Privacy Policy

This Privacy Policy explains how Lets Handshake Inc., doing business as Chekkd ("Chekkd", "we", "us"), handles information when you use www.chekkd.com, app.chekkd.com, the Chekkd iOS app, the Chekkd Android app, and the Chekkd service.

Chekkd collects the information needed to create an account, operate verification levels, protect the service, and carry out sharing or connection actions you request.

• Account and profile information, including your name, email address, phone number, mailing address, authentication records, and the profile fields you choose to publish.
• Identity Verification records, including provider references, completion and review outcomes, and limited identity fields returned to operate the verification, such as name, date of birth, address, and document type.
• Current Bank-connection records described below, limited to the provider connection and masked account metadata needed for Level 4 and account management. Earlier Bank versions may also have created bank-held identity, identity-match, or balance-enrichment records; those legacy records are not used by the current Bank flow and remain subject to Chekkd's reviewed retention and deletion process.
• Security and service information, including login history, IP address, browser or device context, verification requests, Connections, and audit records.
• Optional analytics data described below when analytics is permitted for your region and preferences.
• Safety reports you submit, including the reason, optional details, the member or request you reported, and the time. Blocks you create, including the member you blocked and the time. We use blocks to hide that member's profile, ratings, and requests from you and to stop interaction between the accounts.

You can sign in with Apple, Google, LinkedIn, X, or Meta. When you do, Chekkd receives the account identifier the provider supplies, your name, and your email address, including an Apple private-relay address when Apple provides one, plus a profile photo when the provider supplies one. Chekkd does not receive your password from these providers.

Plaid Identity Verification handles document and liveness capture. Plaid may process identity and biometric information under its own notices. Chekkd receives the limited results and fields needed to operate your verification record; this is separate from the Plaid Link bank connection described below.

If you choose to connect a bank, Chekkd uses Plaid Link to confirm that you can connect and control an eligible financial account and to establish or maintain Level 4 — Bank. Bank proof reflects connection evidence and connection health; it is not a payment, lending, creditworthiness, solvency, account-standing, or available-funds determination.

• Chekkd keeps the encrypted Plaid connection token and Item identifier required to manage the connection.
• Chekkd keeps the institution name and selected account metadata needed to display and manage the connection, such as account name, type, subtype, and masked identifier.
• Chekkd keeps connection-health status and relevant connection, repair, removal, and security timestamps.

The current Level 4 flow does not collect new bank-held Identity or Balance enrichment. Earlier versions may have created bank identity, identity-match, balance-snapshot, or related derived records. Those records are not used by the current connection flow; Chekkd is reviewing the appropriate retention or deletion treatment and will honor applicable deletion and legal-retention requirements.

Plaid may process information from your financial institution under Plaid's own privacy policy and the choices shown in Plaid Link. This section describes what Chekkd receives and keeps.

Review how Plaid handles information: Plaid End User Privacy Policy

• Operate your Passport, Verification levels, TrustBadge, account access, and Connections.
• Verify evidence, prevent fraud and abuse, and protect service integrity.
• Display profile and verification fields on your Public Passport according to your Privacy settings. Public Passports are on by default and can be turned off at any time.
• Maintain, troubleshoot, secure, and improve the service.
• Send requested service messages, security alerts, and notifications.
• Comply with valid legal obligations and enforce our terms.

We disclose information to service providers as needed to operate Chekkd, on your Public Passport according to the defaults and choices described here, to a recipient when you direct a Connection or sharing action, or when valid legal process or safety and fraud-prevention needs require it. A Public Passport is on by default and may include your display name, avatar, and customer-safe Verification level state according to your settings. You can turn the Public Passport off at any time. When it is on, a provider-supplied public social profile link is shown by default; you can hide all connected profiles or any individual profile in Privacy settings.

Chekkd uses layered safeguards appropriate to the service, including TLS for supported client-to-service transport, encrypted Plaid access tokens at rest, authenticated ownership checks for Bank management, verified provider webhooks, access controls, and bounded operational logging. Provider access tokens are not returned to the browser.

No system can guarantee absolute security. See our public Security page for a current, plain-language summary and contact support@chekkd.com if you believe your account or information is at risk.

We retain information only for as long as needed to provide and secure the service, preserve required audit evidence, resolve disputes, and meet legal obligations. Retention depends on the category and purpose rather than a single period for every record.

Where self-service removal is available, review it in Settings in the Chekkd iOS app, the Chekkd Android app, or on the web. Removal runs in verified stages: Chekkd restricts access, removes linked Plaid Items, revokes a saved Apple authorization when available, removes mapped personal data and files, and deletes the sign-in. If a stage cannot be confirmed, the saved request pauses for retry. A limited internal removal record and de-identified shared history may remain, along with provider records, backups, delivered messages, separate Lounge or marketing records and text outside mapped account records. If no Apple token was saved, you can still remove Chekkd and stop using it in your Apple Account settings. Contact support@chekkd.com if self-service removal is unavailable. Copies held by Plaid, Apple, Google, LinkedIn, X, and Meta follow those providers' schedules.

Disconnecting a bank asks Plaid to remove the Item, removes that connection from active Bank evidence, and prevents it from continuing to support Level 4. Deleting your Chekkd account is a separate action and also removes linked Items. Plaid may retain or delete Plaid-held information under its own policy and privacy controls.

• Access: request a copy of your personal data.
• Correction: update or correct inaccurate information.
• Deletion: delete your account yourself in Settings. The deletion section describes what is removed, anonymized, or kept. You can also email support@chekkd.com.
• Portability: export your data in a machine-readable format.
• Opt-out: unsubscribe from marketing communications.
• Object: object to certain data-processing activities.
• Revoke consent: withdraw consent for sharing with specific partners.
• Passport visibility: turn your Public Passport off at any time and control the profile fields and links it displays.

To exercise these rights, contact us at support@chekkd.com.

• Essential storage: authentication, session management, security, and remembering your privacy choice.
• Optional analytics: pseudonymous page, acquisition, engagement, and completed-funnel events processed through Chekkd's first-party analytics backend and Google Analytics 4. Analytics is enabled by default for visitors identified as being in the United States unless they previously turned it off or use a supported Global Privacy Control signal. Prior opt-in is required for other countries and when location is unavailable.
• Public-page measurement: privacy-filtered, cookieless Vercel Web Analytics measures only public marketing and landing routes separately from the optional analytics setting; private account and admin routes are excluded.
• Optional experience measurement: only after a separate explicit opt-in, Microsoft Clarity processes clicks, scrolling, masked page layouts and device/browser information on public website pages and selected core app screens to provide heatmaps and session replay. Personal text and images are masked. Credential entry, identity-document, banking, admin, private-link and unrecognized URL-parameter pages are excluded. Recognized campaign-link values and referrer metadata are removed before upload. Browser privacy signals keep this off. This is separate from Google Analytics consent and is not required to use Chekkd.
• Preferences: remembering your settings.

Chekkd's analytics implementation removes query strings and replaces request tokens, profile usernames, referral codes, and record IDs with generic route labels before a page-view event is sent. When optional analytics is allowed, Chekkd stores pseudonymous session and visitor hashes plus sanitized route, acquisition, engagement, and funnel events in its own backend. These records may include coarse country and region codes and device, browser, and platform families. The first-party analytics event record does not store a raw IP address, raw user-agent string, URL query string, direct account or person identifiers, or form contents. We also do not use names, email addresses, phone numbers, dates of birth, form messages, authentication codes, request links, Plaid identifiers, or bank details as analytics event parameters. Campaign labels supplied in landing-page links may be recorded after basic safety filtering and should never contain personal information.

Google advertising storage, advertising user data, ad personalization, and Google advertising signals remain disabled. You can turn optional analytics on or off at any time through the Analytics settings link in the site footer or the app's Privacy settings. You can also clear cookies in your browser, though disabling essential storage may limit account functionality.

When you opt into Clarity, pseudonymous browser and session cookies can connect visits across www.chekkd.com and app.chekkd.com. We do not send your account identifier or use Clarity's identify API. Microsoft receives network and device information as part of providing this service; masking is not a claim of anonymity. The separate essential cookie remembering your replay choice lasts up to 180 days. You can withdraw permission through Analytics settings; this stops further uploads, removes accessible Clarity first-party cookies and reloads the current page. Withdrawing permission does not retroactively erase data already processed by Microsoft.

The essential cookie that remembers your analytics choice lasts up to 180 days. A short-lived regional setting lasts up to 24 hours, and Chekkd's bounded campaign-attribution cookie lasts up to 90 days when analytics is enabled. Google Analytics first-party measurement cookies may last up to two years unless you turn analytics off, clear them, or your browser removes them sooner. Chekkd's Google Analytics property is configured for 14 months of event and user-data retention.

Our service uses providers with their own terms and privacy practices, including Plaid for Identity Verification and Bank connection, Supabase for authentication and database services, Vercel for hosting and privacy-filtered public-page Web Analytics, Railway for API hosting, Google Analytics 4 for optional analytics, Microsoft Clarity for separately opted-in heatmaps and masked session replay, and Apple, Google, LinkedIn, X, and Meta when you choose social sign-in. Information may be processed in countries outside your jurisdiction, including the United States, with safeguards applied where required.

Our service is not intended for users under 18. We do not knowingly collect personal information from children. If you believe your child has provided us data, contact us immediately at support@chekkd.com.

Depending on where you live, you may have rights to know or access information, correct it, request deletion, receive a portable copy, restrict or object to processing, opt out of sale or sharing where applicable, and appeal or complain to a regulator. We will not discriminate against you for exercising applicable privacy rights.

We may update this policy to reflect changes in our practices, technology, or legal requirements. We will provide notice of material changes through an appropriate service or account channel.

Questions or concerns about this Privacy Policy? Reach Lets Handshake Inc. (Chekkd) any time at support@chekkd.com.