Privacy

Last change:

This page tells you what data the Site collects, why, and who gets it. The Site has no advertisements and no analytics. I do not sell your data.

Who is responsible

Chad Thiele operates chadthiele.com and is responsible for the data that this page describes. “The Site” is chadthiele.com and all its pages. “I” and “me” refer to Chad Thiele.

When you only read pages

You can read the Site without an account. The Site does not set cookies. It does not use analytics or advertisement trackers.

Google Firebase Hosting sends the pages to your browser. As with all websites, the host receives your IP address and data about your browser. Google keeps logs of this data.

The Site has links to other websites, such as Substack and LinkedIn. Those websites have their own privacy policies.

When you sign in

Sign-in is necessary only for some parts of Chibi Things. Google Firebase Authentication does the sign-in.

If you sign in with an email link, the Site gets your email address. Firebase sends the link to that address.

If you sign in with Google, Google gives the Site your email address, your name and the address of your profile picture. Firebase keeps them with your account. The Site uses only your email address. Google can set its own cookies in the sign-in window.

Firebase also records the times of your sign-ins and the IP address that you used.

Your browser keeps a record that you are signed in. The record stays on your device until you sign out. While you wait for an email link, your browser also keeps the email address that you typed.

Your account record

The Site keeps a small account record in Google Cloud Firestore. The record can contain these items:

  • The date of creation and the date of the last change.
  • Your Chibi Crew status, the time of the last check, and the date when the status stops.
  • Your vault data, in encrypted form.
  • The keys that you saved for AI services, in encrypted form. Each key has the name of the service and a date.
  • The devices that you trust. Each device has a name such as “Chrome on macOS”, an expiry date, and data that lets the device open the vault.

The record does not contain your notes, your results or other data from a Thing.

The vault and your keys

The vault keeps the keys for your accounts with AI services. Your browser encrypts each key before it saves the key. The encryption uses your vault passphrase.

The Site does not send your passphrase to me. Because of this, I cannot read your keys.

If you do not save a key in the vault, the Site holds the key in memory for one visit only.

The Chibi Crew check

The Chibi Crew are the people who have a paid subscription to the Chibi Things newsletter on Substack. Substack uses Stripe to collect the payment.

To see if you are in the Crew, the Site sends the email address of your account to Stripe. Stripe replies with the status of the subscription and the end date of the paid period. The Site saves only your Crew status and the dates.

The Site does not process payments. It does not ask for, receive or keep card data. The log of the check contains your account ID and your Crew status. It does not contain your email address.

Data in Things

At this time, Things keep their data in your browser. That data does not go to my servers. Other people who use the same browser profile can see it.

Some Things send data to a different service that you connect. For example, Bento Prompts sends your notes from your browser directly to OpenRouter. OpenRouter then sends them to the AI model that you selected.

I do not receive your notes or the results. The privacy policy of OpenRouter applies to them.

Who gets your data

I do not sell your data and I do not give it to advertisers. These companies get data because the Site uses their services:

  • Google, for Firebase Hosting, Authentication, Firestore and Cloud Functions.
  • Stripe, for the Chibi Crew check.
  • OpenRouter, only if you connect your OpenRouter account in a Thing.

These companies can keep data on servers in other countries, including the United States.

Substack operates the newsletter. If you subscribe there, the privacy policy of Substack applies.

How long the Site keeps data

The Site keeps your account data while you have an account.

To delete your account, open the Account page and hold the delete button. This deletes your sign-in, your account record, your saved keys and your trusted devices.

This does not delete the data that Things saved in your browser. To delete that data, clear the site data for chadthiele.com in your browser settings.

Google and Stripe keep their own logs for the time that their policies give.

Your choices

On the Account page, you can remove a saved key, remove a trusted device, reset the vault or delete your account.

The law in your country can give you rights to your data, such as the right to get a copy or to correct it. To use such a right, send me a message.

The rules for use

The terms of use give the rules for the Site.

Changes to this page

I can change this page. The date at the top shows the last change.

Contact

To ask a question about your data, send me a message on LinkedIn.