Trust
How we protect your data
The specific protections running on Chamko today, without the jargon.
Your Google and Instagram keys are encrypted
When you connect Google or Instagram, those services give Chamko a key so it can act for you. These keys are the most sensitive thing we hold, so they are never saved in readable form. They are locked with AES-256-GCM, a strong standard encryption method, before they reach the database.
What happens to your Google key
Key from Google
Lets Chamko act on your profile, only after you allow it
AES-256-GCM
Locked by the service before saving
Saved scrambled
k9Xv2+Qe7LpZ0a…
Everything travels encrypted
All traffic to Chamko uses HTTPS, and browsers are told to refuse any unencrypted connection. Nobody between you and us can read what you send.
There is no password to steal
Chamko has no passwords. You sign in with Google or with a one-time code sent to your email.
- Email codes expire and are stored only as a salted hash, so a saved code cannot be reused.
- Sign-in stays active for up to 60 days on a device.
- Your session can be ended on all devices at once.
You only ever see your own business
Every request is tied to your signed-in account, and data is looked up through that account's businesses. Asking for another owner's review or post simply finds nothing.
Limits that stop abuse
- Only Chamko's own websites may call the service from a browser.
- Sign-in attempts are limited to 10 a minute and general use to 120 a minute.
- Oversized uploads and malformed requests are rejected before they are processed.
Who at Chamko can see your account
Our small team can open an account to give support or fix a problem. Getting in takes a Google sign-in and a second code from an authenticator app, and staff actions are written to an audit log.
Reporting a problem
Found something that looks wrong? Email [email protected] or WhatsApp +91 95373 25355.