1. Introduction
Chronigo (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and protect your information when you use our mobile application and services.
Chronigo is operated by Gregory Sanon, based in the United States. If you have questions about this policy, you can reach us at privacy@chronigo.com. See our Terms of Service for the rules that govern your use of the app.
Our Role as Data Controller
Chronigo is the data controller for all personal information collected through the Chronigo mobile app and services. This means we determine how and why your data is processed. We work with trusted data processors (service providers) who process data on our behalf under written agreements with strict data protection requirements.
2. Information We Collect
Account & Identity Information
- Email address, password (bcrypt encrypted), username, first and last name
- Profile picture (optional, stored in AWS S3 with unguessable URLs)
- Authentication and session tokens
Health Data
- Health metrics: glucose readings, blood pressure, weight
- Medications, dosages, and adherence tracking
- Goals, notes, logging history, and streaks
Facebook Integration (Optional)
If you choose to connect Facebook, we access:
- Facebook User ID: Stored in our database for account linking and friend matching
- Profile picture & name (public_profile): Displayed in-app; name stored for Connected Accounts settings, picture displayed via Facebook CDN (not permanently stored)
- Email address (email permission): Optionally stored for account linking and recovery
- Friends list (user_friends permission): NEVER STORED. Queried in real-time via Graph API, used only in-memory to find friends who also use Chronigo, then immediately discarded.
What We DO NOT Do With Facebook Data:
- We do NOT store your Facebook friends list in our database
- We do NOT store Facebook access tokens (used in-memory only)
- We do NOT access your Facebook posts, photos, or other content
- We do NOT send your health data to Facebook/Meta
- We do NOT automatically post to Facebook on your behalf
- We do NOT share Facebook data with third parties
- We do NOT use Facebook data for advertising
Device & Usage Data
- App version, device model, OS version, timezone
- Crash reports (Sentry) — retained for 90 days
- IP address, push notification tokens, usage analytics
3. How We Use Your Data
- Core Services: Health tracking, insights, medication reminders, streak calculation
- Social Features: Friend discovery (including via Facebook), challenges, leaderboards
- Account Management: Authentication, password resets, account verification
- Security: Fraud prevention, abuse detection, legal compliance
- App Improvement: Aggregated, anonymized analytics for product development
We do NOT sell personal data. We do NOT use health data for advertising. We do NOT share data with third parties for marketing purposes.
4. Facebook Data Handling
Facebook is completely OPTIONAL and NOT required to use Chronigo.
Permissions We Request
- public_profile: To display your name and profile picture in the app when you connect your Facebook account
- email: To match your Facebook connection with an existing Chronigo account or assist with account recovery
- user_friends: To find Facebook friends who also use Chronigo so they can connect and support each other’s health goals
What We Store vs. What We Don’t
When you link your Facebook account:
- We store your Facebook User ID, name, and optional email in our MongoDB database (US region)
- Your profile picture is displayed via Facebook’s CDN (not stored by us)
- Friend discovery queries Facebook’s Graph API in real-time
- The friends list is used only in-memory to find matches, then immediately discarded
- We NEVER store your friends list, access tokens, or any other Facebook content
No Health Data Shared With Meta
Your health data is NEVER sent to Facebook or Meta. No automatic posting to Facebook occurs. When you share challenges, the Facebook Share Dialog requires your manual confirmation each time.
Data Retention & Deletion
- While linked: Facebook ID, name, and email retained
- After disconnecting: All Facebook data deleted within 24 hours
- After account deletion: All Facebook identifiers deleted within 24 hours
- Friends list: Never stored — discarded immediately after each query
How to Disconnect Facebook
- Open Chronigo app
- Go to Menu → Settings → Connected Accounts → Facebook
- Tap “Disconnect Facebook”
- Confirm the action
- Your Facebook data will be deleted within 24 hours
Facebook Data Deletion Request: You can also request deletion through Facebook → Settings → Apps and Websites → Find Chronigo → Request data deletion. We will process the request and delete your Facebook identifiers within 24 hours. Check deletion status at: chronigo.com/privacy/deletion-status
6. Data Security
Encryption
- In Transit: TLS 1.2 or higher for all connections (TLS 1.3 preferred). SSL 2.0 and SSL 3.0 are disabled.
- No Plaintext Transmission: We NEVER transmit personal data, health data, or Platform Data in plaintext
- At Rest: AES-256 encryption for all stored data (health data, Facebook identifiers, profile images)
- Passwords: Bcrypt hashing with salt (never stored in plaintext)
Access Controls
- Multi-factor authentication for production access
- IP allowlisting for database and server access
- No staff access to production data on personal devices
- Role-based access control for admin functions
- Audit logging of all data access
Infrastructure Security
- Cloud-hosted on secure platforms (MongoDB Atlas, Render, AWS)
- Automated security patches and updates
- Regular security audits
- Isolated environments and container security
Security Vulnerabilities
Report security issues to security@chronigo.com or view our security policy on GitHub.
7. Your Rights & Choices
View, Export, or Delete Your Data
- View: Settings → Account → My Data
- Export: Request a full data export via privacy@chronigo.com (delivered within 30 days as JSON)
- Delete Account: Settings → Delete Account — all data permanently removed within 24 hours
- Disconnect Facebook: Settings → Connected Accounts — Facebook data deleted within 24 hours
- Privacy Settings: Settings → Privacy & Data — toggle visibility and sharing preferences
Multiple Deletion Methods
Method 1 — In-App: Settings → Account → Delete Account → Confirm. All data deleted within 24 hours.
Method 2 — Email: Send an email to privacy@chronigo.com with subject “Data Deletion Request.” Response within 48 hours; deletion within 72 hours of identity verification.
What Gets Deleted
- Account information and credentials
- All health data and medications
- Friend connections and challenge history
- Facebook User ID (if linked)
- Profile pictures from S3
- Push notification tokens
Opt-Out Controls
- Email: Unsubscribe via link in promotional emails
- Push Notifications: Disable in Settings → Notifications
- Social Features: Control visibility in Settings → Privacy
- Facebook: Disconnect anytime (immediate deletion)
GDPR Rights (EU/EEA Users)
If you are in the EU/EEA, you have the right to:
- Access: Request a copy of your personal data
- Rectification: Correct inaccurate data
- Erasure: Request deletion (“right to be forgotten”)
- Restrict Processing: Limit how we use your data
- Data Portability: Receive data in machine-readable format
- Object: Object to processing for direct marketing
- Withdraw Consent: Withdraw consent at any time
- Lodge Complaint: File a complaint with your supervisory authority
To exercise GDPR rights, email privacy@chronigo.com with subject “GDPR Request.”
CCPA Rights (California Residents)
- Know: What personal information we collect and how we use it
- Delete: Request deletion of your personal information
- Opt-Out of Sale: We do not sell personal data, so this does not apply
- Non-Discrimination: No discrimination for exercising your rights
To exercise CCPA rights, email privacy@chronigo.com with subject “CCPA Request.”
8. Data Retention & Deletion
- Health data: Retained until you delete it or delete your account
- Facebook data (while linked): Facebook User ID, name, and email retained while connected
- Facebook data (after disconnecting): Deleted within 24 hours
- Facebook friends list: NEVER stored — used in-memory only and immediately discarded
- Crash reports: 90 days, then deleted
- Backups: 7-day rolling retention, then purged
- Deleted accounts: All data permanently removed within 24 hours; backups purged within 7 days
- Aggregated metrics: Anonymized, de-identified analytics may be retained (cannot identify individual users)
9. Children’s Privacy
- Chronigo is not intended for children under 13 years of age (or 16 in the EU)
- We do not knowingly collect data from children under the applicable age limit
- Age verification via date of birth during onboarding
- If we discover data from a child under the age limit, we delete it immediately
- Parents or guardians: contact privacy@chronigo.com if you believe your child has provided us with personal information
10. International Data Transfers
- Primary storage: United States (MongoDB Atlas, Render, AWS S3)
- Safeguards: Standard Contractual Clauses (SCCs) for EU/EEA transfers
- Compliance: GDPR-compliant data protection measures
11. Changes to This Policy
- We may update this policy to reflect changes in practices, features, or legal requirements
- Material changes: Email notification + in-app notice. Material changes may require re-acceptance.
- Minor changes: Updated “Effective Date” above
- Continued use after changes constitutes acceptance of the updated policy
12. Contact Us
Chronigo is operated by Gregory Sanon, based in the United States. Mailing address available upon request via privacy@chronigo.com.
General Privacy Questions:
- Email: privacy@chronigo.com
- Response time: Within 48 hours
Data Subject Requests (GDPR, CCPA, Data Deletion):
- Email: privacy@chronigo.com
- Subject: “Data Request — [Your Request Type]”
- Response time: Within 30 days (GDPR), 72 hours (deletion)
Security Concerns & Vulnerability Reports:
- Email: security@chronigo.com
- Response time: Within 48 hours
General Support:
- Email: support@chronigo.com
Version History
| Version | Date | Changes |
|---|---|---|
| 3.0 | February 14, 2026 | Redesigned layout with sidebar navigation; enhanced meta tags for Meta crawlers; reorganized sections for clarity; moved operator identification to Contact section |
| 2.0 | November 3, 2025 | Added business identity block; cross-app tracking policy; enhanced Facebook data handling disclosures; detailed service provider information; version history |
| 1.0 | October 2025 | Initial privacy policy version |
Last Reviewed: February 14, 2026
Next Review: August 2026 (or as needed for legal/regulatory changes)