CHALC App Privacy Policy
Effective Date: October 25, 2025
https://chalc.world/privacy
1. Introduction
CHALC Social Limited respects your privacy and complies with POPIA (2013), GDPR, COPPA, and CCPA where applicable.
This Policy explains how we collect, use, store, and protect your data.
2. Information We Collect
- Name, email, phone (optional), date of birth
- Guardian name/email (for users 13–17)
- Videos, images, challenge submissions
- Device type, IP address (anonymised), analytics
- Consent records (timestamp, status)
2.1 Data Classification (for App Stores)
| Data Type |
Collected |
Linked to Identity |
Purpose |
Shared With |
| Name |
Yes |
Yes |
Account |
S3 Amazon (if uploaded) |
| Email |
Yes |
Yes |
Login, alerts |
None |
| Phone |
Optional |
Yes |
2FA |
None |
| Guardian Info |
Yes (13–17) |
Yes |
Consent |
None |
| Videos/Images |
Yes |
Yes |
Challenges |
S3 Amazon |
| Device/IP |
Yes |
No |
Analytics |
Firebase |
| Crash Logs |
Yes |
No |
Stability |
Firebase |
3. Children's Data & Consent
- Users 13–17: Verifiable guardian consent via email link
- Users under 13: Prohibited. Accounts deleted immediately
- Guardians can withdraw consent or request deletion: support@chalc.world
4. How We Use Information
- Operate the App
- Verify age and consent
- Host videos via S3 Amazon API
- Moderate content
- Send safety alerts
- Improve performance (anonymised)
5. Sharing of Information
- S3 Amazon (video hosting) — under S3 Amazon ToS
- Firebase (analytics/crash reporting) — anonymised
- Legal authorities (if required)
- No sale of data. No advertising use.
5.1 S3 Amazon API Disclosure
By uploading a video, you agree to S3 Amazon's Terms (https://docs.aws.amazon.com/managedservices/latest/userguide/key-terms.html) and Privacy Policy.
S3 Amazon may collect: video metadata, IP, watch time.
Upload requires explicit opt-in. No auto-upload.
5.2 Community Marketing Sharing
If you opt in during Community join, your uploaded content (videos, images, username) may be shared with the Community Owner for external promotional use. No contact info (email/phone) is shared. You can revoke consent anytime.
6. Data Retention & Deletion
- Active account: Retained as needed
- Inactive: Deleted after 12 months
- Deletion request: In-app (Settings > Delete Account) or email
- Response: Within 30 days
- Confirmation sent via email
7. Security
- Encryption in transit (TLS) and at rest (AES-256)
- Access controls, 2FA for staff
- Regular audits and breach response (POPIA §22)
8. Your Rights
- Access, correct, delete data
- Withdraw consent
- Object to processing
- Lodge complaint: Information Regulator (SA) or EU DPA
9. Analytics & Cookies
- Firebase Analytics & Crashlytics (anonymised)
- No tracking cookies
- No cross-app tracking
10. International Transfers
Data may be transferred to the US (S3 Amazon, Firebase) under POPIA §57 adequacy or Standard Contractual Clauses.
11. Updates
Changes posted at https://chalc.world/privacy with in-app notice.
12. Contact
Support: support@chalc.world
Address: 11 Erica Heath, Brackenridge, Plettenberg Bay, 6600