Privacy Policy

1. Information We Collect

We collect information you provide, information created through your use of ChaosRoots, and limited technical information needed to operate and secure the service.

• Account and profile information – your email address, public name, preferred time zone, password digest, and records of accepting our terms.
• Account security information – email-verification and password-reset records, two-factor authentication data, recovery-code digests, session status, IP address, and browser or device user agent.
• Calendars and organization content – calendar and event titles, descriptions, locations, dates, time zones, tags, organization names and contact details, memberships, and invitation email addresses.
• Import and media information – calendar-feed URLs, temporary iCalendar uploads, filenames, content types, generated calendar or event images, and related storage metadata.
• Billing information – Stripe customer, price, checkout, and subscription identifiers and the subscription status needed to provide paid features. ChaosRoots does not store full payment-card numbers.
• Operational information – request identifiers and application, queue, cache, and security logs used to operate, protect, and troubleshoot the service.

2. How We Use Information

We use this information to:

• Create, authenticate, secure, and support your account
• Provide calendars, events, organizations, invitations, sharing, imports, exports, and location features
• Process subscriptions and maintain access to paid features
• Prevent abuse, investigate failures, and maintain service reliability
• Send essential account, security, invitation, and service emails

We currently send transactional service messages, not promotional or marketing email.

3. Cookies

ChaosRoots uses essential signed cookies and session storage for authentication, security, post-login return paths, and pending organization invitations. ChaosRoots does not set analytics or advertising cookies. Google Maps may receive request and device information and use its own cookies or similar technologies when its location integration loads.

4. Service Providers

We do not sell your personal information. We use service providers to operate ChaosRoots, and they process information for the services they provide to us.

• Infrastructure and object-storage providers host the application, databases, backups, generated images, and temporary uploads.
• Stripe provides subscription checkout, billing, and account-management services.
• Resend delivers essential account, security, and invitation email.
• Google Maps provides location search and autocomplete. Loading the integration can send your IP address, browser or device information, and location searches to Google.

5. Data Retention

We retain information for as long as needed to provide and secure ChaosRoots, meet legal and billing obligations, resolve disputes, and maintain reliable backups.

• Uploaded iCalendar source files are purged after an import is committed or cancelled. Abandoned import previews and their uploaded files are reaped after 24 hours.
• Session access expires after the configured session period, which defaults to 24 hours. Session records are removed when you sign out, when an expired session is next checked, or when your account is deleted.
• Account, calendar, event, organization, and subscription records are retained while needed to provide the service or until they are deleted, subject to shared ownership and lawful-retention requirements.
• Logs, backups, billing records, and security records are retained only as long as needed for operations, recovery, fraud prevention, accounting, or legal obligations.

6. Data Security

We use HTTPS, access controls, password hashing, and encryption for selected sensitive account-security and billing identifiers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

7. Your Choices and Rights

You may update supported profile information in account settings or contact us to request access to, correction of, or deletion of your personal information.

• Email deletion requests to hello@chaosroots.com. We will complete deletion requests within 30 days of your initial request, subject to verifying your identity.
• Account deletion removes content you authored, including content shared with an organization. If you own an organization with other members, you must transfer ownership or confirm deletion of the organization and its shared data.
• We may retain the minimum information required for legal, billing, fraud-prevention, security, backup, or data-integrity obligations.

8. Changes to This Policy

We may update this Privacy Policy as ChaosRoots changes. We will post the revised policy and effective date here and will provide additional notice for material changes when appropriate.

9. Contact Us

For privacy questions or requests, contact:

• ChaosRoots
• hello@chaosroots.com