Privacy Policy

1. Information We Collect

• Account data: email address, Supabase user identifier, authentication session data, and identity information returned by the sign-in provider you choose.
• Profile data: the display name and biography you save.
• Social data: linked X or Discord identifiers and public profile fields, your saved X Following snapshot and sync status, and whether your linked Discord account belongs to the configured official Chrona server.
• Social authorization: X access and refresh credentials are encrypted and retained server-side to refresh Following data. A Discord access credential is used to verify identity and server membership and is not persistently stored. After a transient connection failure, the browser may hold the relevant credential only in memory for up to five minutes so you can retry.
• Payment data: Checkout Session, order, payment status, amount, currency, wallet balance, and ledger identifiers. Stripe receives payment-card details; Chrona does not store full card numbers.
• Technical data: IP address, browser and device information, timestamps, request metadata, security events, and service logs produced when the Service is accessed.
• Communications: information you send when requesting support, a refund, account assistance, or a privacy action.

2. How We Use Information

We use information to authenticate users, maintain profiles and sessions, connect authorized social sources, match people a user may already know on Chrona, refresh saved X Following data, create and reconcile payment orders, display authoritative Chronos balances, prevent fraud and duplicate crediting, secure and troubleshoot the Service, respond to requests, comply with law, and improve reliability.

3. How We Disclose Information

We disclose information to service providers only as needed to operate the Service, including Supabase for authentication and database infrastructure, Stripe for payment processing, X and Discord for the social connections you authorize, enabled OAuth providers for sign-in, and hosting or security providers. We may also disclose information when required by law, to protect rights and safety, or as part of a business transaction subject to appropriate safeguards.

We do not sell personal information. Your display name, provider avatar, X handle, sign-in provider, and the reason for a relationship match may be visible to another signed-in user whose authorized relationship data matches your account. Do not put sensitive information in public profile fields.

4. Social Relationships

The X source may show a Chrona account when the viewer's saved Following includes that account's linked X identity. The Discord source may show accounts when both people have confirmed membership of the configured official Chrona server within the previous 30 days. These signals do not mean that two people are mutual friends, and Chrona does not receive a normal Discord friend list.

You can revoke Chrona's authorization from X or Discord through that provider. Revocation may stop future synchronization but does not automatically delete data already retained by Chrona; contact us to request deletion or unlinking, subject to legal and security retention requirements.

5. Payments and Chronos

Stripe hosts Checkout and processes payment credentials under its own privacy notice. Chrona stores the records needed to associate a verified payment with an account, prevent duplicate credit, maintain separate test and live balances, and support reconciliation, refunds, disputes, security, and legal obligations.

6. Your Choices and Rights

You may edit your display name and biography and sign out through the account controls. You may request access, correction, deletion, or another privacy action by contacting us. We may need to verify your identity and may retain financial, fraud-prevention, dispute, security, or legal records where permitted or required.

7. Retention and Security

We retain information for as long as reasonably necessary to provide and secure the Service, maintain accounts and financial records, resolve disputes, and comply with law. We use access controls, row-level security, signed webhooks, transaction idempotency, and transport encryption, but no system can guarantee absolute security.

8. Children

The Service is not directed to children under 13. If you believe a child provided personal information in violation of applicable law, contact us so we can review the request.

9. Changes and Contact

We may update this Policy as the Service or law changes. We will post the revised version and update the date above.

For privacy questions or requests, email pengpeng1366@gmail.com with the subject “Chrona Privacy Request.” Do not send passwords, one-time codes, card details, API keys, or other secrets.