OSRU Company
Privacy Policy — Chameleon
This Privacy Policy explains how OSRU Company (“we,” “us,” or “our”) collects, uses, stores, and shares information when you use the Chameleon application on Android or other platforms we support (the “App”).
This document describes our product practices in plain language. It is not legal advice. Please review it carefully before publishing or relying on it for Google Play or other stores, and update it if our practices change.
1. Summary
Chameleon is a personal notes app. By default, your notes and containers stay on your device. If you choose to use Chameleon Sync, we process account and sync data so your notes can sync across your devices through infrastructure we operate (currently Supabase). We do not sell your personal data.
2. Information we collect
2.1 Information you provide
| Data | When |
|---|---|
| Account email and password | If you create a Chameleon Sync account (email/password authentication). We do not receive your password in plain text; authentication is handled by our auth provider (see Third parties). |
| Note content and related data | If you enable Sync: note titles, bodies, comments, tags, links, folders, covers metadata, calendar/timebox data, and other container data you choose to sync. |
| Support messages | If you contact us (for example via shariarpayer.com), whatever you choose to include in that message. |
2.2 Information collected automatically
| Data | When |
|---|---|
| Device identifiers for Sync | If you use Sync, an app-generated device id (and basic device label information we use to show your devices in Sync settings) so we can manage your signed-in devices. |
| Technical / connection data | Standard connection details needed to operate Sync (for example, requests over HTTPS to our Sync backend). We do not operate a separate advertising analytics product in the App. |
| Crash / reliability basics | If the distribution platform (for example Google Play) provides basic crash-free or stability signals to developers, those may be available through that platform. We do not sell that data. |
2.3 Local-only use (no Sync)
If you use Chameleon without creating a Sync account, your notes and containers are stored on your device. We do not receive your note content in that case.
2.4 Optional Unsplash covers
If you choose a cover image from Unsplash, the App may request image search results or image URLs from Unsplash. Unsplash may receive technical request information (such as IP address and request headers) according to Unsplash’s own policies. Cover image files may be cached on your device.
3. How we use information
We use the information above to:
- Provide and operate Chameleon and optional Chameleon Sync
- Authenticate your account and keep your synced data associated with your account
- Sync note/container data across your devices when you enable Sync
- Show and manage your Sync devices
- Respond to support requests
- Maintain security, prevent abuse, and improve reliability of the service
- Comply with applicable law and platform requirements (including Google Play)
We do not sell personal data. We do not use your note content for advertising.
4. Where information is stored
| Data | Location |
|---|---|
| Local containers / notes | On your device (app storage). |
| Chameleon Sync account and synced content | On operator-owned cloud infrastructure we configure for the product — currently Supabase (database and authentication). Data is stored in the region(s) configured for that project. |
| Cached cover images | On your device when applicable. |
You are responsible for the physical security of your device and any device unlock / local protection you enable.
5. Third parties
We use service providers to run the App and Sync. They process data only as needed to provide their services to us:
| Party | Role |
|---|---|
| Supabase | Authentication (email/password) and storage of synced note/container data and device metadata for Chameleon Sync. See Supabase Privacy Policy. |
| Unsplash | Optional cover image search and image delivery when you use Unsplash covers. See Unsplash Privacy Policy. |
| Google Play / Google | App distribution, updates, and platform services (for example Play’s crash or performance reporting if enabled for the listing). See Google Play Privacy Policy. |
We do not sell your personal data to third parties. We do not share your note content with third parties for their own marketing.
6. Retention
- Local data remains on your device until you delete it, clear app data, or uninstall the App (subject to your device’s behavior).
- Sync account and cloud-synced content are retained while your account is active and Sync data exists for that account.
- If you ask us to delete your Sync account or synced data, we will delete or de-identify that data from our Sync systems within a reasonable time, except where we must retain limited records for security, fraud prevention, or legal compliance.
- Cached images and local copies on your devices are under your control; deleting cloud data does not automatically wipe every device until you clear or uninstall locally.
7. Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, or export personal data, or to object to or restrict certain processing.
You can typically:
- Use Chameleon without Sync (local-only)
- Edit or delete notes and containers on your device
- Sign out of Sync on a device
- Request deletion of your Sync account and associated cloud data by contacting us (see Contact)
- Stop Unsplash cover requests by not using Unsplash covers
To exercise a privacy request, contact us via https://shariarpayer.com (use the contact options on that site) and include “Chameleon privacy request” in your message, plus the email address of your Sync account if applicable.
We will respond within a reasonable period. We may need to verify that the request comes from the account holder.
8. Children’s privacy
Chameleon is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information through Sync, contact us and we will take reasonable steps to delete that information from our Sync systems.
9. Security
We use reasonable technical and organizational measures appropriate to a small product operator, including encrypted transport (HTTPS/TLS) to Sync services and provider-managed authentication. No method of transmission or storage is completely secure. You should use a strong unique password for Sync and keep your devices updated.
10. International processing
If you use Chameleon Sync, your account and synced data may be processed in the country or region where our Supabase project (and related infrastructure) is hosted, which may differ from where you live. By using Sync, you understand that this transfer is necessary to provide the service.
11. Changes to this policy
We may update this Privacy Policy from time to time. The “Effective date” / “Last updated” line at the top will change when we do. Continued use of the App after an update means you acknowledge the revised policy. For material changes affecting Sync users, we may also provide notice in the App or by other reasonable means when practical.
12. Contact
OSRU Company
Product: Chameleon
Founder: Shariar Ahmed
Website / contact: https://shariarpayer.com
For privacy questions or deletion requests, use the contact options on that website and mention Chameleon and OSRU Company.