Privacy Policy

Last updated August 23, 2026

This policy explains what CHB Mate (the “Service”), operated from chbmate.com, collects about you, why it is collected, who else receives it and how long it is kept. It is part of the Terms of Service and uses the same words in the same way.

1. Who we are and how to reach us

CHB Mate is operated at chbmate.com. Email is how you reach us: [email protected]. Send privacy questions, access and deletion requests, and complaints to that address.

2. What we collect, and why

You cannot browse the Service anonymously and then be profiled: signing in with Google is the one way in, and everything below follows from it apart from the technical records that any website keeps.

• Account information — the email address and account identifier your Google sign-in gives us, and a record that you accepted the terms. We ask Google only for the openid and email scopes, so we do not receive your name, profile picture, contacts or any other Google data. We never receive your Google password and store no password of our own.
• Subscription and payment information — your plan, what has been charged and when, and the identifiers PayPal gives us so that a renewal can be taken. Card and bank numbers never reach the Service — you enter them at PayPal, and PayPal holds them.
• Your use of the Service — a record of the lookups you run, including the codes you look up, and of what happened on your account.
• Technical records — the ordinary records a website and its network provider keep about requests, used for security and troubleshooting.

We collect this to sign you in, to run and bill your subscription, to answer your support questions, to enforce the usage limits and fair-use rules in the terms, and to investigate suspected abuse. None of it is collected for advertising, and we do not build profiles of you or buy information about you from anyone.

3. The codes you look up

When you are signed in, we keep a record of the lookups you run, including the codes searched. We read it to answer support questions and to look into suspected scraping or account sharing — nothing else, and never to advertise to you. We do not sell it and do not share it for advertising (section 4).

If your lookups involve information your own clients treat as confidential, be aware that a record is kept as described here, and satisfy yourself that this is compatible with your obligations to them.

4. Who else receives your information

• Google — signs you in, and tells us your account identifier and email address. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
• PayPal — takes the payments. It holds your card or bank details; we hold only its identifiers and your permission to charge.
• Mailgun — delivers our service and billing email, and so receives your email address and the contents of those messages, for that purpose and no other. Those messages never include your lookup activity, and we do not use open or click tracking in them.
• Cloudflare — sits in front of the site as its DNS and network provider, so requests to chbmate.com pass through it.
• Our hosting provider — runs the server the Service and its database sit on.

Each of those handles your information under its own terms and privacy policy. Beyond them, we may disclose information where the law requires it or to protect our rights, and may transfer it as part of a merger, acquisition or sale of assets. We do not sell your personal information and we do not share it for cross-context behavioral advertising.

5. How long we keep it

We keep what is described above for as long as your account is open, and afterwards for as long as we need it to support you, protect the Service against abuse, resolve disputes and meet our tax and legal obligations.

Payment records are kept indefinitely, including after an account is erased. They are the evidence of what was charged, when and why; disputes and chargebacks are raised long after the payment itself, and there are tax records to keep. A record deleted or edited would be no use to either of us at that point.

6. Access, correction and erasure

Email [email protected] from the address on your account to ask for a copy of what we hold about you, to have something corrected, or to have your account erased. We respond within 30 days.

Erasure closes your account and removes the identifiers we are able to remove. Records we need to keep stay with us for the reasons in section 5 — payment records above all. Asking us to erase your account is not a refund request and does not by itself stop a subscription — use Cancel plan on your subscription page to do that.

7. Cookies

The Service sets one cookie, named chbmid. It holds a session identifier and nothing else, is marked Secure and HttpOnly with SameSite Lax, and expires when you close your browser — the real expiry is on our side, after 8 hours of inactivity or 24 hours in total. Without it you cannot stay signed in. Cloudflare, which sits in front of the site (section 4), may set its own cookies to tell real visitors from bots; those carry no advertising or analytics purpose and nothing here reads them.

There are no advertising cookies, no analytics and no third-party trackers on this site, so there is no cookie banner and nothing to opt out of.

8. Do Not Track

We do not track you across other websites, so a Do Not Track or Global Privacy Control signal has nothing here to switch off. We treat those signals as already satisfied.

9. California residents

Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, you may ask what personal information we have collected about you, ask for a copy of it, ask us to correct it, and ask us to delete it — the same requests as section 6, made the same way, answered within 30 days. We will not treat you differently for making one.

We do not sell personal information and we do not share it for cross-context behavioral advertising, and we never have, so there is no “Do Not Sell or Share My Personal Information” link to offer. The categories we collect, why we collect them and how long we keep them are listed in sections 2 to 5.

10. Children

The Service is offered to trade professionals in the course of business and is not directed to children. You must be at least 18 to use it. We do not knowingly collect information from anyone under 13; if you believe a child has given us information, email [email protected] and we will delete it.

11. Security

The site is served over HTTPS only. Card and bank details never touch it. Sign-in is delegated to Google, so there is no password of ours to steal, and the session cookie is Secure and HttpOnly. Values that look like a secret are stripped before anything is written to our records. No system is perfectly secure, and we do not promise that one is.

12. Changes to this policy

We may update this policy. The date at the top of the page changes when we do, and a change that materially affects how we handle your information will be accompanied by a new version of the terms, which you will be asked to accept before continuing to use your account.