Privacy Policy

Last updated: 22 August 2026. This policy covers the Chit app, the chitter device service, and this website (chit.ink). Datenschutz-Anfragen gerne auch auf Deutsch.

Who is responsible

The data controller is Robin Goudeketting, Sagedergasse 21A/1/5, 1120 Vienna, Austria — privacy@chit.ink (see the Impressum).

What Chit does with your data

Chit exists to move a short note from one person's phone to another person's printer. We collect only what that requires, and we designed the system to forget message content as soon as it has done its job.

Data we process

• Account: when you sign in with Google, we receive and store your name, email address, and Google account identifier. We use them to operate your account. We never see your Google password.
• Messages ("chits"): the text you send is transmitted over an encrypted connection and stored only until the recipient's chitter confirms it has printed. After printing, the message body is deleted from our servers. We keep only delivery metadata (who sent to whom, when, and a receipt number) so both sides have a history.
• Contacts and groups: names, notes, and groups you yourself enter in the app to organize the people you chit with. We do not read or upload your phone's address book.
• Devices: technical details of chitters you own (identifier, name, online status) to route messages to them.
• Push notifications: if you enable them, a push token issued by Google (Firebase Cloud Messaging) so we can notify you, e.g. when you receive a chit. You can switch each notification type off in Settings.
• Abuse reports: if you report a sender to us (by email), we store the report to act on it.
• Server logs: IP address and technical request data, kept briefly for security and troubleshooting.
• Waitlist: if you join the waitlist on this website, we store your email address in Brevo (our EU-based email provider) and use it only to write to you about Chit. Every mail has an unsubscribe link, and you can ask us to remove you at any time.

What we don't do

• No advertising, no ad tracking, no analytics profiles.
• No sale or sharing of your data for others' purposes.
• No reading of your phone contacts, photos, or location.

Legal bases (GDPR)

We process account and message data to provide the service you signed up for (Art. 6(1)(b) GDPR), logs and abuse handling in our legitimate interest of running a safe service (Art. 6(1)(f)), and push notifications based on your consent (Art. 6(1)(a)), which you can withdraw anytime in Settings.

Where your data lives

Our servers run on Railway with data stored in the EU. Sign-in is provided by Google, and push notifications are delivered via Google Firebase; both may process limited data (such as your push token) under their own terms. Waitlist emails are stored with Brevo (Sendinblue GmbH / Brevo SAS, France), which processes them in the EU on our behalf.

How long we keep things

• Message bodies: until printed, then deleted.
• Delivery metadata and your account data: as long as your account exists.
• Server logs: a short rolling window.

Your rights

Under the GDPR you can request access to, correction of, deletion of, or a copy of your data, and you can object to or restrict certain processing. Write to privacy@chit.ink — for account deletion, see chit.ink/delete-account. You may also lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde, dsb.gv.at).

Changes

Chit is in an early testing phase; we'll update this policy as the product evolves and note the date at the top.