Version of 20 October 2026
Privacy at Chail
This notice covers the Chail website at https://chail.app, the Chail app and buying a plan. Your emails are processed on your device and never on our servers.
1. Who is responsible
The controller under the GDPR is the provider named in the Imprint. Contact: support@chail.app.
2. Visiting this page
We use no cookies, no local storage and no third-party scripts here. Our server counts page views itself: the page, the referring website (domain only), campaign parameters in the link (utm_…), the country our network provider derives from your connection, and whether you use a phone or a computer.
How the page is used: while this page is open, it tells our server what happens on it. That is: which buttons and links are clicked, clicks that hit nothing, which sections were on screen, how far down and for how long the page was read, the steps of the sign-up form (for example that the field was selected or which error message appeared, never what you typed), how the comparison slider and the questions were used, script errors and how fast the page loaded. Our server adds the operating system, browser and language that your browser sends with every request anyway. Nothing else is read from your device (no screen size, no fonts, no settings), and nothing is stored on it.
Telling visits apart: the server forms a code from your connection and browser with a key that changes every day and exists only in its working memory. The code is stored with the events of that day. Because the key is deleted at the end of each day, the code cannot be traced back to your connection afterwards, and it is never linked to your entry on the waitlist. Your IP address is not stored. The single events are deleted after 30 days. After that only daily totals remain, without any code.
If your browser sends “Do Not Track” or “Global Privacy Control”, none of this is counted or sent. Legal basis: Art. 6 (1)(f) GDPR (knowing how many people visit, where they come from and which parts of the page work).
3. Joining the waitlist
What we store: your email address; when you signed up and when you confirmed; your personal invite code and, if you came through someone’s link, which code that was; how you found us (campaign parameters in the link, the referring website as a domain, which button you used); the country derived from your connection, phone or computer, your browser language and how many seconds you spent on the page before joining. If you choose to, also which device you would use Chail on. We do not store your IP address or your name.
Why: to run the waitlist (confirmation, your place in line, invites), to email you when your spot comes up and when Chail launches, and to see in aggregated form which channels bring people to Chail.
Double opt-in: after you enter your address, we send exactly one email with a button. Only when you press it are you on the list. Until then we send nothing else.
Which emails you get: the confirmation, a short note if you sign up again with the same address, at most one note a day when a friend joins with your link, and later your invite and news about the Chail launch. Our emails contain no tracking pixels, and we do not track which links you click.
Invites: when someone joins with your link and confirms, you move up the list. You only see how many people joined through you, never who. The person you invited sees nothing about you.
Legal basis: your consent (Art. 6 (1)(a) GDPR, § 7 (2) no. 2 UWG) for the emails and the list; Art. 6 (1)(f) GDPR for the aggregated statistics and for protection against misuse.
4. Protection against misuse
To stop scripted mass sign-ups, the server briefly counts requests per network connection in its working memory. Nothing of this is saved. Throwaway email domains are refused, and we check whether the domain of your address can receive email at all (a lookup of the domain, not of your mailbox).
5. Who else is involved
IONOS SE runs our server in a data centre in Germany. Cloudflare, Inc. sits in front of our server as network and DDoS protection and receives emails sent to addresses at chail.app on our behalf. Our emails to you (for example confirmations and sign-in codes) are sent through Resend (Plus Five Five, Inc.) from a data centre in Ireland; if Resend is unavailable, through our mailbox at IONOS. Cloudflare and Resend work for us under data processing agreements that include the EU standard contractual clauses. Nobody else receives your data. We do not sell data and we do not show ads.
6. How long we keep it
Sign-ups that are never confirmed are deleted after 30 days. Your entry is deleted as soon as you leave the list, and at the latest 18 months after you joined. The page events from section 2 are deleted after 30 days. Copies in our server backups are overwritten within 30 days. Counts without any email address (for example “120 sign-ups from Reddit”) may be kept.
7. Your rights
You can ask for access, correction, deletion, restriction and a copy of your data, and you can object to processing. You can withdraw your consent at any time with one click: every email has a “Leave the list” link that deletes your entry immediately. You can also write to support@chail.app. And you have the right to complain to a data protection supervisory authority.
8. The Chail app and your Chail account
Your emails stay on your device. The app connects your device directly to your email provider. Emails, contacts, attachments, notes and passwords never reach our server.
Your Chail account is your email address. Our server stores the address and any further addresses you connect, your plan and how long it runs, your devices (a code for each device, its system, app version and language, and when it was last used), and when you created the account. When you connect an address, we send one short note to it; the app finds this note in your mailbox and sends back only the code it contains, so we know the address is yours. Purpose: your plan on all your devices, signing in without a password, protection against misuse. Legal basis: Art. 6 (1)(b) GDPR. You can delete the account in the app at any time (Settings, Account); we then delete these data, except what we must keep by law (purchases, see section 10).
Gmail and your Google account. If you connect a Gmail address with “Continue with Google”, Google lets the Chail app on your device read, send, organise and delete your emails over IMAP and SMTP, and tells the app your email address. Chail uses this access only for what you see and do in the app: showing your emails as chats, searching them on your device, sending your messages, and archiving or deleting when you ask. Your emails and the access key stay on your device (the key is protected with the encryption of your Windows user account). Apart from the code in our own note (see above), nothing from your mailbox reaches our servers. Your emails are never sold, never used for advertising and never used to train AI models; they only leave your device when you send an email or when you connect another app to Chail yourself.
Chail’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can take back the access at any time: remove the address in Chail (Settings, Addresses), which also withdraws it at Google, or remove Chail in your Google Account under “Third-party apps and services”.
Outlook and your Microsoft account. With “Continue with Microsoft”, Microsoft lets the Chail app on your device read and send your emails over IMAP and SMTP in the same way, with the same rules: everything stays on your device. You can remove the address in Chail and withdraw the permission in your Microsoft account settings.
9. How the app is used
Unless you switch it off (Settings, Privacy, “Share how you use Chail”), the app tells our server which screens and buttons are used, the steps of setting up, that an email was sent (not to whom and not what), that a file was opened (only its type), errors, and when the window is in front. With it go a random code that exists only for this purpose and is never linked to your account or your addresses, the app version, system, language, plan, and the country derived from your connection. Never your emails, contacts, addresses, names, subjects, search words or file names. We store a hashed form of the code and no IP address, for 30 days. Purpose: to see what works and where people get stuck, so we can improve Chail. Legal basis: Art. 6 (1)(f) GDPR. You can switch it off at any time; the app then sends nothing more and deletes what is still waiting to be sent.
10. Buying a plan
Payments are handled by Stripe Payments Europe, Ltd. (Ireland). Stripe receives what you enter on its payment page (for example your email address, name, billing address and payment details) and processes it under its own privacy notice. We receive from Stripe your customer number, the plan, the amounts and dates of payments and refunds, and the payment status, never your full card or bank details. Purpose: to provide the plan you bought, invoices, refunds, cancellations and withdrawals. Legal basis: Art. 6 (1)(b) GDPR and, for keeping invoices and payment records (up to 10 years), Art. 6 (1)(c) GDPR together with German tax and commercial law.
Cancellation and withdrawal: when you use the pages “Cancel your plan” or “Withdraw from contract”, we store the address, the name you enter, the type of request and when it arrived, so we can carry it out and prove it. These records are deleted 90 days after they are completed, unless the law requires us to keep them longer.
11. Creating an account on the website
If you create your account on our website, we store your email address and send one email with a button to confirm it. Your account only exists once you confirm. We also note which button on our page led you there (for example “Download Chail”), without any link to your visits. Legal basis: Art. 6 (1)(b) GDPR.
Which button you see: to find out which button on our page helps people most, each visitor sees one of several buttons per day. Which one is derived from the daily code described in section 2. We only count how often each button was shown and clicked and what followed (download, account, purchase), without any code or address.
12. When you write to us
If you email one of our addresses (for example support@chail.app), we store your email, its attachments and our reply on our server so we can answer you and keep track of the conversation. Only the founders can read them, in a protected area with two-step sign-in. Legal basis: Art. 6 (1)(b) GDPR if it concerns your account or a contract, otherwise Art. 6 (1)(f) GDPR (answering requests). We delete these emails when the matter is settled, at the latest two years after the last message, unless the law requires us to keep them longer.