Website Privacy Notice
This Website Privacy Notice covers the chocolatebar.app website, checkout, and email: buying a license, joining the waitlist, requesting the free trial, contacting support, and visiting these pages. It does not cover the ChocolateBar app, which has its own App Privacy Policy. None of the data described here flows back into the app, and using the app never requires any of it.
Who We Are
ChocolateBar is operated as a sole proprietorship by Aloysius Lim (“we”, “us”), who is the data controller responsible for the personal data described in this notice. For any privacy question or to exercise your rights, contact us at [email protected].
Data You Provide at Checkout
Payments are processed by Stripe. We do not see or store your card number, expiry, or CVC. From Stripe we receive: your email address, country, the last four digits of your card, the amount paid, the promo code (if any), and a Stripe customer/payment identifier. We use this data to issue your license, send your receipt and download link, and process refunds, on the lawful basis of performing our contract with you (GDPR Art. 6(1)(b)), and to meet tax and accounting obligations, on the lawful basis of complying with a legal obligation (GDPR Art. 6(1)(c)).
Data You Provide by Email, Waitlist, or Trial Form
If you email [email protected], join the waitlist, or enter your email in the 48-hour free trial form, we receive your email address and the contents of your message. We use it only to reply, deliver the requested item (for the trial, a download link sent by email), or notify you about launch, on the lawful basis of your consent and our legitimate interest in responding to you (GDPR Art. 6(1)(a) and (f)). For a trial request we also store a hash of your IP address and how many times you have downloaded the trial. You can withdraw waitlist consent at any time by asking us to remove you.
Website Analytics
Our website uses a lightweight, first-party, cookieless analytics script to understand which pages are useful. For each visit it records the page URL, the referring page, and link clicks, tied to a temporary session ID that lives in your browser’s session storage and rotates after 30 minutes of inactivity. Your IP address and browser user-agent are hashed on our server with a daily-rotating salt and are never stored in raw form, though a hashed identifier is still treated as pseudonymous personal data, not anonymous data. There are no cookies, no third-party advertising trackers, no cross-site profiles, and we never sell visitor data. Content blockers and Do Not Track are respected, which is also how you opt out. The lawful basis is our legitimate interest in understanding which pages are useful (GDPR Art. 6(1)(f)); we have weighed this against your privacy and limited it to the minimum described here. This analytics runs only on the website, never in the app.
Donations (Ko-fi)
The website shows an optional “Support Us” widget provided by Ko-fi. Loading it means your browser requests a script from Ko-fi’s servers, which receive standard request data such as your IP address and browser user-agent. We do not pass Ko-fi any information about you, and any donation you choose to make happens on ko-fi.com under Ko-fi’s own terms and privacy policy. Content blockers that block the widget do not affect the rest of the site.
Cookies and Local Storage
The website itself sets no analytics cookies. It uses only essential browser storage (for example, a session ID for analytics and remembering that you closed a banner). Stripe’s checkout uses its own cookies for fraud prevention and session continuity, governed by Stripe’s privacy policy.
Where Data Is Stored
Email and support records are stored in standard email infrastructure and may be processed in the United States, the European Union, or Singapore. Payment records live in Stripe’s systems. We do not operate user databases beyond what is necessary to fulfill purchases and reply to support.
How Long We Keep Data
Purchase and refund records are retained for as long as required by applicable tax and accounting law (typically up to seven years). Support emails are retained for up to two years unless you ask us to delete them sooner.
Sharing
We do not sell your personal data. We share it only with: (a) Stripe, to process your payment; (b) email and hosting infrastructure providers acting on our behalf under confidentiality obligations; and (c) authorities when required by valid legal process.
Your Rights
Depending on where you live (for example under the GDPR, UK GDPR, or California’s CCPA), you may have the right to access, correct, export, or delete personal data we hold about you, and to object to or restrict certain processing. To exercise any of these rights, email [email protected] from the address associated with your purchase.
Children
ChocolateBar is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact us and we will delete it.
Security
We use industry-standard practices to protect the limited data we hold, including TLS in transit and access controls. No method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.
Changes
We may update this notice from time to time. When we do, the effective date above will change and material changes will be announced on this page. Your continued use after a change means you accept the updatednotice.
Contact
Questions or requests about your data? Email [email protected].