Privacy Policy

Account

• Email address and username.
• Your password, stored encrypted (we never see it) or, if you sign in with Google, your Google account identifier.
• Preferred language, sign-up date and last access date.

Your house

• The house's name and time zone, who its members are and who is an admin.
• Chores: name, icon, frequency and effort.
• Turns: who each chore fell to, who did it and when, and which were missed.
• Swap requests and the optional message you write.
• Absences: the dates you're away and the reason, if you write one.

Notifications

• If you turn on reminders: the technical details of your device's notification subscription (an address and encryption keys), the device type and whether the app is installed.
• The notifications we sent you and whether you tapped them.

Payments

• Subscription and customer identifiers at Stripe or PaySuite, subscription status, dates and invoices.
• We don't store card details. If you pay with M-Pesa, e-Mola or mKesh, PaySuite may give us the phone number used, only to identify the payment.

Technical data and contacts

• IP address, browser and operating system type, and security logs (for example, sign-in attempts).
• What you send us: feedback, reviews and support requests.

Please don't write sensitive information (about health, religion, intimate life, etc.) in chore names, swap messages or absence reasons. cahpaz doesn't need it.

cahpaz is shared by nature: for the rotation to be fair, everyone in the house sees the same thing. When you join a house, the other people in it can see:

• Your username and whether you're an admin.
• The chores that fall to you, the ones you did and when, the ones that were missed and your effort points.
• The house's history and statistics, including the highlights.
• The swap requests you send them (and the message), or send to the whole house.

They don't see your email, the reasons for your absences, your payments or your devices. If you leave a house, what you did while you lived there stays in that house's history, because it's part of the shared record.

We only process data when we have a legal basis (Article 6 GDPR):

• Providing the service you asked for (performance of the contract): account, house, chores, rotation, swaps, absences and history.
• Sending reminders (your consent): only after you allow notifications on your device. You can turn them off in Profile or in your device settings.
• Charging the subscription and meeting tax obligations (performance of the contract and legal obligation).
• Protecting cahpaz and accounts against abuse and fraud (legitimate interest).
• Understanding, in aggregate, how the app is used so we can improve it (legitimate interest). Analytics tools that use cookies are only used if you accept them.
• Replying to you and sending important service notices (performance of the contract and legitimate interest). We don't send marketing without your consent.

We don't sell or rent personal data, we don't show ads and we don't make automated decisions with legal effects on you. The automatic distribution of chores is an organising suggestion that the people in the house can change.

Only with companies that help us provide the service, who process the data on our behalf and with the safeguards the law requires:

• Stripe: card payments.
• PaySuite: mobile payments in Mozambique (M-Pesa, e-Mola and mKesh).
• Google: Google sign-in, if you use it, and usage statistics, if you accept analytics cookies.
• Your browser's notification services (Google, Apple, Mozilla or Microsoft): they deliver reminders to your device. Notification content is encrypted and these services can't read it.
• Hosting and email providers: they store the app and its data, and send emails such as sign-in codes. The app and database are hosted in the European Union.

Hosting: Contabo GmbH, com servidores na Alemanha

We may also disclose data when the law requires it (for example, by court order) or to defend legal rights in a dispute.

Some providers process data outside the European Economic Area, for example in the United States. In those cases, transfers rely on European Commission adequacy decisions (such as the EU-US Data Privacy Framework) or on standard contractual clauses approved by the Commission.

If you pay through PaySuite, the data needed for the payment is transferred to Mozambique, because that is necessary to carry out the payment you requested (Article 49(1)(b) GDPR).

• Account and house data: for as long as the account is active.
• Accounts with no access for 24 months: we warn you by email and, if you don't come back, we delete the account.
• After you delete your account: your personal data is deleted within 30 days. In the history of houses you lived in, the records are no longer linked to your name.
• Invoices and payment records: 10 years, for tax and accounting obligations.
• Security logs and notification history: up to 12 months.
• Notification subscriptions: until you turn them off or they stop being valid.

At any time, and free of charge, you can:

• Access your data and receive a copy.
• Correct inaccurate data.
• Delete your account and your data.
• Receive your data in a structured format (portability).
• Object to processing based on legitimate interest, or ask for it to be restricted.
• Withdraw your consent (for example, turning off reminders or refusing analytics cookies), without affecting what was done before.

To exercise these rights, email us at the address on this page. We reply within one month and may ask you to confirm your identity.

If you think we haven't handled your data properly, you can complain to the Portuguese data protection authority (CNPD), at www.cnpd.pt, or to the data protection authority of the country where you live.

We apply the same protection to everyone, wherever they live: the GDPR applies to cahpaz because it is established in the European Union.

We also respect the confidentiality and security rules of Law No. 3/2017 of 9 January (Electronic Transactions Law), and we will adapt this policy when Mozambique's personal data protection law comes into force.

We use encrypted connections (HTTPS), encrypted passwords, access control, attempt limits and security logs. No system is infallible: if a data breach happens that could affect you, we will inform you and the authorities, as the law requires.

cahpaz is meant for people aged 16 or over. If you're under 18, you need permission from whoever holds parental responsibility for you to buy a subscription. If we learn that an account belongs to someone under 16, we delete it.

We use cookies and local storage that are essential for the app to work: keeping you signed in, protecting requests, remembering your language, theme and cookie choices, keeping an invite while you sign up, and not repeating notices you already closed.

Analytics cookies are only used if you accept them. You can change your choice at any time under “Manage cookies”.

If we change this policy in an important way, we'll tell you in the app or by email before the changes take effect. The date at the top shows the current version.