Privacy Policy

Effective Date: February 5, 2026

Last Updated: February 7, 2026

---

The Chronicle team ("we," "us," or "our") operates the Chronicle mobile application and website at usechronicle.app (collectively, the "Service"). This Privacy Policy describes how we collect, use, disclose, and protect your information when you use our Service.

By using Chronicle, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the Service.

---

1. Information We Collect

1.1 Information You Provide

• Account Information. When you create an account, we collect your phone number (required for verification), and optionally your email address, username, display name, bio, and profile photo.

• User-Generated Content. We collect content you create, including ranked lists (collections), journal entries (experiences), notes, captions, comments, and likes.

• Photos. When you upload photos, we collect the image files you provide. We may extract metadata such as the date taken, location (GPS coordinates), and camera information from the image file to help auto-populate experience details. Photo location data (GPS coordinates) is stored on our servers for this purpose but is never shared with other users or made publicly visible.

• Custom Items. If you create custom items (e.g., a restaurant not in our database), we collect the name, description, and optional location information you provide.

• Social Interactions. We collect information about your social activity, including who you follow, who follows you, users you block, users you tag as companions on experiences, and your interactions with others' content (likes, comments).

• Reports. If you report content or users, we collect the report reason and any details you provide.

1.2 Information Collected Automatically

• Device and Session Information. When you log in, we collect your device name, operating system, and IP address. We store session metadata such as when you last used the Service.

• Usage Information. We may collect information about how you interact with the Service, including features used, actions taken, and performance data. We may use third-party analytics and error-reporting tools to help us understand usage patterns, diagnose technical issues, and improve the Service.

• Log Data. Our servers automatically record information when you access the Service, including your IP address, request timestamps, and request identifiers.

• Browser Storage. When you use the Service through a web browser, we use local storage and session storage technologies to manage your login session and temporary application state. These are used solely for functional purposes and are not used for tracking.

• Push Notification Tokens. If you enable push notifications, we collect your device's push notification token to deliver notifications to your device. This token is a unique identifier assigned by your device's platform push notification service (e.g., Apple Push Notification service) and is stored on our servers for as long as notifications are enabled or your account is active.

1.3 Information from Third-Party Sources

• Item Metadata. When you search for items to add to your collections (e.g., restaurants, books, movies), we retrieve metadata about those items from third-party providers such as Google Places, TMDB, and Spotify, among others. These searches are performed server-side; your identity is not shared with these providers.

1.4 Location Information

• Device Location. With your permission, the Chronicle mobile app may access your device's location to suggest nearby places. You can revoke location permission at any time through your device settings.

• Photo Location Metadata. If your photos contain embedded location data (GPS coordinates from your camera), we may extract and store location data and other photo metadata (such as date taken and camera information) on our servers to help auto-populate experience details. This location data is used solely for your benefit and is never shared with other users or made publicly visible.

• User-Provided Locations. If you manually enter location information for custom items or experiences, we store that information as you provided it.

---

2. How We Use Your Information

We use the information we collect to:

• Provide and maintain the Service, including account authentication, content storage, and social features.
• Process and display your rankings and journal entries.
• Generate anonymous, aggregate global rankings from users' Official Collection rankings. Individual user identities are never exposed in global rankings.
• Facilitate social features, including activity feeds, follow relationships, comments, likes, and notifications.
• Send you transactional communications, such as verification codes, account notifications, and push notifications related to your activity on the Service.
• Monitor and improve the Service, including analyzing usage patterns, diagnosing errors, and improving performance and reliability.
• Enforce our terms and policies, including content moderation, fraud prevention, and abuse detection.
• Respond to your requests, including customer support and bug reports.

We do not use your information for advertising, and we do not sell your personal information.

---

3. How We Share Your Information

We do not sell, rent, or trade your personal information. We may share your information in the following circumstances:

3.1 With Other Users

• Public Content. Content you set to "public" visibility (such as lists, experiences, or profile information) may be visible to other Chronicle users. Your default profile visibility is private.
• Followers. Content you set to "followers" visibility is visible to users you have approved as followers.
• Global Rankings. If you rank items in Official Collections, your rankings contribute anonymously to aggregate global rankings. Your identity is never associated with global ranking data displayed to other users.
• Companion Tags. If another user tags you as a companion on an experience, that association may be visible to users who can view the experience.

3.2 With Service Providers

We use third-party service providers to help operate the Service. These providers have access to your information only as necessary to perform their functions and are obligated to protect it. Our service providers include:

• Twilio (or similar provider) — for SMS-based phone number verification (receives your phone number).
• Amazon Web Services (AWS) (or similar provider) — for media file storage (hosts your uploaded photos and images).
• Infrastructure Providers — for hosting, database management, and caching services.
• Analytics and Error-Reporting Providers — we may use third-party tools to monitor application performance, track errors, and analyze usage patterns. These tools may receive technical data such as device information, crash reports, and anonymized usage data.
• Item Data Providers — we query third-party APIs (such as Google Places, TMDB, Spotify, and others) to retrieve item metadata. Only search queries are sent to these providers; your identity and personal information are not shared.

3.3 For Legal Reasons

We may disclose your information if required to do so by law or in the good-faith belief that such action is necessary to:

• Comply with a legal obligation, subpoena, or court order.
• Protect and defend our rights or property.
• Prevent or investigate possible wrongdoing in connection with the Service.
• Protect the personal safety of users or the public.

3.4 Business Transfers

If the Service is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change via an in-app notice.

3.5 Authorized Personnel

Our authorized team members may access user information (including phone numbers, email addresses, and content) for the purposes of customer support, content moderation, bug investigation, and enforcing our terms. Access is limited to what is necessary for these purposes, and all actions are logged.

---

4. Data Retention

• Active Accounts. We retain your information for as long as your account is active and as needed to provide the Service.
• Deleted Accounts. When you delete your account, we initiate a soft-delete period of 30 days during which your data is retained but not publicly visible. You may reactivate your account during this period. After 30 days, your data is permanently deleted from our active systems, including your contributions to global rankings.
• Backups. Deleted data may persist in encrypted backups for up to 90 days consistent with our backup retention schedule, after which it is permanently removed.
• Moderation Records. Reports, moderation actions, and related logs may be retained beyond account deletion for safety and compliance purposes.

---

5. Data Security

We implement reasonable administrative, technical, and physical safeguards to protect your information, including:

• Encryption of data in transit (TLS).
• Encryption of data at rest for databases and media storage.
• Hashed storage of authentication credentials (verification codes and tokens are never stored in plaintext).
• Rate limiting on authentication and API endpoints.
• Access controls that restrict data access to authorized personnel.

No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee its absolute security.

Data Breach Notification. In the event of a confirmed data breach that compromises your personal information, we will notify affected users without unreasonable delay via in-app notification, email (if you have provided an email address), or other available contact methods. We will also notify any applicable regulatory authorities as required by law.

---

6. Your Rights and Choices

6.1 Account and Profile

• Visibility Controls. You can set your profile to public or private, and control the visibility of individual lists, experiences, and photos (public, followers-only, or private).
• Edit or Delete Content. You can edit or delete your lists, experiences, photos, comments, and other content at any time.
• Account Deletion. You can delete your account from within the app. See Section 4 for details on our deletion process.

6.2 Device Permissions

• Location. You can grant or revoke location access through your device settings at any time.
• Photos. You can grant or revoke photo library access through your device settings at any time.
• Camera. You can grant or revoke camera access through your device settings at any time.
• Push Notifications. You can enable or disable push notifications through your device settings at any time.

6.3 Sessions

• You can view and revoke active login sessions from within the app, including logging out individual devices.

6.4 California Residents

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including:

• Right to Know. You may request that we disclose the categories and specific pieces of personal information we have collected about you.
• Right to Delete. You may request that we delete your personal information, subject to certain exceptions.
• Right to Non-Discrimination. We will not discriminate against you for exercising your privacy rights.
• No Sale of Personal Information. We do not sell your personal information and have not done so in the preceding 12 months.

To exercise these rights, contact us using the information in Section 11.

---

7. International Data Transfers

The Service is operated in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using the Service, you consent to the transfer of your information to the United States.

---

8. Children's Privacy

The Service is not intended for anyone under the age of 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will take steps to delete that information promptly. If you believe a child under 16 has provided us with personal information, please contact us using the information in Section 11.

---

9. Third-Party Links and Services

The Service may contain links to or display content from third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party services you interact with.

---

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through an in-app notice and update the "Last Updated" date at the top of this policy. Your continued use of the Service after such changes constitutes your acceptance of the updated policy.

---

11. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, you can reach us at:

Chronicle Email: usechronicle@gmail.com Website: usechronicle.app

---

12. Summary of Data Practices

The following table summarizes the key data we collect and how it is used: