This Privacy Policy describes how Cheddify Inc. (“Cheddify,” “we,” “us,” or “our”) collects, uses, and protects your personal information when you use Cheddify and its affiliated properties, including but not limited to chatwithpsychics.com, our iOS and Android mobile applications, and any future properties (collectively, the “Platform”).
1. Information We Collect
We collect the following categories of information:
- Account information: Name, email address, profile photo, bio, social media links, and seller category
- Authentication data: Hashed passwords, social login tokens (Google, Apple)
- Device information: Device type, operating system, app version, unique device identifiers
- Usage data: Pages viewed, features used, search queries, browsing patterns
- Location data: Approximate location (if permission granted) for local discovery features
2. Data Collected During Calls
When you make or receive a call on the Platform, we collect:
- Call duration and timestamps (start time, end time)
- Call status (completed, missed, declined, disconnected)
- Caller and callee identity (user IDs)
- Who ended the call (buyer, seller, or network disconnect)
- Call quality metrics (for debugging and service improvement)
Cheddify does NOT record the audio or video content of calls. We do not listen to, watch, store, or have access to what is said or shown during calls. Call metadata (duration, timestamps, status) is retained for billing, dispute resolution, and platform improvement.
3. Payment Data
Payment processing is handled by Stripe, a PCI DSS-compliant payment processor. Cheddify stores:
- Last 4 digits of your credit or debit card
- Card brand (Visa, Mastercard, etc.)
- Billing name associated with the card
- Transaction history (amounts, dates, associated calls)
Full card numbers are never stored on Cheddify servers. All sensitive payment data is handled directly by Stripe. Seller payout information is managed through Stripe Connect.
4. Real-Time Connection Data
The Platform uses real-time connections (Socket.io) to power features like live availability status, messaging, and notifications. We collect:
- Connection and disconnection timestamps
- Online/offline/available status changes
- IP addresses (used for security, fraud detection, and abuse prevention)
5. Push Notifications
We use Firebase Cloud Messaging (FCM) to deliver push notifications. This requires storing device tokens associated with your account. You can disable push notifications at any time in your device settings.
6. Video Call Infrastructure
Live video calls are powered by Agora.io. During a call, Agora processes video and audio streams in transit to facilitate the connection. These streams are not stored by Agora or Cheddify. Agora’s data practices are governed by their own privacy policy.
7. Google Calendar Integration
Sellers may optionally connect their Google Calendar to enable scheduled bookings. This integration is entirely optional—the scheduling feature works without it, and buyers are never asked to connect a calendar. When a seller connects Google Calendar, Cheddify requests only the following Google API scopes:
- View free/busy (calendar.freebusy): We read only your busy time ranges—never event titles, descriptions, attendees, or any other event content—so that time slots you are already occupied for are hidden from buyers, preventing double-booking.
- Manage events (calendar.events): When a buyer books you, we create a calendar event for that appointment on your primary calendar, and we update or delete that same event if the booking is rescheduled or cancelled. We only ever create, modify, or remove events that Cheddify itself created for your bookings.
To keep this connection working, we store a Google OAuth refresh token associated with your account, encrypted at rest. We do not store the contents of your calendar. You can disconnect Google Calendar at any time from your Cheddify scheduling settings, or revoke access directly from your Google Account permissions; either action deletes the stored token.
Cheddify’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not use it for advertising or to train generalized AI/ML models, and do not transfer it to third parties except as necessary to provide the scheduling feature.
8. How We Protect Your Data
We protect all personal information—and apply heightened safeguards to sensitive data, including data received from Google APIs—using the following mechanisms:
- Encryption in transit: All communication between your device and Cheddify servers, and between Cheddify servers and third-party services such as Google, Stripe, and Agora, is encrypted using TLS (HTTPS).
- Encryption at rest: Sensitive credentials, including Google OAuth refresh tokens, are encrypted at rest using AES-256-GCM before being stored in our database. They are decrypted only momentarily in server memory when needed to make an authorized API call on your behalf.
- Minimal storage of sensitive data: We do not store the contents of your Google Calendar. Free/busy information is processed in memory to compute availability and is not persisted. Full payment card numbers are never stored on our servers (see Section 3), and account passwords are stored only as salted hashes.
- Access controls: Access to production systems and databases is restricted to authorized personnel, protected by key-based authentication, and limited to what is necessary to operate and maintain the service. Encryption keys and service credentials are stored as protected secrets outside of our source code.
- Third-party safeguards: Payment data is handled by Stripe, a PCI DSS-compliant processor, and never touches Cheddify servers in raw form.
- Incident response: If we become aware of a security incident affecting your personal data, we will notify affected users and applicable authorities as required by law.
9. Affiliated Properties
Data may be shared across all Cheddify properties (cheddify.com, chatwithpsychics.com, and mobile applications). All properties are operated by Cheddify Inc. and share the same user database. A single user account provides access to all properties.
We do not sell your personal information to third parties. Data sharing between affiliated properties is for the purpose of providing a consistent user experience across all Cheddify services.
10. Data Retention
- Account data: Retained while your account is active, plus 30 days after account deletion to allow for reactivation
- Call records: Retained for 1 year for billing and dispute resolution purposes
- Payment records: Retained as required by applicable financial regulations
- Usage logs: Retained for up to 90 days for debugging and security purposes
11. Your Rights
Depending on your jurisdiction, you may have the right to access, correct, delete, or export your personal data. To exercise these rights, contact us at privacy@cheddify.com.
12. Legacy Privacy Policy
The following legacy Privacy Policy document remains available for reference. It applies to data practices associated with legacy Cheddify features.
View Legacy Privacy Policy (PDF)
13. Changes to This Policy
Cheddify may update this Privacy Policy at any time. Material changes will be communicated via email or in-app notification. Continued use of the Platform after changes take effect constitutes acceptance of the updated policy.
14. Contact
Questions about your privacy? Contact us at privacy@cheddify.com.