Privacy Policy

ChipInPot helps groups create shared financial goals ("Pots"), collect participant commitments and payments, and enable organizers to withdraw eligible contribution funds. This Policy explains what information we collect, how we use it, and when we share it.

Related documents: our Terms of Service and Stripe's privacy materials for payment processing.

Information you provide

• Organizer information: email address; optional display name; Pot title and description; contribution amounts; number of spots; deadlines; and related Pot settings. Organizers who use Google or Apple sign-in also provide identity information through those providers (for example a verified email and a provider subject identifier).
• Participant information: first name, last name, email and/or phone (as collected in the commitment flow), and other details you enter to join a Pot.
• Support communications: information you send to us (for example, to support@chipinhive.com).
• Access credentials you create with us: session cookies and related session identifiers. Where applicable, hashed capability tokens may remain for legacy Pot links. We do not email recovery codes.

Payment information

Card details (such as full card number and CVC) are collected directly by Stripe through Stripe's payment interfaces (for example, Payment Element). ChipInPot does not receive or store full card numbers or CVC.

ChipInPot may receive and store payment-related information needed to operate the Service, including Stripe customer IDs, payment method IDs, payment intent IDs, refund IDs, amounts, currency, payment and refund status, and limited card display metadata (such as brand and last four digits) retrieved from Stripe for features like rejoining with a saved payment method.

Organizers who withdraw funds complete Stripe Connect onboarding (Express connected accounts). Identity verification documents, bank account details, and similar sensitive onboarding data are collected and processed by Stripe.

ChipInPot may store and use connected-account identifiers, onboarding and payout readiness status, and payout or transfer metadata needed to show status in the product and to initiate transfers or payouts according to product rules.

We process records related to:

• contribution amounts and fee breakdowns for commitments;
• Pot funding progress and status;
• payment attempts and outcomes;
• refund status and refunded amounts;
• organizer withdrawal requests, transfers, and payouts;
• Stripe event identifiers and related webhook payloads used for reliable processing.

Depending on how you use ChipInPot, we may process:

• Approximate network information such as IP address, used in limited ways (for example, rate limiting for organizer recovery flows). We do not store IP addresses as a dedicated profile field in our application database. Our analytics provider may also receive IP addresses as part of delivering the analytics service, which can imply approximate location.
• Operational logs generated by our hosting and application infrastructure (which may include request metadata, error details, and operational identifiers).
• Error and performance monitoring via Sentry, which may receive crash and error reports, stack traces, performance traces (for example page loads and API calls), device/browser information, and an authenticated organizer's internal account identifier. Sensitive URL query parameters are stripped before events are sent. Sentry session replay is not enabled. Sentry does not process payments.
• Browser storage we set for product features (see Cookies and similar technologies).
• Product analytics and usage information collected through PostHog when analytics is enabled in your browser. This can include pages and screens viewed; buttons and features used (as specific product events we send, such as creating a Pot or starting checkout); navigation and interaction events; referring page or source; device and browser information; timestamps; an anonymous visitor or session identifier; an authenticated organizer's internal ChipInPot account identifier after sign-in (not your email as the analytics ID); and product events such as Pot creation, sharing, checkout progression, payout setup, and leftover-fund returns.
• Session replay: when product analytics is enabled, ChipInPot uses PostHog session replay so we can replay how someone moved through the service (for example, clicks, scrolling, and page transitions) to understand usability and diagnose technical issues. This is not limited to anonymous aggregate statistics — a session can be replayed. Input values are masked, Stripe payment fields and other sensitive screens are blocked from capture, and sensitive URL query parameters (such as access tokens) are stripped. Guest participants are not identified in analytics by email.

We do not use third-party advertising SDKs or sell analytics data for cross-context behavioral advertising. We do not send card numbers, CVCs, bank details, Stripe secrets, OAuth or session tokens, magic-link tokens, passwords, or raw Stripe payment objects to PostHog.

We use information to:

• provide, operate, and maintain ChipInPot;
• create and manage Pots and commitments;
• process payments, refunds, and organizer payouts;
• authenticate organizers and participants (including magic links and sessions);
• send transactional emails (for example, Pot created, commitment confirmation, recovery links, cancellation, and refund notices);
• detect abuse, prevent fraud, and enforce rate limits;
• provide customer support;
• secure the Service and debug operational issues;
• understand how ChipInPot is used, improve features and usability, and diagnose technical problems (including via product analytics and session replay where enabled);
• comply with legal obligations; and
• improve ChipInPot based on operational needs.

We share personal information with:

• Stripe — payments, refunds, Connect onboarding, and related financial processing. PostHog does not process payments.
• Sentry — error monitoring and performance tracing as described in this Policy. See sentry.io/privacy. Sentry does not process payments.
• PostHog — product analytics and session replay as described in this Policy. See posthog.com/privacy.
• Google and Apple — organizer social authentication (Sign in with Google / Sign in with Apple). Those companies process sign-in according to their own terms and privacy policies.
• Cloud and infrastructure providers — hosting and related services used to run the web app, API, databases, queues, secrets, and logging (including Vercel for the web application and Amazon Web Services for API and related infrastructure, plus managed Postgres hosting used by the deployment);
• Email delivery providers — transactional email (for example, Amazon SES where configured);
• Other users of a Pot — limited information needed for the product experience (for example, participant display names and commitment status visible to organizers; Pot details visible on the shared Pot page);
• Professional advisors and authorities where reasonably necessary for legal, security, or compliance purposes.

Stripe processes payment and Connect data as an independent payment provider. Stripe's privacy practices are described in Stripe's own documentation, including stripe.com/privacy.

ChipInPot's use of Stripe does not mean Stripe endorses ChipInPot.

We do not sell personal information for money. We also do not share personal information for cross-context behavioral advertising. If that changes, we will update this Policy and provide any notices or choices required by law.

ChipInPot uses cookies and browser storage for essential product functions, including:

• HttpOnly cookies for organizer session and organizer recovery-session authentication where applicable;
• localStorage / sessionStorage for participant session tokens, cancel/rejoin helpers, pending checkout state, and similar product continuity features.

These technologies keep you signed in to the relevant flows and help complete commitments securely. We do not currently use third-party advertising cookies.

When product analytics is enabled, PostHog also stores a first-party cookie and/or localStorage values (typically names starting with ph_) for an anonymous visitor identifier and session continuity. ChipInPot may also store an analytics opt-out flag in localStorage on this device. Analytics storage is not required to use ChipInPot; you can turn it off as described in Your choices and rights.

We retain information for as long as reasonably necessary to provide ChipInPot, comply with legal obligations, resolve disputes, prevent abuse, and enforce our agreements. Infrastructure logs may be retained according to our hosting configuration and provider defaults.

Product analytics and session replay retention is configured in PostHog's project settings (not in this website's source code). We intend to keep replay data only as long as it is useful for product improvement and support, not indefinitely. Contact us if you have questions about a specific request.

We use reasonable administrative, technical, and organizational safeguards appropriate to the nature of the Service, including hashed storage of sensitive tokens where applicable and reliance on Stripe for card data handling.

No method of transmission or storage is completely secure. We cannot guarantee absolute security of information.

Depending on your situation, you may:

• update information by contacting support or using in-product flows where available;
• request access, correction, or deletion of personal information by emailing support@chipinhive.com;
• stop using ChipInPot and clear browser storage on your device;
• turn off product analytics (including session replay) in this browser, or ask us about analytics/privacy preferences by emailing support@chipinhive.com;
• manage communications preferences where required by law (transactional messages related to payments and account security may still be sent when necessary).

We will respond to requests in accordance with applicable law. We may need to verify your identity and may retain information as required for legal, security, or operational reasons. If you are an authenticated organizer, we can look up analytics records associated with your internal ChipInPot account identifier. Guest participants are not identified in PostHog by email.

Residents of certain U.S. states (including California) may have additional rights regarding personal information, such as the right to know, delete, correct, or opt out of certain processing, subject to legal exceptions.

To exercise applicable rights, contact support@chipinhive.com. We will not discriminate against you for exercising privacy rights available under law.

ChipInPot is operated from the United States. If you access ChipInPot from outside the United States, your information may be transferred to and processed in the United States and other countries that may have different data-protection rules than your home country.

ChipInPot is not directed to children under 18, and we do not knowingly collect personal information from children under 18. If you believe a child has provided information, contact us and we will take appropriate steps.

We may update this Privacy Policy from time to time. We will post the updated Policy with a revised version and effective date. If we make material changes, we may provide additional notice, such as by email or through the Service, as appropriate or required by law. A notice about an update does not by itself constitute consent where a separate choice is required.

Privacy questions: support@chipinhive.com.