Effective June 20, 2026

Privacy Policy

Casita is a ChatGPT and MCP service for household members who choose to use it together. It stores only the information needed to provide shared household coordination features such as casita membership, invitations, and shopping lists.

Controller And Contact

Casita is operated by the Casita operator reachable at casita@tank.studio. For privacy requests, questions, or complaints about Casita's data handling, use that contact address. No data protection officer or EU representative has been appointed for this early service unless a later version of this page says otherwise.

Personal Data We Collect

Casita receives authentication identity data from Cloudflare Access when you connect to the MCP service, including your email address and optional profile details such as display name or provider subject. Casita also stores household content and metadata you create through Casita tools, including casita names, membership records, invitation records, shopping-list items, quantities, notes, item status changes, and related timestamps.

How And Why We Use Data

Casita uses data to authenticate users, associate each user with the correct household, create and join casitas, create and validate one-time invitation keys, show and update shared shopping-list information, prevent unauthorized household access, secure the service, troubleshoot problems, and respond to privacy or support requests.

For EU privacy purposes, the main legal bases are performance of the service you request, legitimate interests in operating and securing a small household coordination service, and compliance with legal obligations where applicable. Casita does not rely on consent for processing that is necessary to provide the requested service unless a future feature clearly asks for consent and lets you withdraw it.

Providers And Recipients

Casita runs on Cloudflare Workers, Cloudflare D1, and Cloudflare Access for hosting, authentication, database storage, logging, and security. Requests and tool results may also pass through OpenAI or ChatGPT when you use Casita from ChatGPT. Casita does not sell personal data, use household content for advertising, or add analytics scripts to the public website.

International Transfers

Cloudflare, OpenAI, and ChatGPT may process data in countries outside your country or outside the EU/EEA. Casita relies on those providers' published data-processing terms, security measures, and transfer safeguards for provider-controlled processing.

Retention

Casita keeps account, casita, membership, and shopping-list data while the household uses the service, or until deletion is requested and the request can be honored. Invitation keys are one-time keys that expire after seven days; Casita stores only their hashes, along with invitation metadata needed to validate or audit the invitation.

App-controlled records can be corrected or deleted manually after appropriate identity and household-context checks. Some data may remain for limited periods in provider logs, backups, abuse-prevention records, or legal-obligation records, and deletion from those systems may not be immediate.

Your Rights And Controls

You can ask for access, correction, deletion, restriction, objection, or portability of Casita data by contacting casita@tank.studio. These rights may depend on your location and the legal basis for processing. Casita may need to verify your identity and household relationship before disclosing, changing, exporting, or deleting household information.

If you are in the EU/EEA, the UK, or another jurisdiction with data protection rights, you may also complain to your local data protection supervisory authority.

Security

Casita uses Cloudflare Access as the production authentication boundary, stores invitation keys only as hashes, and limits household access based on authenticated membership. No internet service can be guaranteed completely secure, so do not store sensitive secrets, payment credentials, emergency information, or professional advice data in Casita.

Automated Decisions

Casita does not perform automated decision-making or profiling that produces legal or similarly significant effects. ChatGPT may generate responses around Casita tool results when you choose to use Casita through ChatGPT.

Changes

We may update this policy as Casita changes. The effective date at the top of this page indicates the latest version.