Privacy Policy
Version v1-2026-05-13 · Last updated 2026-05-13.
Chokala operates a creator-hosting platform.
This Privacy Policy describes what personal data Chokala
collects, why, and what your rights are. It applies to the Platform
itself (chokala.gg and the marketplace surfaces). Each
individual creator's profile (at
chokala.gg/@<creator>/) operates under
that creator's own posted Privacy Policy; please consult those for
creator-specific data-handling practices.
What we collect
- Account signups: the email address you provide when creating a Creator account, plus the IP address and user- agent of the request.
- Session cookies: a session identifier (an opaque random token; not your email) used to keep you signed in while you use the Platform.
- Payment metadata: when a payment passes through the Platform, we record the payment processor's transaction identifier, the payment amount, the currency, and the Creator/Visitor identities involved. The payment processor (currently PayPal; additional processors may be added) handles the payment-method details (card number, bank account, etc.) — Chokala does not store payment-method details on its own infrastructure. [OPERATOR-VERIFY]
- Optional analytics: aggregate, non-identifying usage signals (page-load timing, error rates, feature-usage counts) used to operate and improve the Platform. We do not run cross-site advertising trackers. [OPERATOR-VERIFY]
- Server logs: URL, status code, request timing, IP address. Retained for a limited window for debugging and abuse-prevention. [OPERATOR-VERIFY: retention window — Heroku default is approximately 30 days]
Why we collect it
- To deliver the service you signed up for (host your profile, process payments, surface discovery).
- To prevent abuse (rate-limit signups, reject malformed uploads, audit suspicious activity).
- To comply with legal obligations (anti-spam law for email, sales-tax reporting for some jurisdictions, payment-processor audit trails).
Data we do NOT do
[OPERATOR-VERIFY] Chokala does not sell personal data to third parties. Chokala does not share personal data with advertisers for cross-site targeting. Chokala does not run third-party advertising trackers on the Platform's own marketing surfaces. (Individual Creator profiles may embed third- party content — e.g. video players, embedded social posts — that operate under those third parties' own data-handling practices.)
Sub-processors
We use the following third-party services to operate the Platform. Each is under contractual obligation to handle your data only as directed by us. [OPERATOR-VERIFY: list current as of 2026-05-13]
- Heroku — application hosting, request logging.
- DigitalOcean — managed Postgres database (account + content data) and Spaces (uploaded media).
- PayPal — payment processing.
- Resend — transactional email (account verification, password reset, payment receipts).
- Cloudflare — DNS, edge network, DDoS protection. [OPERATOR-VERIFY]
Additional sub-processors may be added; material changes will be announced on this page.
How long we keep it
- Account rows: for as long as your account is active. After you delete your account, identifying information is removed within a reasonable window, except where retention is required by law or for legitimate business purposes (e.g. payment-audit records).
- Uploaded media: until the Creator removes it or terminates the account.
- Server logs: [OPERATOR-VERIFY: approximately 30 days at Heroku]
- Payment audit records: as required by applicable financial-regulatory and tax-reporting law (typically several years). [OPERATOR-VERIFY]
Your rights
- Access + export. You may request a copy of the personal data we hold about you by emailing privacy@chokala.gg.
- Correction. You may correct any inaccurate personal data via your account settings or by contacting us.
- Deletion. You may request deletion of your account and personal data by contacting us. We will respond within a reasonable window, subject to legal retention obligations.
- Unsubscribe from email. Use the unsubscribe link in any email from us, or contact us directly.
Residents of certain jurisdictions (California, the European Economic Area, the United Kingdom, and others) may have additional rights under applicable law. Contact us to exercise those rights. [OPERATOR-VERIFY: state explicit GDPR/CCPA framing if scope warrants]
Children
The Platform is not directed to children under 13 (or the relevant higher minimum age in your jurisdiction). We do not knowingly collect personal data from such children. If you believe a child has provided personal data to us, contact privacy@chokala.gg and we will delete it.
International data transfers
The Platform's infrastructure operates in the United States. If you access the Platform from outside the United States, your personal data may be transferred to and processed in the United States and other countries where our sub-processors operate. By using the Platform you consent to such transfers. [OPERATOR-VERIFY]
Security
We use commercially reasonable administrative, technical, and physical safeguards to protect personal data against unauthorized access, alteration, disclosure, and destruction, including encryption in transit (TLS) and at rest. No security measure is perfect, however; we cannot guarantee absolute security.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time. Material changes will be announced on this page or by email at least thirty (30) days before they take effect.
Contact
Privacy questions, data-subject-rights requests, or complaints: privacy@chokala.gg.
See also: Terms of Service,
Acceptable Use Policy,
DMCA Notice & Takedown,
Comprehensive disclaimers reference
— single-page consolidation of platform legal language for
historical reference + reviewer access. Each Creator's profile
operates under that Creator's own Privacy Policy; visit
chokala.gg/@<creator>/privacy for those.
Version v1-2026-05-13 — MVP. Full attorney review pending; tracked in ../chokalagg-internal-living-docs/internal-docs/legal-pass-required.md.