How we secure your data.

Encryption

CHOIL uses HTTPS to encrypt traffic between your browser and our website. Our database, authentication, and file storage provider, Supabase, documents AES-256 encryption for hosted data at rest and TLS encryption in transit. This includes account information and collection records stored there. See Supabase's security documentation.

This is not end-to-end encryption: CHOIL's servers and authorized operators can access data to provide the service. These protections also do not extend to copies you export or save on your own device.

Account information and access

Profiles start private. Your sign-in email, phone number, and giveaway shipping address are not public profile fields. Database access rules restrict private collection records to their owner; sharing features grant specific additional access. CHOIL checks signed-in identity on protected requests and checks roles for administrative functions.

Administrators have privileged access to operate the service. Support and moderation functions can also expose relevant account information to authorized staff. Encryption does not hide that information from authorized operators.

Receipts and photos have different visibility

Receipts use private storage. Opening a receipt requires owner access to generate an expiring link. Anyone you give that link to can open it until it expires.

Collection photos, message images, and avatars currently use public image links: anyone who has the image URL can view the image without signing in, even when the associated profile or collection is private. Keep addresses, identity documents, and other confidential information out of those images. Use the receipt attachment feature for receipts.

Sharing is a separate choice

Public profiles, item links, listings, posts, and shared wishlists make the content you choose visible to their audience. A public link can be forwarded. Comparisons use your sharing preferences. Review those settings and the information in your text and images before sharing; encryption does not make published content private.

Where your data is processed

Our primary database is hosted in Supabase's US East region in the United States. CHOIL also uses service providers for hosting, email, payments, diagnostics, and AI. Their processing and delivery networks may operate in other countries, so CHOIL does not promise that all data stays in the US.

AI and your information

CHOIL does not train AI models on your private collection. When you use an AI feature, we send relevant input, such as item details, your question, or a photo, to AI service providers to produce the result. Photo identification also uses Google Cloud to compare images. Uploaded collection photos may also be processed by Google Cloud in the background to prepare visual matches for your own collection. CHOIL's use of AI is separate from any provider's retention and processing policies; no training does not mean no retention. See our privacy policy for details.

Payments and service providers

Web payments use Stripe Checkout. CHOIL stores billing identifiers and subscription status, rather than your full card number or card security code. Other providers help deliver sign-in messages, hosting, diagnostics, and AI features. Relevant content is sent to those providers when the feature requires it; see our privacy policy.

Your controls and security questions

You can change sharing settings, export your collection, sign out of devices, and request deletion through your account. See how to delete your data. No online service can guarantee absolute security. If you believe information is exposed or your account is compromised, contact support@choil.app. Please do not send passwords, sign-in codes, or full payment details.