Privacy Policy

Last updated: October 28, 2026

1. Who we are

Chaaq is operated by CapraTrail Studios LLP ("we", "us", "our"), the data controller for the personal information described in this policy. This policy explains how we handle your information when you use the Chaaq mobile app and our website at chaaq.app.

2. What we collect

We collect information in two ways: what you give us directly, and what's generated when you use the app.

Information you provide:

• Account details — phone number (verified with a one-time code when you sign up or sign in), email address (for older accounts that sign in with email or Sign in with Apple), display name, and an optional profile photo. If you use Sign in with Apple and choose to hide your email, we receive only the relay email Apple provides.
• Financial records — expense descriptions, amounts, currencies, split details, payment records, and notes you add to transactions
• Group and chit data — group and chit names, member lists, configuration choices, bid amounts, who receives each month, and payment status
• Contact information for non-Chaaq users — names and phone numbers of people you explicitly add to splits, groups, or chits. If you grant Contacts permission, the app reads the contacts on your phone so you can pick people, and checks their phone numbers against Chaaq accounts to show which of your friends already use Chaaq. Those numbers are used only for that check and are not saved on our servers; we store only the people you add.
• Receipt images — photos you attach to expenses

Information generated automatically:

• Device information — device model, operating system version, and app version (for crash reporting and compatibility)
• Usage data — which features you use and how often, aggregated and not tied to individual user profiles
• Authentication tokens — secure tokens for keeping you signed in
• Push notification tokens — an anonymous device token (APNs token) so we can deliver notifications you've opted into

What we do NOT collect:

• Bank account or credit card numbers
• Your full device contact list (numbers are only checked against Chaaq accounts, never stored)
• Location data
• Browsing history
• SMS or call logs
• Health, biometric, or other sensitive personal data

3. How we use your information

We use your data to make the app work. Specifically:

• Provide the service — tracking expenses, calculating balances, managing groups and chits (lawful basis: contract performance under GDPR Article 6(1)(b))
• Authentication — verifying your identity via phone OTP, email/password, or Sign in with Apple (lawful basis: contract performance)
• Notifications — sending payment reminders and activity updates only if you opt in (lawful basis: consent under Article 6(1)(a))
• Service improvements — understanding aggregate usage to make features better (lawful basis: legitimate interests under Article 6(1)(f))
• Support — responding when you contact us with questions or issues
• Legal compliance — when required by law, regulation, or valid legal process (lawful basis: legal obligation under Article 6(1)(c))

4. How we store and protect your data

Your data is stored on Google Firebase / Cloud Firestore, which provides enterprise-grade security including encryption at rest (AES-256) and in transit (TLS 1.2+), automatic backups, and compliance with SOC 1, SOC 2 Type II, ISO 27001, and ISO 27018 standards.

Receipt images are stored inside the expense or entry they belong to, in Cloud Firestore. Only people signed into an account that can see that expense or entry can view its receipt.

We enforce strict Firestore security rules, server-side: you can only read and write data that belongs to you or groups and chits you're an active member of. These rules cannot be bypassed by a modified client.

5. Payments

Chaaq is an expense tracker, not a payment processor. When you record a payment, you're logging that a payment happened — the actual money transfer happens outside the app (cash, bank transfer, UPI, etc.).

For Pro subscriptions, payments are processed through Apple's In-App Purchase system. We never see or store your payment card details — Apple handles all payment processing under their own privacy policy.

If we add additional payment methods in the future (such as Razorpay or Stripe for non-IAP paths), they will process payment data under their own privacy policies and PCI DSS standards. We will update this policy and notify you before that change takes effect.

6. Who can see your data

• Your individual splits — only you and the person you're tracking expenses with
• Group expenses — all members of that specific group
• Chit data — all members of that specific chit
• Your profile — your name and avatar are visible to people you share groups, chits, or splits with

We do not share your data with any third parties for marketing, advertising, profiling, or any other commercial purpose.

7. Third-party services

We use a small number of trusted services to operate the app. Each is bound by a data processing agreement and operates under its own privacy policy:

• Google Firebase — authentication, Firestore database, cloud storage, crash reporting, and push notification delivery (privacy policy)
• Apple — Sign in with Apple, In-App Purchase, and Apple Push Notification service (privacy policy)

These providers process data on our behalf solely to deliver the services we use. They are contractually prohibited from using your data for their own purposes.

8. Your rights

You have full control over your data. Depending on your location, you have the following rights:

All users:

• Access — request a copy of all data we hold about you
• Correction — update your profile information anytime in the app
• Deletion — delete your account in the app from Profile → Delete Account (section 9 explains what's removed)
• Export — download a machine-readable copy of your data in the app from Profile → Privacy & Security → Export My Data, or ask us by email

Users in the EU, UK, and EEA (GDPR): in addition to the rights above, you have the right to:

• Restrict or object to the processing of your personal data
• Withdraw consent at any time (where processing is based on consent)
• Lodge a complaint with your national data protection supervisory authority

We do not have an appointed Data Protection Officer because the scale and nature of our processing does not require one under GDPR Article 37. For all data protection matters, contact info@chaaq.app.

Users in California (CCPA / CPRA): you have the right to:

• Know what personal information we collect, use, and share
• Request deletion of your personal information
• Opt out of the "sale" or "sharing" of your personal information (we do not sell or share personal information as defined by CCPA, so there is nothing to opt out of)
• Non-discrimination for exercising your privacy rights

To exercise any of these rights, contact us at info@chaaq.app. We'll respond within 30 days (or 45 days for CCPA requests, with possible extension).

9. Data retention

We keep your personal data for as long as your account is active. When you delete your account, we permanently remove your profile, your one-to-one splits (with their receipts) and your activity from our active systems within 30 days. Backup copies are purged within 90 days. Expenses, receipts and chit records in groups or chits you share with other people stay with that group or chit, so the other members' balances stay correct; your account is removed from their member lists.

Some anonymized, aggregated data (which cannot identify you) may be retained for service improvement and analytics. Limited information may be retained longer where required by applicable law, regulation, or to resolve disputes — for example, records required for tax or anti-fraud compliance.

10. Children's privacy

Chaaq is not intended for children under 13, or older where local law requires a higher minimum age (some EU countries require 16). We do not knowingly collect personal information from children below the applicable minimum age. If you believe a child has provided us with personal information, please contact us at info@chaaq.app and we will promptly delete it.

11. International users

Chaaq is available worldwide. Your data is stored on Google Cloud servers and may be processed in the regions where Google operates, which may be outside your home country. Where data is transferred from the EU/EEA, UK, or other regions with data protection regulations, we rely on appropriate safeguards including the EU Standard Contractual Clauses and Google's certifications under relevant frameworks. By using the app, you consent to these transfers.

12. Cookies and similar technologies

The Chaaq mobile app does not use cookies. Our website (chaaq.app) uses only essential cookies necessary for the site to function — no tracking, advertising, or analytics cookies.

13. Changes to this policy

We may update this policy from time to time. When we make material changes, we'll notify you through the app or by email. The "Last updated" date at the top tells you when this policy was last revised. Continued use of Chaaq after a change means you accept the updated policy.

14. Contact us

Questions, concerns, or requests about your privacy? Reach out:

• Email: info@chaaq.app
• Website: chaaq.app

We aim to respond to all privacy-related inquiries within 7 days.