Private by design.

1. What we collect when you have an account

2. If you send a note or play as a guest

You don’t need an account to send a note or play a game. We never tell the person you wrote to who you are, and we don’t try to work it out. To keep anonymous notes safe, we keep:

• what you wrote, and the private return link we give you (only its fingerprint is stored);
• a random key your browser keeps for Chupke, and a fingerprint of your network address, so that if someone blocks you, your notes stop reaching them (network blocks last 7 days);
• your email, only if you ask us to tell you when your note is opened or answered. Every email has a link to stop, and the person you wrote to never sees it;
• for a Golden Note: the country you’re in (for the price) and the payment record from Razorpay (or Stripe, our backup). They handle your card or UPI payment; we never see your card or bank details. The month and year you enter to confirm you’re 18+ are checked and not kept;
• if the person you wrote to asks who sent it, their ask, and your answer if you give one. Saying who you are needs you to sign in, and shares only your username. Saying no is never shown to them.

As a guest in a game, your answers are kept with the round under a random key, not your name, unless you type your name in.

In a live room (Undercover, Paranoia), you join with a code and the name you type. We keep that name and a one-way fingerprint of the key your browser holds for your seat, with the room’s words, clues, votes and questions. A room shuts after a few hours idle, or 12 hours at most, and everything in it is deleted a day after that. When the host closes it, it’s wiped at once. In Flag Check your calls are kept with the round under a random key, never a name. In Match Me your swipes are kept the same way; the host sees only a crowd average unless you sign in and choose to put your first name and match on their board, which you can undo any time. In Aura your colour and word are kept under a random key, never a name, and there’s nothing to type. Four Corners guests keep their progress in their own browser; if you sign in and join a crew, the crew’s board shows your first name and how you did each day. In a Traitors Weekend you join with the name you type; we keep it with a one-way fingerprint of your link’s key, your secret role, your votes, picks, reactions and mission answers. Other players see your name and, once the Round Table shows it or the weekend ends, your role. There’s no chat. A weekend is deleted about a month after it ends, and never later than 36 days after it was made.

In Point Blank your ten picks are kept with the round under a random key, never your name; only the host and you see them. In Two Lamps, the link gives your browser a key for your window (we keep a one-way fingerprint of it), and if you sign in, your account. Your answers, up to 200 characters each, pass the same safety check as any message and are only ever shown to the two of you, once you’ve both answered that night. Either of you can put the lamps out, which deletes every night for both of you.

If you tap “Ping me” on a game, you sign in and we keep your account id with that round, so the app can tell you when the results are in or the next round starts. We never keep your answers or your return link with it, the host can’t see the list, and one tap stops it. If you tap “Make your own”, we make a short code that works once, for 7 days, so the app can open that game for you. On Android, the Play Store hands that code to the app once when it’s first opened (the install referrer); the app never reads your clipboard.

If you buy Gift Plus on the web, we keep the gift code, the first name you chose to show (if any), the price, and the payment record from Razorpay (or Stripe, our backup). They handle your card and the email for your receipt; we never see your card.

If you write to us through the form on chupke.app/business, we keep your name, email, company (if you add one), topic and message, a one-way fingerprint of your network address to stop spam, and the result of our safety check, and we email a copy to support@chupke.app so we can reply. It’s used only to answer you, and deleted after a year.

3. How we use it

• To run Chupke and deliver what you send (our agreement with you).
• To keep people safe: automated checks on words and photos, reviewing reports, enforcing our rules, stopping spam and fraud (our legitimate interest in a safe service, and legal duties).
• To talk to you: sign-in emails, notifications you’ve turned on, and important changes. No marketing email without your permission.
• News by email, only if you turn it on: “News and offers by email” in your profile is off until you switch it on. We keep when and where you said yes, so we can show it, and every news email has a one-click unsubscribe. Turn it off anytime in your profile or from any news email.
• To improve Chupke: counts and error reports, never by reading your private notes for marketing (our legitimate interest; you can switch usage counts off in your profile).
• To show wisps near you: only with your permission, through your phone’s location prompt. You can turn it off in your phone’s settings.
• Sensitive choices (see below): only with your consent.
• To meet the law: tax records for payments, and answering valid legal requests.

We don’t sell your data, we don’t show ads, and we don’t use your notes or photos to train AI models. Safety checks are automated; if one stops something being sent, you can ask a person to look again at support@chupke.app.

Notes and game answers can mention other people, like the person you wrote to or a friend in a round. We treat what you write about others with the same care as everything else.

4. Sensitive information

Some things you can tell Chupke are sensitive. We use them only for the reasons given here, and never for ads.

• Gender, and who you want to see. You choose your gender (or “prefer not to say”) and which genders’ wisps you want to see, and who can find yours. Put together, this could say something about your sexual orientation. We use it only to match wisps. Other people never see your gender.
• Dating and Meetups. These are off until you turn them on. When on, your wisps can be open to dating or meeting nearby, and you can see others’ wisps that are.
• Moods. You can give a wisp a mood, like lonely, anxious or heartbroken, and choose the moods you want to see. The mood is shown with your wisp. It isn’t linked to your name.
• Self-harm checks. If something you write looks like you might be thinking about hurting yourself, we show you helplines first. If you choose to go on, a person on our team reads it so we can help if needed. That review is kept until 90 days after it’s closed, then deleted. We do this to protect people’s lives and safety.

Your consent. Before you use Wisps, the app asks you to agree to how Wisps uses this information. We keep when you agreed and the words you agreed to. Without that yes, none of it is saved or matched.

Taking it back. Turn Wisps consent off in Settings in the app at any time. Your wisps that are still up are hidden, who you want to see is cleared, and matching stops. You can also set your gender to “prefer not to say” (once every 30 days), turn Dating and Meetups off, or delete your account. Taking consent back doesn’t affect what happened before.

5. Who helps us run Chupke

We share data only with companies that help us run Chupke, under contracts that limit what they can do with it, and only what each one needs:

• Google Firebase and Google Cloud: sign-in, database, hosting and storage.
• Cloudflare: photo storage (R2), website delivery, and cookie-free website visit counts (Web Analytics: pages, referrers, country and device type, with no cookies and no personal profile).
• OpenAI: its moderation service checks notes, wisps, messages and photos for harmful content. Under OpenAI’s API terms, this isn’t used to train its models.
• Amazon Web Services (SES): sending sign-in and note emails, and passing enquiries from chupke.app/business and bug reports from the app to our inbox.
• Expo, Apple and Google: delivering push notifications.
• Apple and Google: sign-in, and in-app purchases through the App Store and Google Play.
• RevenueCat: keeps track of your subscription with Apple and Google, using your account ID.
• Razorpay: payments for Golden Notes and Gift Plus on the web.
• Stripe: our backup for web payments, used only if Razorpay isn’t available.

That’s the full list. There are no analytics or advertising companies on it. Our website has no Google Analytics or other tracking scripts (see Cookies).

We don’t sell or share your personal information, for money or for advertising.

We may share information if the law requires it, to protect someone from serious harm, or to protect Chupke and its users from fraud or abuse. We report child sexual abuse material to the relevant authorities. If Chupke is ever sold or merged, your data would move with it under this policy, and we’d tell you first.

6. How long we keep it

• Your account and what’s in it: until you delete it, or delete your account.
• Wisps leave the sky after 48 hours and are deleted 30 days after that. A copy someone kept lasts 90 days after the wisp left the sky.
• Photos: while a wisp or chat shows them, and up to 95 days after you last used them (your photo shelf keeps them 90 days). Activity: 90 days.
• Golden Notes never paid for: deleted 30 days after they were written.
• Live game rooms (Undercover, Paranoia): deleted a day after the room shuts (12 hours at most after it opened). Flag Check, Match Me and Aura rounds and Four Corners crews and days: until the host deletes them or you delete your account, and you can leave a crew any time. Traitors Weekend: about a month after the weekend ends (36 days after it was made at most), or sooner if the host deletes it. Point Blank rounds: until the host deletes them or their account. Two Lamps: until either of you puts the lamps out, or a year after the last night you both answered (two weeks if nobody ever opens the link).
• Reports, with a copy of what was reported, and self-harm reviews: until 90 days after the report is resolved, then deleted. Child safety reports are kept a year, as the law asks.
• Network blocks from a block: 7 days. Limits and visit counting: a few days. Link Radar counts: 30 days. Usage events: 30 days, and an install’s usage record 90 days after it was last used.
• Buddy Pass records for the 90-day rule: the phone fingerprint about 100 days after a pass was used on it; your account’s record until you delete your account. Unused passes stop working after 30 days, gift codes after a year.
• Payment records: as long as tax and accounting law requires. Store purchase events: about 13 months.
• Business and press enquiries sent through chupke.app/business: a year.
• Bug reports you send from the app, with the screenshot if you added one: a year, or until you delete your account.

When you delete your account

Deleting your account (in the app under Profile, or at chupke.app/delete-account) deletes, straight away: your profile and username, every note in your inbox and your replies, your link numbers and short links, your wisps (including copies others kept) and the warmth you gave, your Kindred, the messages you sent in chats, your photos (the files too), games you hosted with their answers, your notifications and devices, your Plus record, your Buddy Pass records (passes you gave stop working if unused, and passes you used no longer point to you), your usage events, bug reports you sent (with their screenshots), and your sign-in. If you once told someone you sent them a note, your username comes off that note. RevenueCat is asked to delete your purchase history too.

Some things stay, because safety or the law needs them:

• Reports you made or that were made about you, and the content they point to (no longer linked to your account), until 90 days after they’re resolved.
• Payment records: a Golden Note you received keeps only its payment details (no words, no link to you) for the sender’s receipt and refunds. Store purchases you made (passes, Plus Weeks, boosts) and Gift Plus orders keep only their payment details, no longer linked to you. Store purchase events expire on their own.
• A record that your account was deleted, under a one-way fingerprint of your account ID, so we can show we did it.
• If your account was banned, keyed one-way fingerprints of its email, phone number and sign-in IDs, so a banned person can’t rejoin. They’re removed if the ban is lifted.

In a chat, the other person keeps their own messages; yours disappear and the chat closes. Deleting your account doesn’t cancel a store subscription: cancel it in the App Store or Google Play.

7. Your choices and rights

Wherever you live, you can:

• Get a copy of your data. In the app, go to your profile and download a copy of your data. You can also ask us by email.
• Correct it. Change your name, username and settings in your profile. For anything else, email us.
• Delete it. Delete your account in your profile, or at chupke.app/delete-account. You can also delete single notes, wisps and games.
• Stop usage counts. Switch off usage counts in your profile. Chupke works the same.
• Take back consent for sensitive choices, location, notifications and news emails, in the app, at any time.
• Object or ask us to stop using your data for something, by emailing us.

Email support@chupke.app from your account’s email. We answer within 30 days, and we may need to check it’s you. We never treat you differently for using these rights.

If you’re in the UK, the EU or the EEA

Data protection law (the GDPR, and in the UK the UK GDPR and the Data Protection Act 2018) gives you the right to: access your data; have it corrected; have it deleted; restrict how we use it; get it in a format you can take elsewhere (the download in your profile); object to how we use it, including usage counts; withdraw consent at any time; and not be subject to a decision made only by a machine that seriously affects you. Our automatic safety checks can hold content back, but a person always reviews before we remove content or act on an account after a report, and you can ask a person to look again.

The legal bases we rely on are: our contract with you (running Chupke), our legitimate interests (safety, stopping abuse, and improving Chupke with usage counts, which you can turn off), legal obligations (tax records, valid legal requests), your consent (location, notifications, news emails), and your explicit consent for sensitive Wisps choices. Self-harm checks rely on protecting someone’s vital interests and the safety purposes the law allows.

To use any of these rights, use your profile in the app or email support@chupke.app. We answer within one month. If you’re unhappy with how we handled your data, you can complain to a data protection authority. In the UK that’s the Information Commissioner’s Office (ICO), at ico.org.uk or on 0303 123 1113. In the EU or EEA, it’s the authority in the country where you live or work, or where the problem happened. We’d like the chance to put it right first, so please tell us too.

Everywhere else

In India you can contact our Grievance Officer below, and then the Data Protection Board of India. In California and other US states, you have the right to know, correct and delete, and we don’t sell or share your personal information. If your local law gives you other rights, ask us and we’ll honour them.

8. Do Not Track

Some browsers send a “Do Not Track” or Global Privacy Control signal. Chupke doesn’t track you across other websites or apps, and chupke.app has no third-party tracking, so we treat every visitor as if they had sent one.

9. Security

Data travels encrypted. Notes, chats and photos live in private storage that apps and websites can’t reach directly; our server checks who you are before showing anything. Note return links keep their secret after the # in the address, a part browsers never send to a server. No system is perfect: if something goes wrong that affects you, we’ll tell you, and tell the authorities as the law requires (in India, CERT-In within 6 hours).

10. 18+ only

Chupke is for adults. We don’t knowingly collect data from anyone under 18. If you join and you’re under 18, Chupke stays locked, and you can delete the account at chupke.app/delete-account. If you think someone under 18 is using Chupke, tell us at support@chupke.app.

11. Where data is kept

Chupke’s servers are run by Google Cloud and Cloudflare, mainly in the United States. Chupke is run from India, so our team reads reports and answers you from India, and Razorpay handles payments there. So your data is processed in the United States and India, and accessed from both. Our providers are bound by data protection terms, and we protect your data the same way wherever it is.

If you’re in the UK, the EU or the EEA: Amberloom Labs is based in India, so we handle your data there ourselves, under this policy and the GDPR or UK GDPR. When our providers handle it in the United States, we rely on the EU-US Data Privacy Framework (and its UK Extension) for providers certified under it, and otherwise on the European Commission’s standard contractual clauses (with the UK Addendum, or the UK’s International Data Transfer Agreement). Ask us at support@chupke.app for more about these safeguards.

12. Where Chupke is offered

Chupke is offered around the world, wherever the app stores and local law allow, to adults 18 and over. Wherever you are, we follow the same practice: we collect as little as we can, say why we use it, and let you see, change and delete it. The sections above explain extra rights you have in the UK, the EU and the EEA, India, and US states.

13. Changes

When we change this policy in a way that matters, we’ll tell you in the app or by email before it applies, and update the date at the top.

14. Contact

Privacy questions and requests: support@chupke.app. Safety: support@chupke.app.