything in a challenge, including your ticks, skips, logged values and notes, is visible to the people who can see that challenge. Personal tasks you add to a group challenge are visible only to you.

Your username, display name and profile photo are visible to other users so they can find and follow you. With a private profile, your activity is shown only to people who already follow you.

Profile photos and challenge covers are stored as images with a web address that is not secret: anyone who has that address can open the image.

The daily reminder and the notices for a challenge’s first and last day are scheduled by the app on your device. What they say is worked out on your phone and not sent anywhere.

We use a small number of service providers, each bound by a data processing agreement:

• Supabase (Supabase Inc., USA) runs the database, sign-in and image storage. All app data is stored in the EU, in Frankfurt, Germany.
• Expo (650 Industries Inc., USA) delivers push notifications. It receives your device’s push token and the text of the notification, for example “Sam started following you.”
• Apple delivers push notifications to iPhones and, if you use it, provides Sign in with Apple. Google provides Sign in with Google if you use it.
• Vercel (Vercel Inc., USA) hosts this website.

Where a provider processes data in the USA, the transfer is based on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

• No advertising, and no advertising or analytics SDKs in the app.
• No selling or renting of your data to anyone.
• No tracking across other apps or websites.

This site sets no cookies and uses no analytics. Its fonts are served from chalify.app itself, so your browser doesn’t contact Google or any other font service.

Like any web server, our host Vercel records technical access data when you visit: your IP address, the time, the page requested and your browser’s user agent. This is needed to deliver the site and keep it secure (Art. 6(1)(f) GDPR) and is deleted by Vercel after a short period.

If you test Chalify through Apple’s TestFlight, Apple may share crash reports, basic device information and any feedback or screenshots you choose to send with us. This is governed by Apple’s TestFlight terms and used only to fix problems.

We keep your data for as long as you have an account. You can delete your account at any time in the app under Profile, Settings, Delete account. This permanently deletes your account, your profile, the challenges you own, and every tick, skip, logged value, note and follow of yours. Leaving a group challenge also removes your ticks and personal items from it.

Profile photos and challenge covers are stored separately and are not yet removed automatically when you delete your account. Email us afterwards and we will delete them within 30 days. A guest account has no email, so once you sign out of it nobody, including us, can tell which account was yours. Delete it in Settings before you sign out.

If you can’t use the app, email info@chalify.app from the address on your account and we will delete it for you.

Under the GDPR you have the right to:

• get a copy of the data we hold about you (Art. 15),
• have incorrect data corrected (Art. 16),
• have your data deleted (Art. 17),
• restrict how we process it (Art. 18),
• receive it in a portable format (Art. 20),
• object to processing based on our legitimate interests (Art. 21),
• withdraw a consent you gave, with effect for the future (Art. 7(3)).

Email info@chalify.app to use any of them. You can also complain to a data protection authority. Ours is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf.

Chalify is not meant for children under 16, and we don’t knowingly collect their data.

When the app starts doing something new with your data, this page changes first, and the date at the top changes with it. See also the imprint.