Privacy Policy

What we collect

Account details: whichever of these you sign in with — an email address and password, a phone number, or the Google or Apple account you connect along with the email address that provider tells us. Optionally a display name, username and email address if you add one later.

Your password is stored only as a one-way hash. We cannot read it, and we never receive a password at all when you sign in with phone, Google or Apple.

The checklists you create — their items, notes, folders, reminder times and completion state.

AI prompts: what you typed to generate or edit a checklist. We keep a shortened copy of the prompt, when it ran and whether it worked.

Credit history: which AI action you spent credits on, when, and on which checklist.

Payment and plan records: what you bought, the amount, and the identifiers Razorpay gives us for the payment and the subscription. We never see or store your card, UPI or bank details — those go to Razorpay directly.

Basic technical information needed to serve the app, such as your IP address and browser type.

Why we collect it

To run the service: sign you in, store and sync your checklists, generate and edit checklists with AI, count credits, and process payments for plans and library purchases.

To keep it working for everyone: rate limits, abuse prevention, and the spending ceilings that stop one account exhausting the AI budget.

To email you about your account: the signup confirmation link and password reset links. We do not send marketing email.

We do not sell your personal information, and we do not use it for advertising.

AI prompts and content

When you use an AI feature, your prompt and the relevant parts of the checklist are sent to Google's Gemini API, which generates the response. Nothing else about you is sent with it.

We do not use your checklists or prompts to train AI models.

A checklist generated before you sign in is created in the public library and may later be made publicly visible. Anything in that prompt should be treated as public. Prompts from signed-in accounts are not published.

Prompts are kept, in shortened form, so that rate limits and abuse checks can see them. Do not put confidential or other people's personal information into a prompt.

If you are not signed in

Nothing is stored for someone who only reads a public checklist. The first time you tick something off, we set a cookie and create a guest record so your progress survives a page reload.

That record holds your progress, and your IP address and browser string stored only as one-way hashes — enough to tell two requests apart for rate limiting, not enough to recover the address.

Signing up on the same browser moves that progress onto your account.

Who else sees it

Firebase (Google) handles phone verification and Google and Apple sign-in. Email and password sign-in is checked by Cheli directly; no third party is involved.

The Gemini API (Google) receives AI prompts and the checklist text an action needs.

Razorpay handles payments and recurring plans. Their checkout runs in your browser when you pay and collects your payment details directly; they tell us the outcome.

Each receives only what it needs to do its job, and nothing is shared with anyone else for their own purposes.

Checklists you publish or share by link are visible to the people you share them with, or to everyone in the case of publishing.

Cookies

Cheli sets a session cookie when you sign in, and a guest cookie when a signed-out visitor first ticks something off. Neither is used for advertising or cross-site tracking. See the Cookie and Tracking Notice.

How long we keep it

Your account data stays until you delete it or close your account.

Prompt records, credit history and payment records are kept while your account exists, because they are what answers 'where did my credits go' and 'was I charged for this'.

Guest records are kept after they are claimed, so the same progress cannot be claimed twice.

Your choices

You can edit or delete your checklists at any time, and change your password — or reset it by email — from your profile.

Deleting your account from your profile removes your account and the data attached to it — your checklists, anything you published, your credit history and your plan record.

Cancel your plan before deleting your account. Deleting the account does not by itself cancel the recurring mandate held by Razorpay.

To request a copy of your data, correct something, or ask for deletion another way, contact legal@cheli.app.

Children

Cheli is not intended for children under 13. See the Child and Parent Notice.

Changes

We may update this policy. Material changes will be notified in-app. Questions go to legal@cheli.app.