chato privacy policy
Last updated: 28 October 2026
chato is a private, invite-only chat app for a small team. It is not a commercial service
and shows no ads. This page explains what it stores, what it can't read, and how to remove
your data.
The short version
- Your messages, files, names and channel names are end-to-end encrypted.
They are encrypted on your device with your team's key before they are uploaded. The server,
and the people who run it, can't read them.
- To make the app work, the server does see some information that isn't encrypted:
your sign-in account, who is in which team, and when things happen (listed below).
- No ads, no analytics, no tracking, and nothing is sold or shared for marketing.
- We email you about chato only if you ask, and every email tells you how to stop.
- You can delete your account in the app at any time.
What is encrypted (the server can't read it)
Message text, attached files and photos (and their names and previews), your display name
and profile photo, team and channel names, custom emoji images, and the text shown in
notifications.
Only devices that hold your team's key can read them. Keys stay on your devices; the service
never has them.
What the service can see
- Your sign-in account from Google or Apple: email address, account ID,
and the name the provider shares. It is used to sign you in and, only if you ask, to email
you about chato (see Emails about chato).
- Team membership: which teams you belong to, your role (owner, admin,
member) and when you joined.
- Activity metadata: when messages, reactions and files were created,
who sent them, who was mentioned, who assigned or unassigned a task and to whom (kept for
about a day, to send one notification for many), which emoji reactions were added, whether
a message was edited or deleted, file sizes, the short names of custom emoji (like
:gg:),
and when you last read each channel.
- Notification settings (all / mentions / none, muted channels) and, if
you turn notifications on, a push token and the device type (iPhone, Android, web) for each
device.
- Abuse protection: the app uses Firebase App Check (Apple App Attest,
Google Play Integrity, or Google reCAPTCHA on the web) to confirm requests come from the
real app. The waitlist form on our website uses Google reCAPTCHA the same way. Those
services may process device and browser signals under Apple's and Google's own privacy
policies. To limit sign-ups from one place, we keep a scrambled code made from your IP
address (not the address itself) for about an hour (it's deleted within a day).
Emails about chato
We only email you about chato if you ask for it, in one of two ways:
- The waitlist on our website. We keep the email address you type, your
language, the team size you pick, when you agreed and to which version of this policy, when
you confirmed, and how many confirmation emails we sent. We then email you to confirm the
address: once, or up to 3 times in all if you sign up again. If you don't confirm within 7
days of signing up, we delete it. A confirmed address is kept until you ask us to remove it. The address is stored as you
typed it, readable by the service (we need it to email you), and never shown to anyone
else.
- "Notify me" in the app, offered to signed-in people who aren't in a team
yet. We keep a record of your choice: yes or no, when, which version of this policy, where
you chose, and whether you signed in with Google or Apple. We don't copy your email address;
when we send, we use the one from your sign-in account.
To stop: turn off You → Product news by email in the app, use the link
or reply "STOP" to any of our emails, or write to us (below). We keep a short record that you
stopped, so we never email you again by mistake.
Where it is stored and who processes it
chato runs on Google Firebase (Google Cloud). Team data is stored in Google's Tokyo region
(asia-northeast1); sign-in is handled by Firebase Authentication. Notifications are
delivered through Firebase Cloud Messaging and, on iPhone, Apple Push Notification service.
These providers only ever receive the encrypted content described above.
Emails about chato are sent through Resend, from its Tokyo region. Resend
sees the address each email goes to and the email's text, nothing from your team, and keeps them
in its logs for its retention period.
Email you send us at hello@hellochato.com is handled by Google Workspace.
How long it is kept
- Messages and files stay in the team's history until they are deleted, or the team is
deleted.
- Invite links expire after 3 days or once used, whichever comes first.
- Push tokens are removed when you sign out, turn notifications off, or the token stops
working.
- A sign-in account that isn't in any team is deleted after 30 days without signing in,
unless you asked us to email you about chato. An account we've blocked for abuse is kept, so
it stays blocked.
- Waitlist addresses that aren't confirmed are deleted after 7 days; see
Emails about chato.
Deleting your data
In the app: You → Delete account. This removes you from every team,
deletes your devices, read state, unused invites and your email choice, and deletes your sign-in
account. If you
were the last member of a team, the whole team and its files are deleted. Messages you sent to
a team that still has members stay in that team's history, still encrypted, so the
conversation keeps making sense for the others.
On the web, signing out also removes the team keys from that browser, so a shared computer
keeps nothing readable.
To remove your address from the waitlist, write to us (below) from that address.
Children
chato is for adults (18+) on an invited team. It is not directed at children.
Changes
If this policy changes, the date at the top changes too. Significant changes are announced in
the team.
Contact
Questions or requests: hello@hellochato.com.