Privacy Policy · Chimeling

This Privacy Policy explains how Cairntale LLC ("Cairntale," "we," "us," or "our"), a Wyoming limited liability company, collects, uses, and shares personal information when you use Chimeling, including our website at chimeling.app, dashboard, macOS app, React components, SDK, and API (together, the "Service"). It also explains the choices and rights you have.

Chimeling is operated from the United States. Our Terms of Service apply to your use of the Service.

1. The short version

We collect what we need to run Chimeling: your account details, the devices and apps you register, and the presence you choose to report.
Presence you report can be read publicly by anyone who has your Chimeling user ID. You control what is reported.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
We do not currently run advertising or third-party analytics trackers on the Service.
You can ask us to access, correct, or delete your data at privacy@cairntale.com.

2. Information we collect

Information you give us

Account data. Your email address and, depending on how you sign up, your name, profile picture, and sign-in method. This is collected and managed through our authentication provider, Clerk.
Waitlist data. The email address you submit when you join our waitlist.
Device data you register. A name for each device (for example "MacBook Air") and its platform (currently macOS).
App data you register. For each app on your device that you choose to report: its name, its identifier (for example com.apple.dt.Xcode), its icon image, and when it was last opened.
Presence reports. Your status (online or idle) and, if you choose to disclose it, which registered app you are using and when you started using it. You can report status only, without any activity.
Communications. Messages you send us, such as support or legal requests, and the information in them.

Information we collect automatically

Usage and technical data. When you use the Service, our servers and providers receive and log technical information such as your IP address, browser or app type and version, device type, request times, and the pages or API endpoints you request. We use it to operate, secure, and debug the Service.
Timestamps. We record when a device was created, last updated, and last seen.
Cookies and similar technologies. See Section 7.
Page loads. When a website loads Chimeling, the visitor's browser contacts us to fetch the presence being shown. We receive technical data about that request, such as IP address, browser type, and the time of the request. We use it to return the presence and to keep the Service secure. We do not use it to identify that visitor or build a profile of them.

Information from others

Authentication providers. If you sign in with a third-party account such as Google or GitHub, we receive basic profile information from that provider as permitted by your settings with them.

We do not intentionally collect precise location, contacts, the contents of your screen, keystrokes, or the content of what you do inside the apps you report. The Chimeling app reports only the data described above.

3. How we use information

We use personal information to:

provide, operate, and maintain the Service, including showing your presence where you have chosen to display it;
create and manage your account and authenticate you;
manage the waitlist and tell you about launch, trials, and pricing;
communicate with you about the Service, including security notices and updates;
respond to your questions and requests;
monitor, secure, and debug the Service and prevent abuse and fraud;
understand how the Service is used so we can improve it;
comply with legal obligations and enforce our Terms; and
with your consent or as otherwise allowed by law, for other purposes we tell you about when we collect the information.

We may create aggregated or de-identified data that cannot reasonably be used to identify you, and we may use it for any lawful purpose.

4. Your presence is public

Presence is designed to be displayed on websites. Our public read endpoint returns your resolved presence to anyone who has your Chimeling user ID. The response can include:

whether you are online, idle, or offline;
the name of the app you are using and its icon; and
when that activity started.

It does not include your device name, your email address, or app identifiers.

Anyone can read this information, and people who see it may copy or store it. Report only what you are comfortable sharing. You can stop reporting at any time, and you can report status without any app activity.

Stored presence expires automatically about 10 minutes after the last report from your device.

We share personal information only as described here:

Service providers. Companies that help us run the Service and who may only use the data for that purpose. They include providers of authentication and user management (Clerk), cloud hosting, our database, our object storage (for app icons), and our in-memory data store (for presence). They process data on our behalf.
Payment processors. When paid plans launch, payments will be handled by a third-party processor. We will not receive your full card number.
Publicly, as described in Section 4. The presence you report.
Legal and safety. Authorities and others, where we believe in good faith that disclosure is required by law or needed to protect rights, safety, or property, or to prevent fraud or abuse.
Business transfers. A successor or counterparty in a merger, acquisition, financing, sale of assets, or similar transaction, or in a bankruptcy or similar proceeding.
With your direction or consent. Anyone else, when you tell us to or agree to it.

App icons are stored by a content hash. If two people register an identical icon, it may be stored once and referenced by both accounts.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the past 12 months.

6. How long we keep information

We keep personal information for as long as needed to provide the Service and for the purposes in this Policy, including legal, accounting, and security needs.

Presence expires about 10 minutes after the last report.
Account, device, and app records are kept while your account is active. Deleting a device deletes the apps registered to it.
After you close your account or ask us to delete data, we delete or de-identify your personal information within 30 days, except for information we must keep for legal reasons, to resolve disputes, or to prevent fraud, and information that remains in backups until it is overwritten in the normal course.
Waitlist emails are kept until you ask us to remove them or until we no longer need them for launch communications.

7. Cookies and similar technologies

We use only the cookies and similar storage that are needed to run the Service, mainly to keep you signed in and secure. These are set by our authentication provider, Clerk, and your browser may store them as session or persistent cookies.

We do not currently use advertising cookies or third-party analytics cookies. If that changes, we will update this Policy and, where required, ask for your consent first.

Most browsers let you block or delete cookies. If you block essential cookies, you may not be able to sign in.

We do not respond to "Do Not Track" signals, because we do not track you across other sites.

8. Security

We use reasonable technical and organizational measures to protect personal information, including encryption in transit and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please keep your account credentials confidential.

9. International transfers

We are based in the United States, and our providers may process data in the United States and other countries. If you use the Service from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country. Where required, we rely on appropriate safeguards such as standard contractual clauses for these transfers.

10. Your choices and rights

Everyone can:

access and update some account information in their account settings;
stop reporting presence or remove registered devices and apps;
unsubscribe from non-essential emails using the link in them; and
ask us to access, correct, or delete personal information by emailing privacy@cairntale.com.

State privacy rights (United States). Depending on where you live, such as California, Colorado, Connecticut, Virginia, Texas, Oregon, and other U.S. states with privacy laws, you may have the right to:

know and access the personal information we hold about you, and get a copy;
correct inaccurate information;
delete your personal information;
opt out of the sale or sharing of personal information, and of targeted advertising and certain profiling (we do none of these);
limit the use of sensitive personal information (we do not use it for purposes that require this right); and
not be treated unfairly for using these rights.

To exercise a right, email privacy@cairntale.com. We will verify your request by matching it against information we already have, such as the email on your account. You may use an authorized agent to make a request for you, and we may ask for proof of their authority. If we deny a request, you can appeal by replying to our decision, and if you are not satisfied you may contact your state attorney general.

California notice at collection. In the past 12 months we collected the categories of personal information in Section 2, namely identifiers (such as email, name, and IP address), internet and device activity, and information in the content you send us. We collected them for the purposes in Section 3, from you and from our authentication providers, and we disclosed them to the service providers in Section 5. We do not sell or share personal information, and we do not knowingly sell or share the personal information of anyone under 16. California residents may also ask which personal information we disclosed to third parties for their direct marketing, and we do not make such disclosures.

Nevada. We do not sell covered information as Nevada defines it. You may still send a request to privacy@cairntale.com.

Europe, the UK, and Switzerland. If you are in the European Economic Area, the United Kingdom, or Switzerland, you may have the right to access, correct, delete, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent at any time. You also have the right to complain to your local data protection authority. We process your data on these legal bases:

Contract: to provide the Service you asked for, such as your account, devices, apps, and presence.
Legitimate interests: to secure and improve the Service, prevent abuse, and communicate with you, balanced against your rights.
Consent: where we ask for it, such as for the waitlist and optional communications. You can withdraw it at any time.
Legal obligation: where we must keep or disclose information by law.

Cairntale is the controller of your personal data. We do not currently have an establishment or a representative in the EEA or UK.

11. Children

The Service is not for anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has given us personal information, contact privacy@cairntale.com and we will delete it.

12. Third-party sites and services

The Service may link to or be embedded in websites we do not run. This Policy does not cover them. If you add Chimeling to a website, you are responsible for that site's own privacy practices.

13. Changes to this Policy

We may update this Policy from time to time. The "Last updated" date at the top shows the latest version. If we make a material change, we will notify you by email or through the Service before it takes effect.

14. Contact

For privacy questions or to use your rights, contact:

Cairntale LLC
30 N Gould St Ste N
Sheridan, WY 82801
Email: privacy@cairntale.com