Our Privacy Promise

Data controller

Checkbloom LLC is the data controller responsible for the personal data processed through Checkbloom. References to "we", "us", and "our" in this policy mean Checkbloom LLC.

What we collect

• Account information — your email address and the name you choose to display, used to create and secure your account.
• Household and list content — the checklists, items, notes, and household settings you create inside the app.
• Usage analytics — anonymised product analytics via PostHog with IP anonymisation enabled, used to understand which features are useful.
• Payment data — handled entirely by Paddle, our merchant of record. We do not see or store your card details.

Legal basis for processing

We rely on the following grounds under Article 6 of the UK and EU GDPR:

• Consent (Art. 6(1)(a)) — when you create an account and agree to these terms.
• Performance of a contract (Art. 6(1)(b)) — to provide the Checkbloom service you subscribed to, including syncing your lists across devices.
• Legitimate interests (Art. 6(1)(f)) — to keep the service secure, prevent fraud and abuse, and improve product quality.

Who we share data with

We share the minimum data necessary with a small number of vetted processors:

• Paddle — our payment processor and merchant of record. Paddle handles checkout, billing, tax, invoicing, and refunds.
• Supabase — our database and authentication host (United States).
• PostHog — anonymised product analytics with IP anonymisation.
• Sentry — error tracking. Errors never contain personal list content.
• Resend — transactional email (account confirmation, password reset, billing receipts).

We do not sell your data, share it with advertisers, or use it to train AI models — ever. See the promises above.

Your rights

Under GDPR and similar laws (including CCPA) you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — delete your account and all associated data.
• Restriction of processing — limit how we use your data.
• Data portability — export your data in JSON or CSV format.
• Objection — object to processing based on legitimate interests.

To exercise any of these rights, email privacy@checkbloom.app. We respond within 30 days, and usually within 48 hours.

Data retention

While your account is active, we keep your account information and household content for as long as needed to provide the service to you. Anonymised analytics may be kept longer for trend analysis.

When you delete your account, your personal data and household content are purged from our production systems and backups within 30 days. Nothing is archived or anonymised in place — it is fully deleted.