Version of 20 October 2026

Chail 的隐私保护

This notice covers the Chail website at https://chail.app, the Chail app and buying a plan. Your emails are processed on your device and never on our servers.

1. 谁是责任方

《通用数据保护条例》（GDPR）所称的控制者，是法律声明中列明的提供者。联系方式：support@chail.app。

2. 访问本页面

我们在这里不使用跟踪 Cookie、本地存储或第三方脚本。只有在你登录账户时，两个小 Cookie 才会让你保持登录 30 天：一个保存你的会话，另一个只是让页面显示“Account”。退出登录会删除这两个 Cookie。我们的服务器自行统计页面浏览量：所访问的页面、来源网站（仅域名）、链接中的推广活动参数（utm_…）、我们的网络服务提供商根据你的连接推断出的国家，以及你使用的是手机还是电脑。

页面的使用情况：本页面打开期间，会把页面上发生的情况告知我们的服务器，即：哪些按钮和链接被点击、没有点中任何内容的点击、哪些区域出现在屏幕上、页面被向下阅读到什么位置以及阅读了多长时间、报名表单的各个步骤（例如输入框被选中，或出现了哪条错误提示，但绝不包括你输入的内容）、对比滑块和常见问题是如何被使用的、脚本错误以及页面的加载速度。我们的服务器会补充你的浏览器在每次请求时本来就会发送的操作系统、浏览器和语言信息。除此之外，不会从你的设备读取任何信息（不读取屏幕尺寸、字体或设置），也不会在你的设备上存储任何内容。

区分不同的访问：服务器会使用一个每天更换、且只存在于其内存中的密钥，根据你的网络连接和浏览器生成一个代码。该代码与当天的事件一起存储。由于密钥会在每天结束时被删除，此后便无法再通过该代码追溯到你的连接，而且该代码绝不会与你在候补名单上的记录相关联。你的 IP 地址不会被存储。单个事件会在 30 天后删除。此后只保留不含任何代码的每日总数。

如果你的浏览器发送“请勿跟踪”（Do Not Track）或“全球隐私控制”（Global Privacy Control）信号，以上内容均不会被统计或发送。法律依据：GDPR 第 6 条第 1 款第 (f) 项（了解有多少人访问、他们来自哪里，以及页面的哪些部分起作用）。

3. 加入候补名单

我们存储的内容：你的邮箱地址；你报名的时间和确认的时间；你的个人邀请码，以及（如果你是通过别人的链接来的）对方的邀请码；你是如何找到我们的（链接中的推广活动参数、以域名形式记录的来源网站、你使用的是哪个按钮）；根据你的连接推断出的国家、你使用的是手机还是电脑、你的浏览器语言，以及你在加入前在页面上停留了多少秒。如果你选择提供，还包括你会在哪种设备上使用 Chail。我们不存储你的 IP 地址，也不存储你的姓名。

目的：运营候补名单（确认、你的排队位置、邀请），在轮到你时以及 Chail 发布时给你发邮件，并以汇总形式了解哪些渠道把人们带到了 Chail。

双重确认（Double Opt-in）：你输入地址后，我们只会发送一封带有按钮的邮件。只有在你点击该按钮后，你才会进入名单。在此之前，我们不会发送任何其他邮件。

你会收到哪些邮件：确认邮件；如果你用同一地址再次报名，会收到一封简短的通知；当有朋友通过你的链接加入时，每天最多一封通知；以及之后你的邀请和有关 Chail 发布的消息。我们的邮件不含追踪像素，我们也不追踪你点击了哪些链接。

邀请：当有人通过你的链接加入并完成确认后，你在名单上的位置会往前移。你只能看到有多少人通过你加入，永远看不到是谁。你邀请的人也看不到任何关于你的信息。

法律依据：邮件和名单基于你的同意（GDPR 第 6 条第 1 款第 (a) 项，德国《反不正当竞争法》（UWG）第 7 条第 2 款第 2 项）；汇总统计和防止滥用基于 GDPR 第 6 条第 1 款第 (f) 项。

4. 防止滥用

为了阻止用脚本批量报名，服务器会在其内存中短暂统计每个网络连接的请求次数。其中任何数据都不会被保存。临时邮箱域名会被拒绝，我们还会检查你地址的域名究竟能否接收邮件（查询的是域名，而不是你的邮箱）。

5. 还有谁参与

IONOS SE runs our server in a data centre in Germany. Cloudflare, Inc. sits in front of our server as network and DDoS protection and receives emails sent to addresses at chail.app on our behalf. Our emails to you (for example confirmations and sign-in codes) are sent through Resend (Plus Five Five, Inc.) from a data centre in Ireland; if Resend is unavailable, through our mailbox at IONOS. Cloudflare and Resend work for us under data processing agreements that include the EU standard contractual clauses. Nobody else receives your data. We do not sell data and we do not show ads.

6. 我们保存多久

从未确认的报名会在 30 天后删除。你一旦退出名单，你的记录就会被删除，最迟会在你加入 18 个月后删除。第 2 节所述的页面事件会在 30 天后删除。我们服务器备份中的副本会在 30 天内被覆盖。不含任何邮箱地址的统计数字（例如“120 人通过 Reddit 报名”）可能会被保留。

7. 你的权利

你可以要求访问、更正、删除、限制处理你的数据以及获取你的数据副本，也可以反对处理。你可以随时一键撤回同意：每封邮件里都有一个“退出名单”链接，点击后会立即删除你的记录。你也可以写信至 support@chail.app。此外，你有权向数据保护监管机构投诉。

8. The Chail app and your Chail account

Your emails stay on your device. The app connects your device directly to your email provider. Emails, contacts, attachments, notes and passwords never reach our server.

Your Chail account is your email address. Our server stores the address and any further addresses you connect, your plan and how long it runs, your devices (a code for each device, its system, app version and language, and when it was last used), and when you created the account. When you connect an address, we send one short note to it; the app finds this note in your mailbox and sends back only the code it contains, so we know the address is yours. Purpose: your plan on all your devices, signing in without a password, protection against misuse. Legal basis: Art. 6 (1)(b) GDPR. You can delete the account in the app at any time (Settings, Account); we then delete these data, except what we must keep by law (purchases, see section 10).

Gmail and your Google account. If you connect a Gmail address with “Continue with Google”, Google lets the Chail app on your device read, send, organise and delete your emails over IMAP and SMTP, and tells the app your email address. Chail uses this access only for what you see and do in the app: showing your emails as chats, searching them on your device, sending your messages, and archiving or deleting when you ask. Your emails and the access key stay on your device (the key is protected with the encryption of your Windows user account). Apart from the code in our own note (see above), nothing from your mailbox reaches our servers. Your emails are never sold, never used for advertising and never used to train AI models; they only leave your device when you send an email or when you connect another app to Chail yourself.

Chail’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can take back the access at any time: remove the address in Chail (Settings, Addresses), which also withdraws it at Google, or remove Chail in your Google Account under “Third-party apps and services”.

Outlook and your Microsoft account. With “Continue with Microsoft”, Microsoft lets the Chail app on your device read and send your emails over IMAP and SMTP in the same way, with the same rules: everything stays on your device. You can remove the address in Chail and withdraw the permission in your Microsoft account settings.

9. How the app is used

Unless you switch it off (Settings, Privacy, “Share how you use Chail”), the app tells our server which screens and buttons are used, the steps of setting up, that an email was sent (not to whom and not what), that a file was opened (only its type), errors, and when the window is in front. With it go a random code that exists only for this purpose and is never linked to your account or your addresses, the app version, system, language, plan, and the country derived from your connection. Never your emails, contacts, addresses, names, subjects, search words or file names. We store a hashed form of the code and no IP address, for 30 days. Purpose: to see what works and where people get stuck, so we can improve Chail. Legal basis: Art. 6 (1)(f) GDPR. You can switch it off at any time; the app then sends nothing more and deletes what is still waiting to be sent.

10. Buying a plan

Payments are handled by Stripe Payments Europe, Ltd. (Ireland). Stripe receives what you enter on its payment page (for example your email address, name, billing address and payment details) and processes it under its own privacy notice. We receive from Stripe your customer number, the plan, the amounts and dates of payments and refunds, and the payment status, never your full card or bank details. Purpose: to provide the plan you bought, invoices, refunds, cancellations and withdrawals. Legal basis: Art. 6 (1)(b) GDPR and, for keeping invoices and payment records (up to 10 years), Art. 6 (1)(c) GDPR together with German tax and commercial law.

Cancellation and withdrawal: when you use the pages “Cancel your plan” or “Withdraw from contract”, we store the address, the name you enter, the type of request and when it arrived, so we can carry it out and prove it. These records are deleted 90 days after they are completed, unless the law requires us to keep them longer.

11. Creating an account on the website

If you create your account on our website, we store your email address and send one email with a button to confirm it. Your account only exists once you confirm. We also note which button on our page led you there (for example “Download Chail”), without any link to your visits. Legal basis: Art. 6 (1)(b) GDPR.

Which button you see: to find out which button on our page helps people most, each visitor sees one of several buttons per day. Which one is derived from the daily code described in section 2. We only count how often each button was shown and clicked and what followed (download, account, purchase), without any code or address.

12. When you write to us

If you email one of our addresses (for example support@chail.app), we store your email, its attachments and our reply on our server so we can answer you and keep track of the conversation. Only the founders can read them, in a protected area with two-step sign-in. Legal basis: Art. 6 (1)(b) GDPR if it concerns your account or a contract, otherwise Art. 6 (1)(f) GDPR (answering requests). We delete these emails when the matter is settled, at the latest two years after the last message, unless the law requires us to keep them longer.