Version of 20 October 2026

Chail 的隱私權政策

This notice covers the Chail website at https://chail.app, the Chail app and buying a plan. Your emails are processed on your device and never on our servers.

1. 由誰負責

依 GDPR，控管者為營運者資訊中所列的服務提供者。聯絡方式：support@chail.app。

2. 造訪本網頁

本網頁不使用追蹤 Cookie、本機儲存空間，也不使用任何第三方指令碼。只有在你登入帳號時，兩個小 Cookie 才會讓你保持登入 30 天：一個保存你的工作階段，另一個只是讓網頁顯示「Account」。登出後兩個都會刪除。我們的伺服器會自行統計網頁瀏覽次數，記錄的內容為：瀏覽的網頁、來源網站（僅限網域）、連結中的行銷活動參數（utm_…）、我們的網路服務供應商依你的連線推斷出的國家，以及你使用的是手機還是電腦。

網頁的使用情形：本網頁開啟期間，會將網頁上發生的事告知我們的伺服器，也就是：點擊了哪些按鈕和連結、沒有點到任何東西的點擊、哪些區塊曾出現在螢幕上、網頁被往下閱讀到哪裡以及閱讀了多久、登記表單的各個步驟（例如欄位已被選取，或出現了哪一則錯誤訊息，但絕不包含你輸入的內容）、比較滑桿與常見問題的使用情形、指令碼錯誤，以及網頁的載入速度。我們的伺服器另外會加上你的瀏覽器在每次要求時本來就會傳送的作業系統、瀏覽器與語言資訊。除此之外，我們不會從你的裝置讀取任何資訊（不讀取螢幕大小、字型或設定），也不會在你的裝置上儲存任何東西。

區分不同造訪：伺服器會使用一組每天更換、且只存在於其工作記憶體中的金鑰，根據你的連線和瀏覽器產生一組代碼。這組代碼會與當天的事件一起儲存。由於金鑰在每天結束時都會被刪除，事後便無法再將代碼追溯到你的連線，而且代碼絕不會與你在候補名單上的登記資料連結。我們不會儲存你的 IP 位址。個別事件會在 30 天後刪除，之後只會保留不含任何代碼的每日總數。

如果你的瀏覽器傳送「Do Not Track」或「Global Privacy Control」訊號，以上內容都不會被統計或傳送。法律依據：GDPR 第 6 條第 1 項第 f 款（了解有多少人造訪、他們從哪裡來，以及網頁的哪些部分運作良好）。

3. 加入候補名單

我們儲存的資料：你的電子郵件地址；你登記與確認的時間；你的個人邀請碼，以及如果你是透過別人的連結而來，那個連結的邀請碼；你是如何找到我們的（連結中的行銷活動參數、以網域形式記錄的來源網站、你使用了哪個按鈕）；依你的連線推斷出的國家、你使用手機還是電腦、你的瀏覽器語言，以及你在加入前於網頁上停留的秒數。如果你選擇提供，也包括你會在哪種裝置上使用 Chail。我們不會儲存你的 IP 位址或姓名。

目的：管理候補名單（確認、你的排隊位置、邀請），在輪到你以及 Chail 推出時寄信通知你，並以彙總形式了解哪些管道讓人們來到 Chail。

雙重確認（double opt-in）：你輸入地址後，我們只會寄出一封附有按鈕的郵件。只有在你按下按鈕後，你才會被加入名單。在此之前，我們不會寄送任何其他郵件。

你會收到哪些郵件：確認信；如果你用同一個地址再次登記，會收到一則簡短通知；有朋友透過你的連結加入時，每天最多一則通知；以及之後的邀請和 Chail 推出的消息。我們的郵件不含追蹤像素，我們也不會追蹤你點擊了哪些連結。

邀請：當有人透過你的連結加入並完成確認，你在名單上的位置就會往前。你只會看到有多少人透過你加入，永遠不會看到是誰。你邀請的人也看不到任何關於你的資訊。

法律依據：郵件與名單依據你的同意（GDPR 第 6 條第 1 項第 a 款、UWG 第 7 條第 2 項第 2 款）；彙總統計與防止濫用依據 GDPR 第 6 條第 1 項第 f 款。

4. 防止濫用

為了阻止以程式大量自動登記，伺服器會在工作記憶體中短暫計算每個網路連線的要求次數，這些資料都不會被儲存。我們會拒絕拋棄式電子郵件網域，並檢查你的地址所屬的網域是否能夠收信（查詢的是網域，而不是你的信箱）。

5. 還有誰參與

IONOS SE runs our server in a data centre in Germany. Cloudflare, Inc. sits in front of our server as network and DDoS protection and receives emails sent to addresses at chail.app on our behalf. Our emails to you (for example confirmations and sign-in codes) are sent through Resend (Plus Five Five, Inc.) from a data centre in Ireland; if Resend is unavailable, through our mailbox at IONOS. Cloudflare and Resend work for us under data processing agreements that include the EU standard contractual clauses. Nobody else receives your data. We do not sell data and we do not show ads.

6. 保存期限

從未確認的登記資料會在 30 天後刪除。你一退出名單，你的登記資料就會立即刪除，最遲則在你加入後 18 個月刪除。第 2 節所述的網頁事件會在 30 天後刪除。我們伺服器備份中的副本會在 30 天內被覆寫。不含任何電子郵件地址的統計數字（例如「120 筆來自 Reddit 的登記」）可能會被保留。

7. 你的權利

你可以要求查閱、更正、刪除、限制處理你的資料，以及取得資料副本，也可以對資料的處理提出異議。你可以隨時一鍵撤回同意：每封郵件都附有「退出名單」連結，點擊後會立即刪除你的登記資料。你也可以寫信至 support@chail.app。此外，你有權向資料保護監管機關提出申訴。

8. The Chail app and your Chail account

Your emails stay on your device. The app connects your device directly to your email provider. Emails, contacts, attachments, notes and passwords never reach our server.

Your Chail account is your email address. Our server stores the address and any further addresses you connect, your plan and how long it runs, your devices (a code for each device, its system, app version and language, and when it was last used), and when you created the account. When you connect an address, we send one short note to it; the app finds this note in your mailbox and sends back only the code it contains, so we know the address is yours. Purpose: your plan on all your devices, signing in without a password, protection against misuse. Legal basis: Art. 6 (1)(b) GDPR. You can delete the account in the app at any time (Settings, Account); we then delete these data, except what we must keep by law (purchases, see section 10).

Gmail and your Google account. If you connect a Gmail address with “Continue with Google”, Google lets the Chail app on your device read, send, organise and delete your emails over IMAP and SMTP, and tells the app your email address. Chail uses this access only for what you see and do in the app: showing your emails as chats, searching them on your device, sending your messages, and archiving or deleting when you ask. Your emails and the access key stay on your device (the key is protected with the encryption of your Windows user account). Apart from the code in our own note (see above), nothing from your mailbox reaches our servers. Your emails are never sold, never used for advertising and never used to train AI models; they only leave your device when you send an email or when you connect another app to Chail yourself.

Chail’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can take back the access at any time: remove the address in Chail (Settings, Addresses), which also withdraws it at Google, or remove Chail in your Google Account under “Third-party apps and services”.

Outlook and your Microsoft account. With “Continue with Microsoft”, Microsoft lets the Chail app on your device read and send your emails over IMAP and SMTP in the same way, with the same rules: everything stays on your device. You can remove the address in Chail and withdraw the permission in your Microsoft account settings.

9. How the app is used

Unless you switch it off (Settings, Privacy, “Share how you use Chail”), the app tells our server which screens and buttons are used, the steps of setting up, that an email was sent (not to whom and not what), that a file was opened (only its type), errors, and when the window is in front. With it go a random code that exists only for this purpose and is never linked to your account or your addresses, the app version, system, language, plan, and the country derived from your connection. Never your emails, contacts, addresses, names, subjects, search words or file names. We store a hashed form of the code and no IP address, for 30 days. Purpose: to see what works and where people get stuck, so we can improve Chail. Legal basis: Art. 6 (1)(f) GDPR. You can switch it off at any time; the app then sends nothing more and deletes what is still waiting to be sent.

10. Buying a plan

Payments are handled by Stripe Payments Europe, Ltd. (Ireland). Stripe receives what you enter on its payment page (for example your email address, name, billing address and payment details) and processes it under its own privacy notice. We receive from Stripe your customer number, the plan, the amounts and dates of payments and refunds, and the payment status, never your full card or bank details. Purpose: to provide the plan you bought, invoices, refunds, cancellations and withdrawals. Legal basis: Art. 6 (1)(b) GDPR and, for keeping invoices and payment records (up to 10 years), Art. 6 (1)(c) GDPR together with German tax and commercial law.

Cancellation and withdrawal: when you use the pages “Cancel your plan” or “Withdraw from contract”, we store the address, the name you enter, the type of request and when it arrived, so we can carry it out and prove it. These records are deleted 90 days after they are completed, unless the law requires us to keep them longer.

11. Creating an account on the website

If you create your account on our website, we store your email address and send one email with a button to confirm it. Your account only exists once you confirm. We also note which button on our page led you there (for example “Download Chail”), without any link to your visits. Legal basis: Art. 6 (1)(b) GDPR.

Which button you see: to find out which button on our page helps people most, each visitor sees one of several buttons per day. Which one is derived from the daily code described in section 2. We only count how often each button was shown and clicked and what followed (download, account, purchase), without any code or address.

12. When you write to us

If you email one of our addresses (for example support@chail.app), we store your email, its attachments and our reply on our server so we can answer you and keep track of the conversation. Only the founders can read them, in a protected area with two-step sign-in. Legal basis: Art. 6 (1)(b) GDPR if it concerns your account or a contract, otherwise Art. 6 (1)(f) GDPR (answering requests). We delete these emails when the matter is settled, at the latest two years after the last message, unless the law requires us to keep them longer.