Privacy policy
Chikaboom is a workspace where a designer builds brand templates and a team fills them in and publishes social posts. This page explains what we store, why, and how you can remove it. Questions: hello@chikaboom.xyz.
What we collect
- Account: your email address. With "Continue with Google" we also receive your name and the fact that Google verified the email. We never see your Google password.
- Brand workspace content: brand kits (colors, fonts, logos), templates, text and images you add to posts, captions, schedules and approval notes.
- Uploads: images you upload or generate in the gallery.
- Connected tools, only if an owner sets them up: access tokens for Figma, Notion, Jira or social networks, and AI keys. They are stored server-side and never shown in the browser.
- Instagram, if a brand owner connects it: the Instagram account id and username, and an access token valid for 60 days that is renewed while posts go out. We use them only to publish the posts the brand schedules; when a post is published, its pictures and caption are sent to Instagram. We do not read followers, messages, comments or insights. Removing Chikaboom in Instagram deletes the connection and its token.
- Technical data: a session cookie that keeps you signed in; server logs (IP address, time, request) used for security and rate limiting; and usage events: which pages and features were used and when (for example "template opened" or "post scheduled"), never what you typed. When you are signed in they are linked to your account; before sign-in only to a code computed from your IP address and browser that changes every day and cannot be traced back. The IP address itself is not stored for this.
Why
To sign you in, show you the brands you belong to, render and schedule your posts, and keep the service secure. We do not sell personal data and do not use it for advertising. We use usage events to see where the product is hard to use and to improve it; we process them on the basis of our legitimate interest in improving the product.
Who processes it for us
- Railway hosts the application and its storage.
- Resend delivers sign-in and notification emails.
- Google handles "Continue with Google" sign-in.
- Anthropic runs the assistant (Copilot) and one-prompt post creation with Chikaboom's own key: it receives your prompt and the names and fields of the brand's templates, only when you use these features.
- Google Gemini and other image AI receive the prompt or image only when someone in the brand uses an image feature, with that brand's own key.
- X, LinkedIn and Instagram (Meta) receive the picture and caption of a post when it is published to an account connected by the brand.
- Figma, Notion, Jira and social networks exchange data only when a brand owner connects them.
When a brand owner connects Instagram to Chikaboom, we receive the Instagram account ID, username, and an access token valid for 60 days, renewed while posts are being published. We use this only to publish the posts the brand schedules: when a post is published, its pictures and caption are sent to Instagram. We do not read your followers, messages, comments or insights.
To remove Chikaboom's access, disconnect it on the Connections page, or remove Chikaboom in Instagram > Settings > Website permissions > Apps and websites. Either way we delete the connection and its token. See Delete your Instagram data for more.
Who can see your content
Members of the same brand and its owner (the agency that set it up). Nobody outside the brand has access. Every user gets a private copy of the demo brand AURORA to try things out.
How long we keep it
As long as your account or brand exists. Sign-in links expire after 15 minutes; sessions after 30 days. Rendered pictures that no post or history entry uses are deleted after 30 days. Backups of the service are kept for up to 14 days. Usage events are deleted after 90 days.
Your choices
In Settings → Your data you can download your data or delete your account yourself. Posts you made in a client brand stay with that brand without your email.
Or email hello@chikaboom.xyz to get a copy of your data, correct it or delete your account. We answer within 30 days. If you are in the EU/EEA you also have the right to complain to your data protection authority.
If your browser sends Global Privacy Control or Do Not Track, we record no usage events before you sign in.
The rules for using the service are in the terms of service.
Cookies
One essential session cookie, plus a short-lived cookie during Google sign-in. No advertising or analytics cookies.
Changes
If this policy changes we will update the date above and, for material changes, let signed-in users know.