Privacy policy

Last updated October 16, 2026

This Policy describes the personal data Chesly processes to operate the Chesly mobile apps, the website at chesly.app, and related services (the “Service”). That data exists so the inbox can function, not so we can build a profile of you.

How we protect your data

Traffic to Chesly is encrypted in transit with TLS. Account credentials, email, and recovery backups are encrypted at rest with AES-256-GCM. We do not sell your data. We do not train AI models on your messages. You can delete your account at any time.

  • In transit. Connections between the Chesly apps, our API, and our servers use TLS.
  • At rest. Credentials, email content, and recovery material on our servers are encrypted with AES-256-GCM. On your phone, the local cache is encrypted with AES-256-GCM.
  • While an account is connected. Chesly is a bridge, so message data lives on our servers so the same inbox can show up on your phone, computer, and glasses. Disconnect the account or delete Chesly and that copy is removed.
  • Calls are not end-to-end encrypted. Call audio and video are encrypted in transit, are decrypted on Chesly’s servers and by our real-time media provider while a call is live, and are never recorded or stored.
  • AI is opt-in. Translation and Voice Transcription run only when you request them. AI Notifications, AI email categorization, and meaning-based search require explicit permission and the AI Notifications setting to be on. The app names OpenAI and TypeSafe and explains the content shared with each before asking for permission. Chesly does not train models on your message content.

1. Who we are

Chesly, Inc., a Delaware corporation (“Chesly,” “we,” “us”), operates a unified messaging inbox that bridges third-party messaging and email providers (such as Slack, WhatsApp, Telegram, Discord, Gmail, Outlook, Messenger, Signal, LinkedIn, Google Chat, Instagram, X, and Reddit) into a single client. For the GDPR/UK GDPR, Chesly is the controller of personal data described below. Privacy questions: privacy@chesly.app.

2. Information the Service needs to work

Chesly processes the categories below because they are required to provide the inbox you asked for. We do not process them to advertise to you or to train models on your conversations.

  • Account. A cryptographic identity you control (recovery phrase derived from BIP-39 wordlists), plus an optional display name, profile picture, and email so you can sign in and recover the account.
  • Connected providers. Linking WhatsApp, email, or another provider requires the access tokens, account identifiers, contact lists, group memberships, and message data that keep that connection working. Depending on the provider and connection method, that can include browser session cookies, session tokens, or an app-specific password that you enter. Those credentials stay on Chesly infrastructure only while the connection is active. Disconnect the provider in Chesly and revoke the session or app password with the provider to end that access.
  • Messages and content. Messages, attachments, photos, voice notes, and the WhatsApp statuses you view or post that pass through the Service so they can appear on each of your devices. A bridge cannot show the same inbox on your phone, computer, and glasses without holding that copy while the account is connected.
  • Voice and video calls. When you place or answer a call with a contact on WhatsApp, Telegram, or Signal, the call is connected through Chesly’s servers. While it is live, its audio and, in a video call, its video are decrypted and processed on our servers and by LiveKit, our real-time media provider, to pass them between the network and your device. Calls are not end-to-end encrypted, and their audio and video are never recorded or stored. Chesly uses your microphone, and your camera in a video call, only during a call you place or answer. We keep a record of each call (the network, the other party, voice or video, when it started and ended, and how it ended) so it can appear in your chats and on your other devices.
  • Contacts. If you allow contact access, saved names and contact photos from your device address book are used on that device to label conversations and show people you know. Contact photos stay on your device and are not uploaded. Contact access alone does not upload saved names either. Only if you separately enable the off-by-default Sync Contact Names setting does Chesly encrypt the saved names on your device and upload the encrypted blob so your other devices can show the same labels. Phone identifiers are hashed before they are included in the encrypted payload. Contacts are not used for advertising and are not shared with the providers you connect.
  • Sender avatar lookup. For email senders, Chesly may send a SHA-256 identifier derived from the normalized sender email to Gravatar and Libravatar to check for a public avatar. Although the raw address is not sent in that request, the identifier can still be associated with an email address and is treated as personal data. For business addresses, Chesly may also use the sender’s email domain to request a published BIMI logo or website favicon. These image requests are proxied through Chesly so the app does not expose your device network information to those avatar services. A saved device contact photo, when available, takes priority locally.
  • Precise location, only when you share it. If you send a location message or start sharing live location in a chat, the Service processes your device’s precise location to deliver it to that conversation. We never track your location in the background or use it for any other purpose.
  • Device and reliability. Device model, OS version, app version, language, timezone, country (derived from IP), crash logs, push notification tokens, IP address, and timestamps, used to deliver notifications, keep sessions working, and diagnose failures.
  • Support and waitlist forms. If you sign up for early access or contact us, the email address, optional name, and message you send are used to reply to you.
  • GIF search. When you open GIF search, Chesly requests trending GIFs from GIPHY. If you type a GIF search, the search terms are sent directly to GIPHY so it can return matching results.
  • Optional Android recovery backup. If you affirmatively choose recovery-phrase backup on Android, Chesly stores the phrase through Google Play services Block Store so it can be restored on another Android device signed in to your Google Account. Chesly enables cloud backup only after Block Store confirms end-to-end encryption is available on that device. You can delete this backup from Chesly’s recovery settings or by signing out.

The Service does not process browsing history, advertising identifiers, biometric templates, health data, or financial account numbers.

3. How this information is used

  • To operate the Service: relaying messages, syncing devices, sending notifications, providing support.
  • To secure the Service: fraud and abuse prevention, rate limiting, incident response.
  • To keep the Service reliable: diagnosing crashes and measuring aggregated usage. We do not profile you for advertising.
  • To comply with the law and enforce our Terms.

Where the GDPR applies, we rely on the performance of our contract with you, our legitimate interests in operating and securing the Service, your consent (where requested), and legal obligations.

4. Optional AI features

Chesly uses OpenAI and TypeSafe for optional AI features. Before enabling them, the app identifies the providers, explains the data and purposes below, and presents an Allow / Not now choice. One permission covers the disclosed optional features. Earlier permission naming only OpenAI does not authorize sharing with TypeSafe; the updated app asks again.

  • Translation: When Apple on-device translation is unavailable and you explicitly request translation, the selected message text and target language are sent to OpenAI to return a translation.
  • Voice Transcription: Selected voice-message audio is sent to OpenAI when you request a transcript.
  • AI Notifications: When enabled, incoming message text, recent conversation context, sender names, group-chat status, and custom notification rules are sent to TypeSafe to decide which notifications should alert you. OpenAI can process notification content instead when it is the active provider.
  • Email categorization: With AI Notifications enabled, sender names and email addresses, subjects, and bounded email text are sent to TypeSafe to organize the inbox and evaluate email notifications.
  • Meaning-based search: With AI Notifications enabled, a search query and a limited set of historical message texts, sender labels, and conversation identifiers are sent to TypeSafe to find relevant messages.

Turning off AI Notifications stops AI notification processing, AI email categorization, and meaning-based search. Translation and Voice Transcription remain request-driven. Tapping Not now does not grant the new permission. Chesly does not train models on your message content. The providers process the supplied data under their applicable service terms and agreements; Chesly does not promise TypeSafe zero retention.

5. Sharing

  • Providers you connect: to deliver the messages you send through them.
  • Service providers: companies that host the Service, deliver email or push notifications, process analytics, and provide cloud infrastructure; Google Firebase for Android push delivery and crash diagnostics; Google Block Store for the optional Android recovery backup; GIPHY for trending GIFs and GIF search; LiveKit for relaying call audio and video in real time; and OpenAI and TypeSafe for the optional AI features described above, all under written agreements (including SCCs where required). Every service provider with which Chesly shares personal data, including OpenAI and TypeSafe, is contractually required to provide the same or equal protection of user data as stated in this Privacy Policy and required by applicable app-store privacy guidelines.
  • Public avatar sources: Gravatar and Libravatar receive the hashed sender identifier described above solely to check for a public avatar; public BIMI and favicon services receive the sender’s email domain solely to retrieve a published company image.
  • Legal reasons: when required by law or to protect rights, property, or safety.
  • Business transfers: in a merger, acquisition, or sale of assets.

We do not sell or share personal information for cross-context behavioral advertising.

6. Retention

  • Account and message data: while your account is active.
  • Backups: up to 30 days.
  • Security and abuse logs: up to 12 months.
  • Tax and billing records: up to 7 years where required.

To delete your account at any time, see Delete your account.

7. Your rights

Subject to applicable law, you may access, correct, delete, port, or restrict the processing of your information, and withdraw consent. EEA, UK, and Swiss residents may lodge a complaint with their local data protection authority. California residents have the rights described under the CCPA/CPRA, including the right to know, delete, correct, and limit the use of sensitive personal information; we respect Global Privacy Control signals. To exercise rights, email privacy@chesly.app.

8. International transfers

Personal data may be processed outside your country, including in the United States. Where we transfer data out of the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses or other lawful mechanisms.

9. Children

The Service is not directed to children under 13 (or under 16 where required by law). We do not knowingly process personal information from children.

10. Security and cookies

In transit, we use TLS. At rest, account credentials, email, and recovery backups are encrypted with AES-256-GCM. Access to production systems is least-privilege. No system is 100% secure. The website uses minimal first-party storage (a flag for the early-access gate and an HttpOnly cookie set if your IP is blocked for abuse) and aggregate page-view analytics. No advertising cookies, no third-party trackers. To report a vulnerability, email security@chesly.app.

11. Changes

We may update this Policy. Material changes will be notified in-app or by email. The “Last updated” date reflects the latest revision.

12. Contact

privacy@chesly.app.