Privacy Policy

Effective 2 October 2026

Who we are

Chalkday is a habit tracker for iPhone. In this policy, “Chalkday”, “we” and “us” mean the people who make Chalkday and run its service. We decide what personal data Chalkday collects and why, so we’re responsible for it: the “data fiduciary” under India’s Digital Personal Data Protection Act, 2023, and the “controller” under the GDPR.

For anything about your privacy, including complaints, write to hello@chalkday.com.

Using Chalkday without an account

You don’t need an account to use Chalkday. If you choose “Not now” when it offers one, your habits, history and settings are saved only on your iPhone, and we never receive them. Friends, circles, cheers and nudges need an account, because they connect you with other people.

What we collect when you have an account

Your account

Your email address. If you sign in with Apple, Apple gives us an email address (your own, or a private relay address if you choose Hide My Email) and, the first time only, your name if you choose to share it. We use that name as your display name. If you sign in with email instead, you have no display name, and friends see you as “A friend”.

Sign-in records

Supabase, which runs our sign-in, keeps records of your sign-ins and sessions, such as their times, your IP address and the type of device or app, to keep your account secure.

Your habits

Each habit’s name, detail, colour and icon; how you complete it (check off, a count or minutes, with its target and unit); its schedule and time of day; the notes you add to it (the identity behind it, its two-minute version and its “After I” cue); its reminder time; its place in your list; and when it was archived or paused.

Your check-ins

For each habit and day: whether you kept it, did the two-minute version, rested or missed it, and your progress toward a count.

Friends and circles

Who you’re friends with; habits you keep together with a friend (shared streaks); circles you create or join, their names, and the habits you share into them; invite links you create, and who accepted them; cheers and nudges you send and receive; people you block; and a daily note of which friend’s nudge was pushed to you, so each friend can reach you at most once a day.

Push notifications

If you’re signed in and allow notifications, your iPhone’s push token, whether you accept nudges from friends, your quiet hours and your time zone. These let a friend’s nudge reach you, and never during your quiet hours.

Your Sign in with Apple token

If you sign in with Apple, we keep a token Apple gives us for your account. We use it for one thing only: when you delete your account, we send it back to Apple to revoke Chalkday’s access to your Apple ID.

Messages to us

If you email us or report someone, your email address and what you write. A report from the app includes the name and Chalkday ID of the person you’re reporting.

We don’t collect your location, contacts, photos, health data, advertising identifier or payment details.

What your friends can see

Your habits are private unless you share them. A friend sees a habit only when you keep it together with one of theirs through an invite, and the people in a circle see only the habits you share into that circle, with their check-ins. Friends and circle-mates also see your display name, and the cheers and nudges you send them. Nobody sees your email address.

When you remove a friend, your shared streaks and the cheers and nudges between you end. When you block someone, they can no longer invite, cheer or nudge you, and neither of you sees the other’s habits in a circle you’re both in. They aren’t told.

What stays on your iPhone

• Reminders. Your iPhone schedules habit reminders and the evening wrap-up itself. We don’t send them, and they work without an account. (A habit’s reminder time is saved with the habit, so it comes back on a new iPhone.)
• Settings. Appearance, haptics, sounds, when your day ends, which day your week starts, the wrap-up time, and the identities you picked when you started.
• Your Chalkday Plus status, as the App Store last reported it to the app.
• Exports. Your CSV export is made on your iPhone and goes only where you send it.

Signing out or deleting your account clears Chalkday’s copy of your account from that iPhone.

Purchases

Chalkday Plus is sold through the App Store, and Apple handles the payment: we never see your card or payment details. When you subscribe while signed in, the app attaches your Chalkday account ID (a random code, not your name or email) to the purchase, so the subscription can be matched to your account. The app asks the App Store on your iPhone whether Chalkday Plus is active. Apple’s Privacy Policy covers what Apple does with your purchase.

How we use your data, and why

• To give you the service you signed up for: signing in, backing up and syncing your habits, and friends, circles, cheers and nudges. (Under the GDPR, this is to perform our contract with you.)
• To keep Chalkday safe: securing accounts, enforcing blocks, and looking into reports of abuse. (Our legitimate interest in a safe service.)
• To help you when you write to us. (Our contract with you, or our legitimate interest in answering.)
• To meet legal obligations, when the law requires it.

Notifications only ever arrive with your permission, which you can take back in your iPhone’s Settings > Chalkday > Notifications. Under India’s DPDP Act, you consent to the uses above when you create an account, and you can withdraw that consent at any time by deleting your account, which is as easy as creating it.

We don’t use your data for advertising, we don’t build profiles of you, and we don’t sell or rent it to anyone.

No ads, no tracking, no analytics

Chalkday has no ads and no advertising or analytics code, and it doesn’t track you across other companies’ apps or websites. Apple gives app developers anonymous, aggregate App Store statistics, such as downloads, and crash reports from people who chose to share them with developers in their iPhone’s settings. None of this tells us who you are.

Who handles your data for us

We use a few service providers. Each is bound by its data processing terms with us to use your data only to provide its service to us, and to protect it at least as well as this policy describes.

Supabase

Stores your account and the data above, runs sign-in, and runs the small server functions that push nudges and delete accounts. Our project is hosted in Mumbai, India.

Resend

Sends the emails with your six-digit sign-in code, so it receives your email address and the code.

Apple

Sign in with Apple, App Store purchases, and push notifications. Apple’s push service delivers a friend’s nudge to your iPhone, including the friend’s name and the habit it’s about.

Cloudflare

Serves this website, chalkday.com, and forwards email sent to hello@chalkday.com to our inbox.

Our email provider

Stores the emails you send us, including reports.

Other than these providers, and the friends and circle-mates you choose to share with, we share your data only when the law requires it. If Chalkday is ever sold or merged, we’ll tell you before your data comes under a different privacy policy.

Where your data is stored

Your account and habits are stored in India, with Supabase in Mumbai. Resend is based in the United States, Apple, Cloudflare and our email provider work around the world, so some data (like your email address for a sign-in code) passes through other countries. Where the GDPR applies, these transfers rely on safeguards such as the European Commission’s Standard Contractual Clauses in our providers’ data processing terms.

How long we keep it

• Your account, habits, check-ins and friends are kept until you delete them or your account.
• Invite links stop working after 14 days, or once used, and stay in your account as a record until you delete your account.
• A push token is removed when you sign out on that iPhone (signing out needs a connection, so the token is always removed first), when Apple tells us it no longer works, or when you delete your account.
• Nudge records: to let each friend nudge you at most once a day, we note who nudged whom on which day. These notes are deleted after a day.
• Your Sign in with Apple token is kept only while you have an account, and is revoked at Apple and deleted when you delete it.
• Backups: Supabase keeps daily backups of our database for a limited time (currently 7 days), so something deleted is gone from backups within about a week.
• Technical logs kept by Supabase and Cloudflare, which can include IP addresses, are deleted on the providers’ own short schedules.
• Emails to us, including reports, are kept only as long as we need them to help you or deal with the report.

Deleting your account

In Chalkday, go to You > Settings (the gear at the top) > Delete account. This deletes your account and everything in it from our servers straight away: your profile, habits, check-ins, friendships, shared streaks, circle memberships, cheers and nudges sent or received, blocks, invites, push tokens and Sign in with Apple token. Circles you created are deleted for everyone in them. Invites you accepted stay in the inviter’s account as used, with no link to you. Chalkday’s data is also cleared from that iPhone.

If you signed in with Apple, we revoke Chalkday’s access to your Apple ID first. If Apple can’t be reached, the app tells you how to finish yourself: open the Settings app, tap your name and go to Sign in with Apple, then choose Chalkday and tap Delete.

Deleting your account doesn’t cancel Chalkday Plus. Cancel it with Apple first (see Support).

Can’t open the app? Email hello@chalkday.com from the address on your account, and we’ll delete it for you.

Exporting your data

Go to You > Settings > Export your data for a CSV file of the days you’ve logged in roughly the last 13 months (the app keeps about 400 days of history): the date, the habit and how it went, archived habits included. For a complete copy of everything we hold about you, email us.

Your rights

Wherever you live, you can ask us what personal data we hold about you, get a copy, have it corrected or deleted, and stop us using it. Much of this you can do yourself in the app.

In India

Under the Digital Personal Data Protection Act, 2023, you have the right to:

• a summary of the personal data we process about you and what we do with it, and to know who we’ve shared it with;
• have your data corrected, completed, updated or erased;
• withdraw your consent at any time (deleting your account does this);
• have your complaints answered by us; and
• nominate someone to use these rights for you if you die or can’t use them yourself.

If you’re not satisfied with how we answer a complaint, you can complain to the Data Protection Board of India.

In the European Economic Area, the UK and Switzerland

Under the GDPR (and the UK GDPR), you have the right to access your data, have it corrected or erased, restrict or object to how we use it, receive it in a portable format, and withdraw consent at any time. You can also complain to your local data protection authority.

How to ask

Email hello@chalkday.com, from the address on your account if you can. We may ask you to confirm it’s you before acting. We’ll reply within 30 days, and it’s free.

Security

Your data travels encrypted, and Supabase encrypts our database at rest. The database checks every request, so each person can read only what they’re allowed to: their own data, and what friends chose to share with them. Some data, like Sign in with Apple tokens, can’t be read from the app at all. No system is perfectly secure, but if a breach ever affects your data, we’ll tell you and the authorities as the law requires.

Children

Chalkday isn’t directed at children under 13, and we don’t knowingly collect personal data from them. If you’re under 18, please create an account only with a parent’s or guardian’s permission. If you believe a child under 13 has given us personal data, email us and we’ll delete it.

This website

This website has no cookies, no analytics and no scripts. Cloudflare serves it and, like any web host, handles your IP address to deliver the pages. The pages use the Nunito font from Google Fonts, so Google receives your IP address and browser details when you open them, under Google’s Privacy Policy.

Changes to this policy

If we change this policy, we’ll update the date at the top. If a change matters, we’ll tell you in the app or by email before it takes effect.

Contact

Questions, requests or complaints about your privacy: hello@chalkday.com.