doingthings.

CHISPA · LEGAL

Privacy policy

Last reviewed: 31 August 2026.

Summary

You can use Chispa without an account. History is created and kept first on the device. If you choose to sign in and enable sync, Chispa encrypts history on your device before sending it; Doing Things stores the encrypted content but does not hold the key needed to read it.

Data stored in the app

The app stores fast sessions and corrections, protocol, time-reference, preferences, onboarding status and security responses locally. iOS shares a minimal summary with its widget and Live Activity; Android shares it with its widget and active notification inside the app's private storage. Security responses remain local and are not included in synced backups. Chispa does not access Apple Health, Health Connect, location, contacts, photos, microphone or camera, nor does it record weight, hydration, calories, activity, notes or metabolic measurements.

Account and encrypted sync

The account is optional. When signing in with Apple or Google we receive the provider identifier and, depending on what they share, name, email, verification status and image. We retain access sessions, technical security data and linked providers. If you enable sync, we store an encrypted vault, encrypted recovery envelopes, version and update date, and device technical info such as platform, app version and a random identifier. History leaves the device only as end-to-end encrypted text.

Site and technical data

When visiting this website, Cloudflare may process your IP address, date and time, requested URL, technical security identifiers and basic browser data to deliver content, prevent abuse and maintain availability. Doing Things does not add third-party analytics or advertising cookies.

Support messages

If you email support or privacy, we will process your address, message content and any data you choose to provide to respond, investigate the issue and meet legal obligations. Do not send medical information that isn’t necessary.

Purposes and choice

We use account data to authenticate you, link providers, maintain the session, sync the encrypted vault, allow recovery and deletion, prevent abuse and handle support. Technical data is used to deliver and protect the app and website. We do not use it for advertising, commercial profiling or selling data. You can continue to use local features without creating an account.

Notifications

If you grant permission, Chispa schedules local alerts on your device. Doing Things does not receive their content or scheduling; you can disable them in Profile or your system settings.

Purchases and stores

Apple or Google process Chispa Plus as the operators of their respective stores. Doing Things does not receive your card details; the store only communicates the status needed to enable the purchase. Their policies govern the account, payment and refunds.

Providers and communications

Cloudflare provides the API, database, hosting, delivery and protection for the app and website. Apple and Google provide sign‑in and, where applicable, store and payment. These providers may process data in other countries under their terms and applicable mechanisms. We only disclose data when necessary to deliver, protect or support the service, or when required by law. We do not sell personal data.

Retention

Local data stays on your device until you delete it or uninstall the app. Account data, devices and end-to-end encrypted sync are retained while you keep the account and are deleted once you confirm account removal, except where a legal obligation requires otherwise. Sessions expire after a limited time and technical logs and support messages are kept only for as long as operational, security or legal needs require.

Your rights

You may request access, correction, erasure or objection, withdraw consent or restrict use and disclosure by emailing the privacy address with your name, the specific request, the data affected and a means to receive a reply. We may ask for minimal information to verify your identity and will respond within applicable legal timeframes.

Export and deletion

You can export your history, delete local data and delete your account from Profile. Confirmed account deletion removes the profile, sessions, devices, linked providers and all encrypted content stored by Chispa. It does not cancel an App Store or Google Play subscription. Doing Things cannot recover deleted data, decrypt the vault or access the destination you choose for an export.

Security and minors

We apply minimisation, platform private storage, HTTPS transport and reasonable protective measures. No system is infallible. Chispa is not directed at minors and the safety questionnaire disables the timer where appropriate.

Changes and contact

We will publish any changes at this same URL and indicate the review date. The identity of the responsible entity, its address and the privacy and ARCO rights email appear at the end of this policy.

Controller and contact

Owner
ZONK MEDIA, CORP
Tax identifier (EIN)
32-0846732
Address
7345 W Sand Lake Rd, Ste 210, Office 8164, Orlando, FL 32819, United States
Registration
2026-001910870
Country
United States
Governing law and jurisdiction
Leyes de México y tribunales mexicanos competentes, sin perjuicio de los derechos imperativos del consumidor.