Privacy policy
Last updated: 21 October 2026 · Versione italiana (the Italian version prevails in case of discrepancies)
This policy explains which personal data the Chisly app (Android and iOS) processes, why, for how long, and what rights you have under Regulation (EU) 2016/679 ("GDPR").
- We use your data only to run the app: wishlists, friends, groups and gifts.
- No ads, no profiling, no selling of data, no analytics or tracking tools.
- Data is stored on servers in the European Union.
- You can delete your account from the app at any time, and your data is deleted.
1. Data controller
Vanessa Larivei, Torino, Italy.
Privacy contact: vanessalarivei.studio@gmail.com
2. Data we process
| Category | Data | Source |
|---|---|---|
| Account | Email address, password (stored only in encrypted form, unreadable to us), username | You, at sign-up |
| Profile | First name, last name, date of birth, bio, profile photo, all optional | You |
| Friends | Friend requests sent and received, accepted friendships, blocked users | You and other users |
| Wishlist | Wishes with title, description, link, price, visibility (private or friends) | You |
| Notes | Gift ideas you write down for a friend (visible only to you) | You |
| Groups | Groups you create or join, join requests, gift proposals, reservations, votes, comments | You and other members |
| Technical data | IP address, date and time of access, device type and app version, recorded in server logs | Collected automatically when you use the app |
We do not process payment data, location, address book contacts or special categories of data (health, political opinions, etc.). Please do not enter them in free-text fields.
3. Purposes and legal bases
- Providing the service (creating your account, showing your wishlist to your friends, running groups, proposals, reservations and votes, sending sign-up confirmation and password recovery emails). Legal basis: performance of the contract, i.e. the Terms of use you accept when signing up (Art. 6(1)(b) GDPR).
- Security: preventing abuse and unauthorised access, investigating malfunctions through technical logs. Legal basis: our legitimate interest in keeping the app secure (Art. 6(1)(f) GDPR).
- Legal obligations, if required by an authority. Legal basis: Art. 6(1)(c) GDPR.
We do not make automated decisions that produce legal effects on you.
4. Who sees your data in the app
- All registered users can find you by username and see your username and profile photo.
- Your friends (accepted friendship) also see your name, birthday, bio and the wishes you made visible to friends.
- Members of your groups see your username and photo, the proposals you make and, depending on group settings, who proposed or reserved a gift and the votes once voting has closed.
- The person receiving a gift never sees the proposals, reservations, comments and votes about them.
- Notes about your friends and private wishes are visible only to you.
5. Data about other people
When you write a note or propose a gift for someone, you enter information about another person. Please enter only what helps choose a gift and do not write sensitive or offensive information. Notes remain visible only to you.
6. Service providers
We use a few providers, appointed as data processors under an agreement that obliges them to protect the data (Art. 28 GDPR):
| Provider | Service | Location |
|---|---|---|
| Supabase Inc. | Database, authentication, profile photo storage | Servers in the EU (Frankfurt, Germany) |
| Sendinblue SAS (Brevo) | Sign-up confirmation and password recovery emails | European Union (France) |
Supabase is a US-based company. Data is stored in the EU, but access by the provider from the United States (for example for technical support) cannot be fully excluded. Any such transfer is protected by the Standard Contractual Clauses approved by the European Commission and, where applicable, by the EU-US Data Privacy Framework.
We do not sell or share your data with anyone else. We may disclose it to authorities only where required by law.
7. Retention
- Account data and content: while your account is active. When you delete it, it is removed from the database immediately. Any technical backups are overwritten within 30 days.
- Technical logs: for the short period set by our providers, normally no more than 30 days.
- Emails sent by the app: sending records are kept by Brevo for the period set by its service.
If you delete your account, groups you owned pass to the longest-standing member. Proposals, reservations, votes and comments you created are deleted.
8. Your rights
You can ask at any time to access, rectify or erase your data, restrict its processing, receive it in a portable format, and object to processing based on legitimate interest (Arts. 15-21 GDPR). Much of this you can do directly in the app: edit your profile, delete wishes and notes, delete your account.
For anything else, write to vanessalarivei.studio@gmail.com. We reply within 30 days.
You also have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) or with the authority of the EU country where you live.
9. Minimum age
Chisly is only for people aged 16 or over. If we learn that an account belongs to someone younger, we delete it.
10. Security
Communication between the app and the servers is encrypted (HTTPS). Access to data is governed by database rules that let each person see only what they are entitled to, and we regularly verify these rules with security tests. No system is 100% secure: in the event of a data breach likely to put your rights at risk, we will inform you as required by the GDPR.
11. Cookies and tracking
The app uses no cookies, advertising, tracking or analytics tools. This website is hosted on GitHub Pages, which may log visitors' IP addresses for security purposes; the site sets no cookies of its own.
12. Changes
If we change this policy in a significant way (for example adding a new provider or a new use of data), we will let you know in the app before the changes take effect. The date at the top shows the latest version.