Privacy policy
The short version. We never store your messages. Pasted code, logs, stack traces and anything that looks like a key or password are removed on your computer before anything is sent, and screenshots are never sent. We keep your account email, your subscription status and simple daily counts.
Who we are
Chillaki is run by TEXNI VELOCIDAI S.L., Barcelona, Spain ("we"). We are the data controller for the personal data described here. Contact: hello@chillaki.com.
What happens to your messages
- Before a message leaves your computer, the Chillaki hook cuts out pasted blocks, code, stack traces, logs and long pasted text, and replaces anything that looks like a secret (keys, tokens, passwords). These stay on your computer and are put back into the suggested version locally. Screenshots you paste are never sent; they stay on your computer.
- The cleaned text (at most 2,000 characters) is sent to our server, which asks TypeSafe whether it is strongly worded and, if so, asks Cerebras for a suggested version (Groq only as a backup, if Cerebras fails).
- We do not store or log message text or suggested versions, on our servers or in our logs. TypeSafe does not use it to train models and keeps it only as long as it needs to run its service. Cerebras does not keep inputs or outputs. Groq, the backup, does not keep them by default; it may keep them for up to 30 days only when investigating abuse or errors.
- On your computer, the paused message and its suggested version are kept in the Chillaki folder (~/.chill) so you can send either one. These copies stay on your computer and are replaced or cleared as you send more messages. The Recent list in the Chillaki panel is kept in memory only and is gone when you close your editor.
What we collect
- Install data: a random install id, the extension version, your operating system, and daily counts (messages checked, noted and paused, errors, response times).
- Account data: your email, your sign-in user id, when your trial ends, and your Stripe customer id.
- Subscription data: plan, status and renewal date. Link (Stripe) sells the subscription and processes your payment; we never see your card number.
- IP addresses: used to limit sign-ups from one address. We keep only a one-way hash of it, for one hour, as a counter; our hosting provider keeps standard request logs.
- Trial record: when your free trial starts, we keep a one-way, keyed fingerprint of your email (not the email itself), so each email gets one free trial. It stays even if you delete your account.
Why, and on what legal basis
- To provide Chillaki and your subscription (performance of a contract, GDPR art. 6(1)(b)).
- To keep invoices and tax records (legal obligation, art. 6(1)(c)).
- To keep the service secure and stop abuse, with rate limits and the one-trial-per-email record (legitimate interests, art. 6(1)(f)).
Who processes data for us
| Provider | What for | Data |
|---|---|---|
| Vercel Inc. (US) | Hosting of the website and API | Request metadata (IP address, time), install id |
| Supabase Inc. (US, servers in the US) | Database and sign-in | Account email, install and account records, daily counts |
| Upstash Inc. (US, servers in the US) | Rate limiting and plan cache | Install id, plan, a one-way hash of your IP address (for one hour) |
| Stripe (Link, Stripe Payments Europe Ltd. / Stripe Inc.) | Selling the subscription as seller of record, payments, tax, receipts and invoices (see below) | Name, email, billing address, payment details (we never see card numbers), subscription |
| TypeSafe (US) | Checking the tone of a message | Cleaned message text, not stored by us |
| Cerebras Systems Inc. (US) | Writing the suggested version | Cleaned message text, not stored by us |
| Groq Inc. (US) | Backup for the suggested version, only if Cerebras fails | Cleaned message text, not stored by us |
| GitHub Inc. (US) | Sign-in, only if you choose GitHub | Your GitHub email and user id |
| Resend Inc. (US, sending from the EU) | Sending sign-in emails, only if you sign in by email | Your email address |
Several of these providers are in the United States. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, and on the European Commission's Standard Contractual Clauses otherwise.
Link (Stripe) sells the subscription as seller of record, so it is responsible for the payment and billing data it collects at checkout, under its own privacy policy (link.com). We receive your Stripe customer id and the plan, status and renewal date of your subscription.
How long we keep it
- Message text: not kept.
- Account data: while you have an account. You can delete it any time on your account page, and it is removed right away; your editors are signed out.
- Invoices and payment records: as long as Spanish tax and commercial law requires.
- Trial record (the email fingerprint): 2 years after your trial started.
Cookies
We only set the cookies needed to keep you signed in on the sign-in and account pages. No analytics, no advertising, no tracking.
Your rights
You can ask to access, correct, delete or export your data, and object to or restrict how we use it. Write to hello@chillaki.com, or delete your account yourself on your account page. You can also complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (aepd.es).
Children
Chillaki is not meant for anyone under 16.
Changes
If we change this policy in a way that matters, we'll say so on this page and in the extension.