Privacy Policy

CHAIOS ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and disclose information when you use the CHAIOS mobile application and web application (collectively, the "Services").

CHAIOS develops applications to support personal and professional planning, coordination, and organisation. Our Services are not designed for storing sensitive personal identification documents, confidential legal or compliance records, or other highly sensitive data. Please refer to our Terms of Use for the full scope and limitations of the Services.

By creating an account or using our Services, you agree to the collection and use of information as described in this policy.

Account information: When you register, we collect your name, email address, and password (stored securely via Supabase Auth).

App data: Information you enter about events, guests, budgets, tasks, businesses, and other planning-related content you choose to record within the Services.

Uploaded files: CHAIOS stores only one category of files on its own servers: images uploaded by businesses to their Business Directory listing (logos, banner images, and gallery photos). These are stored in our Supabase file storage (vendor-assets bucket) so they can be displayed publicly on the listing. All other files — such as document attachments — remain on your device and are never transmitted to our servers.

Usage data: We may collect anonymised usage analytics (e.g. which features are used) to improve the Services. No personally identifiable information is included in these analytics.

While CHAIOS applies appropriate security measures (see our Trust & Security page), the Services are not designed, assessed, or warranted as a secure platform for highly sensitive or regulated data categories. We strongly advise against storing:

• Government-issued identification documents (passports, driver licences, tax file numbers)
• Legal contracts, deeds, or instruments requiring secure custody
• Financial account credentials, banking information, or card numbers
• Sensitive compliance or regulatory records that carry legal obligations
• Medical or clinical health records beyond basic personal wellness tracking
• Confidential business information subject to legal privilege or regulatory obligations

For any information in the above categories, please use a purpose-built, audited, and certified solution appropriate to the sensitivity and regulatory requirements of that data.

CHAIOS uses file storage in one specific context: Business Directory listings. When a business partner uploads a logo, banner, or gallery images for their public listing, those files are stored in our secure Supabase storage bucket (vendor-assets) and served publicly as part of the directory.

For all other content — such as vision board inspiration images — files are encoded and stored as data directly within your record in the database. They are not uploaded to any separate storage bucket.

Record attachments (contracts, quotes, photos) remain on your device only and are never transmitted to our servers.

• To provide, maintain, and improve the Services
• To authenticate your account and maintain security
• To respond to support enquiries and feedback
• To send transactional emails (e.g. account verification, password reset)
• To analyse aggregate, anonymised usage patterns

We do not sell your personal information to third parties.

We share data with the following third-party service providers, solely to operate the Services:

• Supabase — database, authentication, and file storage for Business Directory listing images. All data is hosted in a SOC 2-compliant environment.

We do not share your data with advertisers or data brokers. Each provider is bound by their own privacy policy and data processing agreements.

Your account data is retained for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, unless we are required to retain it by law.

We implement industry-standard security measures including encrypted connections (HTTPS/TLS), password hashing, and Supabase Row Level Security to ensure only authorised users can access your data. However, no method of transmission over the internet is 100% secure, and the Services are not designed as a certified secure vault for sensitive or regulated data. See our Trust & Security page for full details.

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Request correction or deletion of your data
• Object to or restrict processing of your data
• Export your data in a portable format

To exercise these rights, contact us at support@chaios.au.

CHAIOS is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the effective date above and, where appropriate, by sending an email notification.

If you have questions about this Privacy Policy, please contact us at support@chaios.au or visit our Contact page.