Privacy Policy

This policy describes how ChunkSquad collects, uses, and shares information about you when you use the Service.

We collect the following categories of information:

• Account info — email, username, password hash (or OAuth provider id for Google / Discord sign-ins), and profile metadata (bio, avatar URL) you choose to provide.
• Content you submit — projects, boards, markers, tasks, resources, comments, forum posts, attachments, and any other content you upload or post.
• Usage data — pages visited, actions taken, IP address, browser user-agent, and timestamps. Used for security (rate limiting, abuse detection) and analytics.
• Cookies — a session cookie to keep you signed in, a theme preference cookie, and (during private preview) a gatekeeper cookie. We do not use third-party advertising cookies.

• To provide and operate the Service (sign-in, hosting your content, sending notifications).
• To moderate the Service (responding to reports, removing abuse).
• To improve the Service (aggregate analytics, error monitoring).
• To communicate with you about important account or product changes.
• To comply with legal obligations.

We share information only with service providers necessary to operate ChunkSquad and with parties you direct us to (e.g. Discord when you connect a webhook). Current service providers include:

• Supabase — database and authentication hosting.
• Vercel — web hosting and CDN.
• Cloudflare — image storage (R2) and bot challenge (Turnstile).
• Google and Discord — sign-in providers, only if you choose to use them.

We do not sell your personal data. We may disclose information when required by law or to protect the safety of users.

Your content stays available until you delete it or close your account. Closing your account permanently removes your profile, your markers, tasks, comments, and forum posts, and every team you own together with all builds inside those teams. Backups may retain data for up to 30 days for disaster recovery before being purged. Images you uploaded may persist on our media CDN after deletion; contact us if you need them removed immediately.

You can delete your account at any time from account settings.

Under the California Consumer Privacy Act (CCPA), California residents have the right to know what personal information we collect, request deletion of personal information, and opt out of sale (we do not sell personal information). To exercise these rights, email privacy@chunksquad.com.

If you're located in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and equivalent UK/Swiss law give you the following rights in relation to your personal data:

• Right to access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure("right to be forgotten") — request deletion of your account and personal data. You can do this immediately from account settings → Delete account, or email us to handle it manually.
• Right to restrict processing — ask us to temporarily stop processing your data while we investigate a dispute.
• Right to data portability— request your data in a structured, commonly-used, machine-readable format. Email us and we'll export your account contents as JSON.
• Right to objectto processing based on our legitimate interests, including processing for direct marketing (we don't currently do direct marketing).
• Right to withdraw consentfor any processing that relies on consent. Withdrawal doesn't affect processing that already occurred.
• Right to lodge a complaintwith your local supervisory authority if you believe we've mishandled your data.

To exercise any of these rights, email privacy@chunksquad.com. We'll respond within 30 days (often much sooner).

Legal basis for processing. We process your data under three lawful bases under GDPR Article 6:

• Contract performance — the data necessary to create your account, host your content, and deliver the Service you signed up for.
• Legitimate interests — security logs, abuse detection, basic analytics for keeping the Service running and improving it. You can object to this at any time.
• Consent— for any future non-essential processing (we don't currently rely on consent for anything because we don't use non-essential cookies).

International transfers. ChunkSquad is operated from the United States. When you access the Service from the EEA or UK, your data is transferred to the US. We rely on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses (where applicable) for our hosting partners (Vercel, Supabase, Cloudflare, AWS).

Data Protection Officer.We don't have a formally designated DPO (we're below the size where Article 37 mandates one). All privacy inquiries go to privacy@chunksquad.com.

Residents of Virginia, Colorado, Connecticut, Utah, and other US states with comprehensive privacy laws have substantially similar rights to those described above (access, deletion, correction, and opt-outs from sale/sharing). We don't sell or share personal data for advertising. To exercise any state-law rights, email privacy@chunksquad.com.

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us.

ChunkSquad operates from the United States. If you access the Service from outside the US, your data will be transferred to and processed in the US. By using the Service, you consent to this transfer.

We use industry-standard measures (HTTPS, password hashing, RLS at the database layer, signed upload URLs, rate limiting) to protect your data. No system is perfect; if you believe your account has been compromised, contact security@chunksquad.com.

We may update this policy. Material changes will be communicated in-app or by email. The "Effective" date above is updated on each revision.

Questions about this policy? privacy@chunksquad.com