Privacy
Last updated 20 October 2026
This document may change as Chesto evolves. When a change matters, we will tell you in the app before it takes effect; the date above is the latest version. Please check back from time to time.
Chesto is made by Fernando Vásquez, a sole trader in Santander, Spain), who is responsible for your data (the “controller”). Questions or requests about your data: [email protected].
The short version: we collect what Chesto needs to work, we don’t sell your data, we don’t show ads, and we don’t track you across other apps or websites. There are no analytics or advertising tools in the app.
What we collect, why, and on what basis
| Data | Why | Legal basis |
|---|---|---|
| Your email address | To sign you in with a one-time code. It is never shown to other people. | Contract |
| Your username and avatar | Shown to people you share collections with, and used to invite you. | Contract |
| What you save: links, titles, previews, collections | That’s Chesto: we store it so it syncs to your devices and to the people you share with. | Contract |
| Pins, favorites and settings | Private to you; to sync your library and tell you when a pin ends. | Contract |
| Subscription status and your account ID | To unlock Chesto Pro. Apple or Google handle payment; we never see your card. | Contract |
| A push notification token per device, and when you last used it | To send a pin-end or invite notification to the device you used last. | Consent (the notification prompt) |
| Sign-in records (time, IP address, device) | To keep accounts secure and stop abuse. | Legitimate interest |
| Blocks and reports | To keep people safe. Your blocks are private to you; a report stores what was reported and who reported it, and only we read it. | Legitimate interest, and legal obligations |
You don’t have to give us anything beyond your email address, but without it you can’t have an account.
Links and previews
When you save a link, our server visits that page once to read the title and preview picture it publishes for sharing; the website sees a request from our server, not from you. We store the address of the preview picture, and your phone then loads the picture from that website, so the website can see your device’s IP address, as it would if you opened the page yourself.
Who can see what
- Your collections are private unless you share one. People in a shared collection see its bookmarks, who added each one, and the usernames and avatars of the other members. Your pins and favorites are never shared.
- Anyone signed in can find you by typing your exact username, to invite you. There’s no search or list of people, and lookups are limited. People you block can’t find you.
- Your email address is shown only to you, and to a collection owner for an address they typed into an invite themselves.
People who aren’t on Chesto
If someone invites you by email address, we store that address with the invite and send you one email. If you don’t join, the invite expires after 90 days and is deleted 30 days later.
Services that process data for us
- Supabase (database, sign-in, file storage and server functions), hosted in the EU (Ireland).
- PowerSync: syncing your library between your devices.
- RevenueCat: subscription status, linked to your Chesto account ID.
- Expo: delivering push notifications.
- Resend: sending sign-in and invite emails.
- Netlify: hosting this website.
- Apple and Google handle payments for Chesto Pro as independent controllers under their own privacy policies.
They process data only on our instructions and under data processing agreements. Some are based in the United States; those transfers are protected by the EU’s Standard Contractual Clauses or the EU–US Data Privacy Framework.
How long we keep it
- Notifications: 90 days. Push delivery logs: 90 days. Username lookups: 1 hour.
- Invites by email or username: until they’re answered, revoked or expire (90 days), then deleted 30 days later.
- Reports: up to 2 years after they’re resolved, to handle repeat abuse and legal requests.
Your rights
You can access, correct, delete or export your data, object to or restrict how we use it, and withdraw consent at any time. Much of it is self-service:
- Export: Settings › Export bookmarks.
- Delete: Settings › Delete account deletes your account and everything you own or created, everywhere, including bookmarks you added to other people’s collections. Members of your shared collections get an email saying those collections are gone. It doesn’t cancel an App Store subscription: cancel that in your store settings.
- Notifications: turn them off in Settings or in your device’s settings.
For anything else, write to [email protected]; we answer within one month. You can also complain to the Spanish Data Protection Agency (aepd.es) or the authority where you live.
Children
You must be at least 14 to use Chesto. We don’t knowingly collect data from younger children; if you think a child under 14 has an account, write to us and we’ll delete it.
Security
Data travels encrypted (HTTPS), and the database only lets each person reach their own data and collections shared with them. If a breach put your data at risk, we’d tell you and the authorities as the law requires.
California
We don’t sell or share personal information, and we don’t use it for targeted advertising.
This website
moontic.studio sets no cookies and runs no analytics. Its host keeps standard server logs (IP address, pages requested) for security.
Changes
If we change this policy in a way that matters, we’ll tell you in the app before it takes effect.