Privacy Policy

1. Data controller

The data controller responsible for your personal data is Checkbloom LLC. You can contact us at privacy@checkbloom.app for any privacy-related question or to exercise your rights.

2. Personal data we collect

2.1 Data you provide directly

• Account data: email address, display name, password hash.
• Household content: checklists, list items, shopping items, routines, annual calendar entries, notes and any other content you enter.
• Household composition: names or nicknames of household members you invite or add.
• Optional profile data: hemisphere, home type, life events, stress level and other onboarding answers.
• Support and correspondence: emails and messages you send us.

2.2 Data collected automatically

• Technical data: IP address, browser type, device type, operating system, language, and timestamps.
• Usage data: pages visited, features used, errors encountered.
• Cookies and similar technologies strictly necessary to keep you signed in and to remember your preferences.

2.3 Data from third parties

• Payment metadata from our payment processors (Paddle, RevenueCat) such as subscription status, plan and country. We never receive your full card number.
• Authentication data from social sign-in providers if you use them (e.g. name and email from Google).

3. How and why we use your data

We process your personal data for the following purposes:

• Provide the service — create your account, sync your lists across devices, share content with household members.
• Improve the service — analyse aggregate usage and errors to fix bugs and prioritise improvements.
• Communicate — send transactional emails (invites, receipts, security alerts) and, only with your consent, product updates.
• Billing — process subscription payments, prevent fraud, comply with tax obligations.
• Legal compliance — meet our obligations under applicable law and respond to lawful requests.

4. Legal bases (GDPR)

• Contract (Art. 6(1)(b)) — to provide the service you signed up for.
• Legitimate interests (Art. 6(1)(f)) — to secure the service, prevent abuse, and improve product quality. You may object at any time.
• Consent (Art. 6(1)(a)) — for optional marketing emails and non-essential cookies. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — to comply with accounting, tax and law-enforcement obligations.

5. How we share your data

We never sell your personal data. We share it only with the following categories of recipients, strictly for the purposes above:

• Hosting & database — Supabase (EU region) and Cloudflare (global edge network).
• Email delivery — Resend, for transactional email.
• Payments — Paddle and RevenueCat, for subscription management and tax handling.
• Analytics — privacy-respecting product analytics for aggregate usage only; no advertising networks.

All processors are bound by written data processing agreements and only process data on our instructions.

6. International transfers

Where personal data is transferred outside the European Economic Area or the UK, we rely on the European Commission's Standard Contractual Clauses (SCCs) or an adequacy decision. You may request a copy of the safeguards in place by emailing privacy@checkbloom.app.

7. Retention

• Account and household content: kept while your account is active.
• After account deletion: fully purged from our systems within 30 days, except where longer retention is required by law (e.g. invoices for up to 10 years).
• Backups: rotated within 35 days.
• Anonymised aggregate statistics may be retained indefinitely.

8. Your rights

Depending on where you live, you have the following rights over your personal data:

• Access — obtain a copy of the data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — delete your account and associated data.
• Restriction — limit how we process your data.
• Portability — export your data in a machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on your consent.
• Lodge a complaint with your local supervisory authority (e.g. your national Data Protection Authority in the EU, or the ICO in the UK).

You can exercise most of these rights directly in Settings → Data & privacy (export, delete). For anything else, email privacy@checkbloom.app. We respond within 30 days.

9. California residents (CCPA/CPRA)

California residents have the right to know what personal information we collect, to request deletion, to correct inaccurate information, and to opt out of the "sale" or "sharing" of personal information. Checkbloom does not sell or share personal information as defined by the CCPA. To exercise your rights, email privacy@checkbloom.app. We will not discriminate against you for exercising these rights.

10. Children

Checkbloom is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Security

We use industry-standard measures to protect your data, including encryption in transit (TLS 1.2+), encryption at rest, row-level security in our database, hashed passwords, and regular security audits. No system is 100% secure, but we work hard to keep yours safe.

12. Cookies

We use only strictly necessary cookies to keep you signed in and to remember your preferences. We do not use advertising cookies or third-party tracking cookies. Where required by law, we ask for your consent before using non-essential cookies.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through the app at least 30 days before they take effect. The "Last updated" date at the top of this page always reflects the current version.

14. Contact

For any privacy question, request or complaint, contact us at privacy@checkbloom.app. You may also write to Checkbloom LLC at the postal address listed on our Support page.