This Privacy Policy explains how Chrona ("we," "us," "our"), currently operated by Laurens Surya and Denny Ryanto as individual co-founders pending formal incorporation, collects, uses, shares, and protects information when you use the Chrona mobile application and related services (the "Service"). This Privacy Policy is incorporated into, and forms part of, our Terms of Service.
1. Information We Collect
Information you provide to us:
- Phone number, which we use to create and verify your account;
- If you sign in with Google or Apple, the information that provider shares with us for sign-in: an account identifier, your email address, and your name (and, for Google, your profile photo, if you have one). If you choose Apple's "Hide My Email" option, we receive only the relay address Apple creates for Chrona, not your real email address;
- Profile information you choose to add, such as your name and profile photo;
- Event and group details you or other group organizers enter, such as event names, descriptions, and locations;
- Photos or other media you choose to upload, such as profile pictures or event photos;
- Inputs to Chrona's AI-assisted scheduling and chat-based planning features, such as event details, questions, and any other context (including names of people you're planning with) that you choose to include; see Section 5 for how this data is handled;
- Safety information: if you block someone or report a person or plan, we store that block or report, including a copy of what was reported (such as a name, photo, or plan details at the time of the report) and any note you add, so our team can review it.
Information from calendars and contacts you connect:
- Calendar data, if you connect Google Calendar or Apple Calendar. Our access is read-only: we read your existing events (such as their title, time, location, description, and attendees) to show your schedule in Chrona, check availability, and suggest times to meet. We do not create, modify, or delete events on your connected calendar, and we do not use this data for advertising. You can disconnect a calendar at any time in the app's settings. Section 13 describes how we handle data from Google Calendar in particular.
- Your phone contacts, if you grant permission. We upload and store the names and phone numbers you grant us access to, so we can show you which of your contacts already have a Chrona account and let you invite the rest. You can revoke this permission at any time in your device settings; see Section 7 for how long we keep this data.
Information collected automatically:
- Push notification tokens issued by Firebase Cloud Messaging (FCM), used to deliver reminders and updates to your device;
- We do not collect your device's location. A place you add to an event (such as a venue name) is text you choose to enter, and when you search for a place, your search text is sent to Google Places to suggest matches;
- Device and usage information, such as device type, operating system, app version, and general diagnostic or log data, used to keep the Service running and to fix bugs.
Information from others:
- If someone shares a Chrona invite link with you or adds you to a group, the organizer's name, group details, and event preview information may be visible to you before you create an account.
2. How We Use Information
We use the information above to: operate and provide the Service (including generating invite links and their preview data); check availability and power scheduling suggestions using any calendar you connect; match your uploaded contacts against existing Chrona users and power invite suggestions; power Chrona's AI-assisted scheduling and planning features; send you notifications about groups, events, and invites; personalize your experience; maintain the security and integrity of the Service; diagnose technical issues and improve performance; and communicate with you about updates to the Service or these policies. We do not sell your personal data, and we do not use your calendar or contacts data for advertising.
3. Legal Bases for Processing
Where Indonesia’s Personal Data Protection Law (Law No. 27 of 2022, "UU PDP") applies, we process your personal data on the basis of: your consent (for example, when you connect a calendar, grant contacts or notification permissions, or choose to use AI features); the performance of a service you have requested (creating your account and enabling scheduling features); and our legitimate interests in operating, securing, and improving the Service, weighed against your rights.
Where the laws of the European Economic Area, United Kingdom, or other jurisdictions with similar frameworks (such as the GDPR) apply to you, the same bases apply (consent, contractual necessity, and legitimate interest), and you have the additional rights described in Section 8.
4. How We Share Information
We do not sell your personal data. We share information only as follows:
- With other users, as inherent to the Service: for example, your name, profile photo, and RSVP status may be visible to members of a shared group, and invite-link preview data (such as event name and image) may be visible to anyone who receives the link;
- With service providers who process data on our behalf, currently including Google LLC (Firebase Authentication, Firebase Cloud Messaging, and Google Cloud Platform, used for sign-in, hosting, push notifications, and backend infrastructure), under their own data-processing and security commitments;
- With Google or Apple, if you choose to sign in with them, to verify your identity. If you signed in with Apple and later delete your Chrona account, we also ask Apple to revoke Chrona's access to your Apple ID;
- With Google or Apple, solely to read events from a calendar you've chosen to connect, as described in Section 1; this exchange is governed by that provider's own terms and privacy policy in addition to ours;
- With Google LLC, through Google Cloud Vertex AI, to run Chrona's AI-assisted features when you use them (see Section 5 for details);
- With WhatsApp, only in the limited sense that WhatsApp's own systems fetch publicly available link-preview metadata (such as an event title and image) when a Chrona invite link is opened or shared on WhatsApp. This is standard link-preview behavior, governed by WhatsApp's own privacy policy, and does not involve us otherwise transmitting your personal account data to WhatsApp or Meta Platforms, Inc.;
- If required by law, legal process, or to protect the rights, safety, or property of Chrona, our users, or the public;
- In connection with a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy continuing to apply to your data.
5. AI Features & AI Processing (Google Gemini)
Chrona's AI-assisted scheduling and chat-based planning features are powered by Google's Gemini models, which we access through Google Cloud Vertex AI under our Google Cloud agreement. We have configured these features (through system-level guardrails) to focus on scheduling- and event-planning content. This reduces, but does not eliminate, the chance that a prompt includes personal information about someone else: Chrona does not verify whether a person referenced in your prompt is a Chrona user, and the guardrails are not a technical filter on the content of what you type. When you use these features:
- the text you enter, including event details and any other context you choose to include (which may reference names or other information about you or people you're planning with), is sent to Google Cloud Vertex AI to generate a response, along with the plans you have made in Chrona;
- content from calendars you connect (Google Calendar, Apple Calendar) is never sent to the AI model: the AI may learn the times you are busy, but never what those events are, where they are, or who is attending;
- neither we nor Google use this data to train AI models: we do not train models on it, and under Google Cloud's terms Google does not use data sent to Vertex AI to train its models and processes it only to provide the service to us;
- you should not enter highly sensitive personal information about yourself or others into Chrona's AI features, and you should not include information about another person unless you have the right to share it.
6. International Data Transfers
Our primary hosting and backend infrastructure runs on Google Cloud Platform in Singapore. Depending on the third-party provider, your information may also be stored or processed on servers located outside Indonesia or your home country, for example Google Cloud Vertex AI processing described in Section 5, which may take place in any region where Google operates, or a calendar provider's own infrastructure. Where required by UU PDP, GDPR, or similar law, we take reasonable steps to ensure such transfers are subject to appropriate safeguards, such as our providers' standard contractual protections.
7. Data Retention
We retain your personal data for as long as your account is active or as needed to provide the Service. You can request deletion of your account at any time directly within the Service, from the app's account settings, or from the web at chronaworld.com/delete-account (for example, if you no longer have the app installed); deletion requests are reviewed and fulfilled by our team and may not be instantaneous. If you delete your account, we will delete or anonymize your personal data within a reasonable period, except where we are required to retain it to comply with legal obligations, resolve disputes, or enforce our agreements. While a calendar is connected, we keep a copy of its events so Chrona can show your schedule and check availability, and we update that copy as your calendar changes. When you disconnect the calendar or delete your account, we revoke Chrona's access to it and delete that copy. Uploaded contacts are retained for as long as your account is active, or until you revoke contacts permission or delete your account, whichever comes first. Reports are kept while they are under review and deleted 12 months after they are resolved. Blocks are kept until you unblock the person or either account is deleted.
8. Your Rights
Subject to applicable law, you may have the right to: access the personal data we hold about you; request correction of inaccurate data; request deletion of your data, including through the in-app deletion option described in Section 7; withdraw consent (for example, by disconnecting a calendar, revoking contacts or notification permissions, avoiding Chrona's AI features, or deleting your account); object to or restrict certain processing; and request a portable copy of your data. Users in Indonesia may exercise these rights under UU PDP; users in the EEA, UK, or other jurisdictions with similar data-protection frameworks may exercise equivalent rights under those laws. To exercise any of these rights, contact us at support@chronaworld.com. We may need to verify your identity before fulfilling a request.
9. Children's Privacy
Chrona is not directed to children under 16, and we do not knowingly collect personal data from children under that age. If you believe a child has provided us with personal data, please contact us at support@chronaworld.com so we can delete it.
10. Security
We use reasonable administrative, technical, and organizational measures, including those provided by our infrastructure providers (Google Cloud, Firebase), to protect your information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
11. Third-Party Links & Platforms
The Service may contain links to third-party platforms (such as WhatsApp, where you choose to share a Chrona invite link) that are governed by their own privacy policies. We are not responsible for the privacy practices of third parties.
12. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice, such as an in-app notice, before the changes take effect. The "Last Updated" date at the top of this policy reflects the most recent revision.
13. Google User Data
If you connect Google Calendar, Chrona requests read-only access to your calendar events (the calendar.events.readonly permission). We use the event details we receive (such as title, time, location, description, and attendees) only to show your schedule in Chrona, to find times when you and the people you plan with are free, and to warn you about clashes. We never create, change, or delete events in your Google Calendar.
We do not sell Google user data, use it for advertising, or use it to develop, improve, or train generalized artificial intelligence or machine learning models. We do not send the content of your Google Calendar events to our AI provider; it may learn only the times you are busy, as described in Section 5. We do not allow humans to read Google user data, except with your explicit consent for a specific request (for example, a support request), where needed for security purposes or to comply with applicable law, or when the data has been aggregated and anonymized for internal operations.
You can disconnect Google Calendar at any time in Chrona's settings. When you do, we revoke Chrona's access to your Google account and delete the calendar events we copied from it. You can also remove Chrona's access from your Google Account at myaccount.google.com/permissions.
Chrona's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
14. Contact Us
If you have questions or requests regarding this Privacy Policy or your personal data, please contact us at support@chronaworld.com.