Privacy Policy

Effective 8 October 2026

Who we are

Chalkday is a habit tracker for iPhone, run by Vishal Arora, the seller shown on the App Store. In this policy, “Chalkday”, “we” and “us” mean the people who make Chalkday and run its service. We decide what personal data Chalkday collects and why, so we’re responsible for it: the “data fiduciary” under India’s Digital Personal Data Protection Act, 2023, and the “controller” under the GDPR.

For anything about your privacy, including complaints, write to hello@chalkday.com.

Using Chalkday without an account

You don’t need an account to use Chalkday. If you choose “Not now” when it offers one, your habits, history and settings are saved only on your iPhone, and we never receive them. Friends, circles, cheers and nudges need an account, because they connect you with other people. Each time it opens, though, the app asks RevenueCat whether you have Chalkday Plus, even if you never buy it, so RevenueCat keeps a customer record for the app on your iPhone under a random ID instead of an account, along with any purchases you make (see Purchases).

What we collect when you have an account

Your account

Your email address, and your Chalkday account ID (a random code we give your account, not your name or email). If you sign in with Apple, Apple gives us an email address (your own, or a private relay address if you choose Hide My Email), its user identifier for your Apple ID (a code Apple makes for our apps, not your Apple ID itself) and, the first time only, your name if you choose to share it. We use that name as your display name. If you choose Continue with Google, Google confirms who you are and gives us your name, the email address of your Google account and its identifier for your Google account (a number Google gives the account, not your password). We use that name as your display name too. Google’s answer also includes a link to your Google profile picture, which Supabase keeps with your sign-in details; Chalkday doesn’t use or show it. If you sign in with an email code instead, you have no display name, and friends see you as “A friend”.

Sign-in records

Supabase, which runs our sign-in, keeps records of your sign-ins and sessions to keep your account secure: their times, the IP address you signed in from, and device details your iPhone sends with each request (its “user agent”, which names the app and the iOS version).

Your habits

Each habit’s name, detail, colour and icon; how you complete it (check off, a count or minutes, with its target and unit); its schedule and time of day; the notes you add to it (the identity behind it, its two-minute version and its “After I” cue); its reminder time; its place in your list; and when it was archived or paused.

Your check-ins

For each habit and day: whether you kept it, did the two-minute version, rested or missed it, your progress toward a count, and when you last logged it.

Friends and circles

Who you’re friends with; habits you keep together with a friend (shared streaks); circles you create or join, their names, and the habits you share into them; invite links you create, and who accepted them; cheers and nudges you send and receive; people you block; and a daily note of which friend’s nudge was pushed to you, so each friend can reach you at most once a day.

Push notifications

If you’re signed in and allow notifications, your iPhone’s push token (a code Apple gives the app so notifications can reach that iPhone), whether you accept nudges from friends, your quiet hours and your time zone. These let a friend’s nudge reach you, and never during your quiet hours.

Chalkday Plus

Whether you have Chalkday Plus and until when: the plan (yearly or monthly), whether it’s in its free trial, when it ends or renews, whether it will renew, and whether it was a test purchase (TestFlight). RevenueCat tells our server each time this changes (see Purchases). We don’t keep prices, your country or a history of your payments.

Your Sign in with Apple token

If you sign in with Apple, we keep a token Apple gives us for your account. We use it for one thing only: when you delete your account, we send it back to Apple to revoke Chalkday’s access to your Apple ID.

Messages to us

If you email us, send feedback from the app or report someone, your email address and what you write. A report from the app includes the name and Chalkday ID of the person you’re reporting.

Chalkday never reads your iPhone’s contacts or address book. The friends list, shared streaks and circles you create in Chalkday are stored as described above, and they’re what Apple’s App Store privacy labels call “Contacts”.

Chalkday doesn’t read from or write to Apple Health. The habits and check-ins you keep, which can include health and fitness habits such as water, sleep or workouts, are stored as described above, which is why Apple’s labels list “Health” and “Fitness”.

We don’t collect your location, photos, advertising identifier or payment details.

What your friends can see

Your habits are private unless you share them. A friend sees a habit only when you keep it together with one of theirs through an invite (a shared streak), and the people in a circle see only the habits you share into that circle.

For a habit you share, friends, shared-streak partners and circle-mates see only its name, icon, colour and schedule, and its check-ins: the day, whether you kept it, did the two-minute version, rested or missed it, and when you logged it (Friends shows it as, for example, “Today, 7:12 am”). They never see its detail, the notes you add to it, its “After I” cue, its reminder or your progress toward a count. Once you archive a habit, they no longer see it or its check-ins. Friends and circle-mates also see your display name, and the cheers and nudges you send them. Nobody sees your email address.

When you remove a friend, your shared streaks and the cheers and nudges between you end. When you block someone, they can no longer invite, cheer or nudge you, and neither of you sees the other’s habits in a circle you’re both in. They aren’t told.

What stays on your iPhone

• Reminders. Your iPhone schedules habit reminders and the evening wrap-up itself. We don’t send them, and they work without an account. (A habit’s reminder time is saved with the habit, so it comes back on a new iPhone.)
• Settings. Appearance, haptics, sounds, when your day ends, which day your week starts, the wrap-up time, and the identities you picked when you started.
• Your Chalkday Plus status, as RevenueCat last reported it to the app, so Plus works offline.
• Exports. Your CSV export is made on your iPhone and goes only where you send it.

Signing out or deleting your account clears Chalkday’s copy of your account from that iPhone.

Purchases

Chalkday Plus is sold through the App Store, and Apple handles the payment: we never see your card or payment details.

The app makes and checks purchases through RevenueCat. Each time Chalkday opens or you come back to it, the app asks RevenueCat whether you have Chalkday Plus, whether or not you’ve ever bought it. So RevenueCat keeps a customer record for everyone who uses the app, not just for buyers: an ID, when the app last checked in, and the technical details your iPhone sends with each request (its IP address, model, iOS version, preferred languages and an identifier iOS gives Chalkday for that iPhone, not the advertising identifier). While you’re signed in, the ID is your Chalkday account ID (a random code, not your name or email), which the app also gives Apple with any purchase. Otherwise it’s a random ID RevenueCat makes for the app on your iPhone. When you buy, restore or renew Chalkday Plus, RevenueCat adds the App Store’s records of your purchases to that customer record: the products, their dates (bought, trial, renewal and expiry), prices and currency, and your country or App Store storefront. RevenueCat never receives your name, email address or habits.

RevenueCat confirms each purchase with Apple, so Chalkday Plus follows your account to a new iPhone, and tells our server whenever your subscription changes. Our server keeps only whether you have Chalkday Plus and until when (see What we collect). RevenueCat’s dashboard shows us each account’s purchase history, which we use to help with purchase problems, and overall figures about Chalkday Plus, such as how many free trials become subscriptions.

Apple’s Privacy Policy covers what Apple does with your purchase.

How we use your data, and why

• To give you the service you signed up for: signing in, backing up and syncing your habits, and friends, circles, cheers and nudges. (Under the GDPR, this is to perform our contract with you.)
• To run Chalkday Plus: checking whether you have Plus each time the app opens, checking purchases with Apple, unlocking Plus on each iPhone you sign in to, and helping with purchase problems (our contract with you), and seeing overall figures about Plus, such as how many free trials become subscriptions (our legitimate interest in running the subscription).
• To keep Chalkday safe: securing accounts, enforcing blocks, and looking into reports of abuse. (Our legitimate interest in a safe service.)
• To help you when you write to us. (Our contract with you, or our legitimate interest in answering.)
• To meet legal obligations, when the law requires it.

Notifications only ever arrive with your permission, which you can take back in your iPhone’s Settings > Chalkday > Notifications. Under India’s DPDP Act, you consent to the uses above when you create an account, and you can withdraw that consent at any time by deleting your account, which is as easy as creating it.

We don’t use your data for advertising, we don’t build profiles of you, and we don’t sell or rent it to anyone.

No ads, no tracking, no usage analytics

Chalkday has no ads and no advertising or usage-analytics code: apart from RevenueCat noting when the app last checked whether you have Chalkday Plus (see Purchases), nothing records how you use the app. It doesn’t track you across other companies’ apps or websites. Apple gives app developers anonymous, aggregate App Store statistics, such as downloads, and crash reports from people who chose to share them with developers in their iPhone’s settings. None of this tells us who you are. The only other figures we see are RevenueCat’s about Chalkday Plus, built from the customer and purchase records described under Purchases.

Who handles your data for us

We use a few service providers. Each is bound by its data processing terms with us to use your data only to provide its service to us, and to protect it at least as well as this policy describes.

Supabase

Stores your account and the data above, runs sign-in, and runs the small server functions that push nudges, delete accounts, and receive RevenueCat’s updates about Chalkday Plus. Each update passes through with the purchase details listed under Purchases, but we keep only your Chalkday Plus status. Our project is hosted in Mumbai, India.

Resend

Our email delivery provider. Your six-digit sign-in codes are emailed by Supabase or by Resend, and when Resend sends one, it receives your email address and the code.

RevenueCat

RevenueCat, Inc., in the United States, runs Chalkday Plus purchases for us. Because the app asks it at each launch whether you have Chalkday Plus, it keeps a customer record for everyone who uses the app, buyer or not: your Chalkday account ID while you’re signed in (otherwise a random anonymous ID), when the app last checked in, and technical details such as your IP address, iPhone model and iOS version. If you buy, it adds the records of your App Store purchases (products, dates, prices, and your country or App Store storefront), checks them with Apple, and tells our server whether you have Chalkday Plus. See Purchases.

Apple

Sign in with Apple, App Store purchases, and push notifications. Apple’s push service delivers a friend’s nudge to your iPhone, including the friend’s name and the habit it’s about.

Google

Google LLC, in the United States, runs Sign in with Google. When you choose Continue with Google, you sign in on Google’s own screen, under Google’s Privacy Policy, and Google confirms who you are to us (see What we collect). From us, Google only learns that you signed in to Chalkday: we never send it your habits or anything else from the app. When you delete your account, the app asks Google to revoke Chalkday’s access to your Google account where it can (see Deleting your account).

Cloudflare

Serves this website, chalkday.com, and forwards email sent to hello@chalkday.com to our inbox.

Our email provider

Stores the emails you send us, including reports.

Other than these providers, and the friends and circle-mates you choose to share with, we share your data only when the law requires it. If Chalkday is ever sold or merged, we’ll tell you before your data comes under a different privacy policy.

Where your data is stored

Your account and habits are stored in India, with Supabase in Mumbai. Some data leaves India: sign-in code emails, sent by Supabase or by Resend (which is based in the United States), can be sent from outside India, so your email address and the code pass through other countries; RevenueCat keeps its customer and purchase records in the United States; and Apple, Google (for Sign in with Google), Cloudflare and our email provider work around the world. Where the GDPR applies, these transfers rely on safeguards such as the European Commission’s Standard Contractual Clauses in our providers’ data processing terms.

How long we keep it

• Your account, habits, check-ins and friends are kept until you delete them or your account.
• Sign-in records are kept by Supabase while you have an account, and deleted straight away when you delete it.
• Invite links stop working after 14 days, or once used, and stay in your account as a record until you delete your account.
• A push token is removed when you sign out on that iPhone (signing out needs a connection, so the token is always removed first), when Apple tells us it no longer works, or when you delete your account.
• Nudge records: to let each friend nudge you at most once a day, we note who nudged whom on which day. We keep these notes for today and yesterday only (yesterday covers time zones), and a daily job deletes older ones, so none is kept for more than about two days.
• Your Sign in with Apple token is kept only while you have an account, and is revoked at Apple and deleted when you delete it.
• Your Chalkday Plus status is kept while you have an account, updated whenever RevenueCat tells us of a change, and deleted when you delete your account.
• Your customer record at RevenueCat (its ID, when the app last checked in, the technical details listed under Purchases, and any purchase records) is kept under RevenueCat’s own policy and Apple’s requirements for App Store purchases. Deleting your Chalkday account doesn’t delete it. To have it deleted, email us and we’ll delete it at RevenueCat. If you’ve bought Chalkday Plus, include the Order ID from Apple’s receipt email, which lets us find the record and shows it’s yours. If you haven’t, write from the address on your Chalkday account before you delete the account. Without a purchase or an account, the record is under a random ID that nothing links to you, so there’s nothing we can find.
• Backups: Supabase keeps daily backups of our database for a limited time (currently 7 days), so something deleted is gone from backups within about a week.
• Technical logs kept by Supabase and Cloudflare, which can include IP addresses, are deleted on the providers’ own short schedules.
• Emails to us, including reports, are kept only as long as we need them to help you or deal with the report.

Deleting your account

In Chalkday, go to You > Settings (the gear at the top) > Delete account. This deletes your account and everything linked to it from our servers straight away: your profile, habits, check-ins, friendships, shared streaks, circle memberships, cheers and nudges sent or received, nudge records, blocks, invites, push tokens, Sign in with Apple token, Chalkday Plus status, and the sign-in records Supabase keeps for your account. Circles you created are deleted for everyone in them. Invites you accepted stay in the inviter’s account as used, with no link to you. Chalkday’s data is also cleared from that iPhone. Copies in Supabase’s daily backups are gone within about a week (see How long we keep it).

If you signed in with Apple, we revoke Chalkday’s access to your Apple ID first. If Apple can’t be reached, the app tells you how to finish yourself: open the Settings app, tap your name and go to Sign in with Apple, then choose Chalkday and tap Delete.

If you signed in with Google, deleting your account on an iPhone where you’re signed in to Chalkday with Google also asks Google to revoke Chalkday’s access to your Google account. If the app can’t (say you delete it on an iPhone where you signed in with an email code, or Google can’t be reached), it tells you how to finish yourself: in your Google Account’s third-party connections (Security > Your connections to third-party apps & services), choose Chalkday and delete its connection. You can remove that access there at any time, too.

Deleting your account doesn’t cancel Chalkday Plus, or delete your customer record at RevenueCat (see How long we keep it). Cancel Plus with Apple first (see Support).

Can’t open the app? Email hello@chalkday.com from the address on your account, and we’ll delete it for you.

Exporting your data

Go to You > Settings > Export your data for a CSV file of the days you’ve logged in roughly the last 13 months (the app keeps about 400 days of history): the date, the habit and how it went, archived habits included. For a complete copy of everything we hold about you, email us.

Your rights

Wherever you live, you can ask us what personal data we hold about you, get a copy, have it corrected or deleted, and stop us using it. Much of this you can do yourself in the app.

In India

Under the Digital Personal Data Protection Act, 2023, you have the right to:

• a summary of the personal data we process about you and what we do with it, and to know who we’ve shared it with;
• have your data corrected, completed, updated or erased;
• withdraw your consent at any time (deleting your account does this);
• have your complaints answered by us; and
• nominate someone to use these rights for you if you die or can’t use them yourself.

If you’re not satisfied with how we answer a complaint, you can complain to the Data Protection Board of India.

In the European Economic Area, the UK and Switzerland

Under the GDPR (and the UK GDPR), you have the right to access your data, have it corrected or erased, restrict or object to how we use it, receive it in a portable format, and withdraw consent at any time. You can also complain to your local data protection authority.

How to ask

Email hello@chalkday.com, from the address on your account if you can. We may ask you to confirm it’s you before acting. We’ll reply within 30 days, and it’s free.

Security

Your data travels encrypted, and Supabase encrypts our database at rest. The database checks every request, so each person can read only what they’re allowed to: their own data, and what friends chose to share with them. Some data, like Sign in with Apple tokens, can’t be read from the app at all. No system is perfectly secure, but if a breach ever affects your data, we’ll tell you and the authorities as the law requires.

Children

Chalkday isn’t directed at children under 13, and we don’t knowingly collect personal data from them. If you’re under 18, please create an account only with a parent’s or guardian’s permission. If you believe a child under 13 has given us personal data, email us and we’ll delete it.

This website

This website has no cookies, no analytics and no scripts. Cloudflare serves it and, like any web host, handles your IP address to deliver the pages. The pages use the Nunito font from Google Fonts, so Google receives your IP address and browser details when you open them, under Google’s Privacy Policy.

Changes to this policy

If we change this policy, we’ll update the date at the top. If a change matters, we’ll tell you in the app or by email before it takes effect.

Contact

Questions, requests or complaints about your privacy: hello@chalkday.com.

Grievance Officer

Vishal Arora, hello@chalkday.com. We’ll respond to a grievance within one month of receiving it.