Privacy Policy

Who operates Chappie

Chappie is operated by Mitissa, LLC, based in the United States. This policy covers our apps, website and support. Features, payment methods and collection differ by platform and app version. The Android service is for adults 18 and over.

Content sent to AI services

Our servers and AI services process messages, relevant conversation history, attachments, images, audio and tool results needed for your chosen feature. Depending on selection or automatic routing, providers include Anthropic, OpenAI, Google and xAI. Compare sends the same input to multiple providers. Titles, summaries, images, speech and supporting tasks may use a different provider from the conversation model you selected.

Google's embedding service converts text into numerical representations to find relevant parts of long conversations. Text you pause on while typing may be processed this way before you send it to improve response speed; this does not save draft text in chat history. Temporary embedding caches expire within 14 days. Vectors stored with history are deleted with the corresponding chat.

For accounts using Memory, saved facts, communication preferences and relevant excerpts from your own other chats may be included in the context used to answer you. You can turn Memory off and inspect or delete saved facts in its settings. Free-message turns do not retrieve excerpts from other chats.

For a nearby search, Chappie uses foreground location only with your permission and for the relevant request. Latitude and longitude are rounded to 0.001 degrees (about 100 metres), which can still reveal precise location. Chappie and Google Maps process the rounded coordinates and search query; the AI receives the place information needed to answer. You can decline location access and type an area instead. We do not track location in the background. Search, speech and attachments are also processed by the services needed for those features.

We do not normally add payment-card details or sign-in credentials to AI inputs. Personal information you put in messages or attachments is processed as part of that input. Provider terms, retention rules and regional availability also apply. Take care when entering confidential information.

Accounts, content and purchases

We process a guest identifier or supported Apple, Google or LINE sign-in identifier, and any email, name or profile picture provided. Sessions support history sync and access control. Revocation credentials obtained through Apple browser sign-in are stored encrypted and removed on account deletion.

We store messages, AI replies, model selections, timestamps, files, generated images, Memory and bot settings. Request identifiers support reconnection and prevent duplicate work. We do not use conversation content to target advertising.

Apple, Google Play or supported Stripe web checkout processes payments. We and RevenueCat process products, subscriber and purchase/order/transaction identifiers, store, renewals, entitlements, usage, cancellation and refund status. We do not receive your in-app purchase card number. Stripe handles payment details for web checkout.

For Apple refund reviews, we or RevenueCat may provide Apple with purchase delivery, consumption, subscription status and refund preferences. For Google Play chargeback reviews, our server may send Google the order identifier, our refund preference and timestamps with general descriptions of completed paid usage. These Google usage descriptions exclude conversation content, names, email, IP addresses and location. Contact support to withdraw this sharing. Cancellation and refund procedures depend on where you purchased.

Security, free allowances and notifications

We use Firebase App Check, Play Integrity on Android, Apple DeviceCheck and related protections to check authenticity and prevent abuse. This can involve package, signing and version information, licensing and device-integrity verdicts, short-lived challenges and IP addresses. New Android free allowances require strict verification; existing allowances and paid access are managed separately.

To prevent repeated Android free allowances, we retain keyed hashes of the Android app/device-user identifier and installation billing-principal identifier. We do not store the raw Android ID or join these proofs to advertising identifiers or advertising measurement. The hashes are still device identifiers, not anonymous data. Ordinary reinstallation or account deletion does not grant another allowance; resets, new device users and compromised clients have known limits.

New Android allowances are limited to three new device claims per IP address per UTC day and 1,000 worldwide per day. These are admission limits, not a cap on daily consumption or expense. Verification attempts have separate short-term limits.

If you allow notifications, we use push tokens, account ownership, language, timezone and supported capabilities to send through APNs or Firebase Cloud Messaging. Notifications may show content on your lock screen. You can control them in OS and app settings. Token-ownership fingerprints preventing delivery to the wrong person after logout are retained for up to 60 days.

Analytics, diagnostics and advertising choices

We process errors, crashes, app/OS versions, response times, usage and costs to operate a reliable service, using services including Firebase and PostHog. Identifiers can be linked to accounts or installations; they are not all anonymous. For mobile analytics, PostHog also retains coarse location, such as country, inferred from IP addresses and linked to mobile analytics identifiers.

App usage analytics is on by default, with no in-app opt-out setting. Android usage analytics uses PostHog and excludes messages, files, AI prompts, replies and tool content. Sampled Android session recording covers only selected introductory screens and masks private screens and text inputs; it does not record ordinary chat screens. Advertising measurement is on by default on Android; previous advertising opt-outs remain off. The Android app does not include Firebase Analytics or the GA4 SDK. Essential Firebase authentication, app verification, notifications and crash reporting are separate.

Privacy-choice revision history is usable for delayed purchase attribution for 45 days, then becomes ineligible and is normally removed by daily bounded cleanup. Backlogs can delay physical removal. A compact latest-choice and withdrawal control has no automatic expiry, preventing old permissions from reappearing.

Unbound purchase-attribution records and optional purchase-measurement receipts/delivery payloads become eligible for removal after 45 days. Confirmed provenance for an active account can remain for 45 days or until 400 days after a verified billing period end or scheduled change, whichever is later. Account deletion removes account-owned origins, receipts and delivery payloads. An unresolved hash-only receipt can remain until bounded cleanup, but cannot be bound or sent for a proven deleted identity. Separately described refund/accounting evidence has its own retention.

Existing iOS service diagnostics can include prompts and replies in AI traces, and sampled session replay can include displayed conversations and interactions. We do not claim conversation content never reaches analytics providers. Some supporting tasks, such as private Memory extraction, disable content recording.

Advertising measurement uses Adjust, RevenueCat and partners such as Apple, Google and Meta, with permitted device/app identifiers, IP addresses, campaigns, installs, sessions and purchase/renewal events. IDFA is accessed only with iOS tracking permission. Advertising measurement is on by default on Android, without an extra Welcome prompt. Previous opt-outs remain respected. The default is not recorded as your affirmative consent; continuing, signing in or reading this policy does not create one. This does not enable personalized advertising, and OS advertising restrictions still apply. Conversations are excluded from advertising. Withdrawal controls future collection; it cannot retract information already sent.

Support and safety reports

When you contact us or report AI content, we process the submission, selected content or reference, reason, optional reply address and account identifier. Feedback forms and surveys use PostHog; support uses PostHog Conversations and email. Deliberately submitted feedback is processed as that requested operation, separately from ordinary non-content usage analytics. A reply address is a contact destination, not proof of account ownership. Do not send passwords, verification codes or payment-card numbers.

Our safety-report snapshots expire after 90 days and are normally removed by the next daily cleanup. Outages or a cleanup backlog can delay physical removal. Account deletion removes our report copy sooner. Support-provider copies have separate retention rules.

Usage, device information and pricing research

We use non-content information about how Chappie is used to understand onboarding, improve reliability and evaluate subscription prices and offers. Depending on the app version and information available, this can include onboarding choices and completion times, screens and actions, language and regional settings, app and OS versions, device type and model, and acquisition sources.

Pricing and subscription records can include the experiment or offer assigned, prices displayed, product and billing period, storefront, currency, trial eligibility and starts, purchases, renewals, cancellations, discounts and refunds. We study people who do not purchase as well as subscribers. Prices and offers can differ by market, plan, promotion or experiment. Collecting these records does not mean that an individually personalized price has been applied.

Where permitted by applicable requirements, existing permissions and privacy choices, supported versions can also provide display, audio and accessibility settings; battery, memory and thermal state; network type, connectivity and carrier; permission and capability states; and limited sensor readings such as acceleration, rotation, magnetic field, gravity, orientation, pressure, relative altitude, heading and proximity. These settings and readings are technical context, not a health assessment. A device exposing a value does not itself authorize every use of it. Unavailable, restricted or failed readings are not treated as observed values.

PriceTune is our pricing and analytics service. It processes this context for Chappie, with original capture and receipt times, to evaluate usage, reliability and pricing experiments. Records can be linked to account, guest or installation identifiers and subscription or experiment records; pseudonymous records are not anonymous. This context excludes chat text, message images, contact lists and precise location. We do not use the research context to fingerprint a device or track you across other companies’ apps or websites, and it does not enable advertising tracking or recordings.

The existing first-screen notice and linked policy explain the covered data use. If you continue or choose sign-in there, we can record the notice version, language, action and time of that acknowledgement. That record is not a blanket permission for unrelated purposes, and earlier actions are not rewritten as acceptance of a later notice. This research does not add an onboarding step or request a new OS permission during onboarding. We use existing valid permissions and choices only for their covered purposes. When collection or a further use requires consent or permission that is not available, we do not perform that collection or use. Publishing or updating this policy does not create an affirmative consent record or override an earlier refusal.

Historical Android usage-analytics choices remain attached to their covered optional research records. They do not control default-on service analytics. Original research permissions and withdrawal records continue to govern their covered purposes; removing the in-app control does not grant new research authority. Available OS settings continue to apply on their respective platforms. Contact support to exercise applicable access, objection, withdrawal or deletion rights, including for historical optional records. Account deletion and verified requests use the retention and deletion processes below. Processing and cleanup retries can delay completion; minimal deletion and withdrawal controls can remain to prevent erased information from being imported again. A change to this policy does not relabel older records as newly consented.

Website analytics

PostHog measures visits to public marketing pages, referral sources, campaign tags, browser/device information, approximate location derived from IP address, time on pages, scroll depth and page performance. A first-party reverse proxy forwards this information to PostHog. Random visitor and session identifiers are stored in your browser’s local and session storage. We do not link these website identifiers to your Chappie account.

PostHog respects Do Not Track, Global Privacy Control, and previously saved website analytics opt-outs. You can remove stored website identifiers by clearing site data. Contact support for deletion requests covering information already sent.

Website analytics excludes shared conversations, private email links, unsubscribe and billing return pages. URL fragments and query fields other than campaign tags are removed from analytics URL properties. Website session recording, form/click autocapture and account identification are disabled. Website analytics does not enable the separate advertising-measurement path or change the existing iOS advertising path.

Retention, deletion and your rights

We normally retain history and files until you delete them or delete your account. Request account deletion in app Settings. If you cannot use the app, the account-deletion resource linked below explains how to contact support and verify ownership. Uninstalling does not delete the server account or cancel a subscription.

Account deletion removes active chats, messages, files, images, bots, sign-in links, sessions and notification registrations. External-storage removal and backup expiry can take additional time. Limited pseudonymous purchase and usage records are normally retained for up to 90 days after deletion for refunds and legal obligations. Names, contact email and conversation content are excluded from this refund evidence.

Keyed Android device and installation claim identifiers preventing repeated free allowances remain after account deletion, without an expiry, for the lifetime of the free-allowance program. They are not anonymous and are used only to prevent another allowance.

To handle processor erasure, we temporarily retain random account and verified guest identifiers until the request is resolved. Once completion is separately verified, these request identifiers are removed. Purpose-limited hashes remain without an expiry to stop delayed optional analytics from recreating a deleted identity; these controls are not anonymous and do not restrict a different new account.

AI, payment, support and analytics providers have their own retention schedules and legal obligations. Deleting a Chappie account does not simultaneously erase every external record. Contact us for access or deletion requests covering information already sent to those services.

Depending on applicable law, you may request access, correction, export, deletion, restriction, withdrawal of consent or an appeal. We verify ownership and explain the result and necessary exceptions. Cancel a subscription separately with the store or provider where you purchased.

Service providers, safeguards and contact

We use Amazon Web Services, Cloudflare, Firebase, PostHog, RevenueCat, Stripe, sign-in and AI providers, and Adjust and advertising partners according to platform settings, applicable permissions and your choices. Each processes account, content, identifier, payment-status or diagnostic information needed for its role. Processing can occur outside your home country, including in the United States and Japan.

We use encrypted connections, restricted access, session controls and protections for private credentials. No internet service guarantees absolute security. We do not collect your contacts or sell or rent personal information. Regional rights relating to optional advertising measurement can be exercised through its choices and support.

For privacy questions, contact support@heychappie.com. Mitissa, LLC handles requests. We update this page and, where appropriate, provide an in-app notice of material changes.