Chime – Mobile Banking

"Information you provide through contacts integration, including a list of contacts from your phone's operating system. Biometric Data: We or our identity verification partners may collect documents that contain your photograph or require you to provide a photo of yourself. This information and data derived from these images may be considered biometric data and may be used to verify your identity or meet regulatory obligations."

Chime collects phone contacts and biometric data (facial photographs for identity verification), along with device identifiers, battery and signal strength, device settings and configurations, and installed app usage statistics — broad device access for a financial app.

"Precise geolocation data derived from a device and that is used or intended to be used to locate you within a geographic area that is equal to or less than the area of a circle with a radius of 1,750 feet. In addition, we may collect your device's geolocation information. Your device's operating platform may provide you with a notification when the App attempts to collect your precise geolocation."

Chime collects precise GPS-level geolocation data capable of pinpointing users within a 1,750-foot radius, classified as sensitive personal information even by their own disclosure.

"We may share the personal information we obtain about you with our affiliates and subsidiaries; our Bank Partners; other companies in connection with co-branded products, services or programs; joint marketing partners; research study partners; and consumer reporting agencies. We also may share the information we obtain about you with vendors and other entities we engage to perform services on our behalf, such as payment and check deposit processors, fraud and risk detection and mitigation tools, and modeling and analytics tools."

Chime shares personal data with a wide range of third parties including marketing partners, joint marketing partners, consumer reporting agencies, analytics providers, and data brokers/aggregators like Plaid.

"Through these ad services, we can target our messaging to users considering demographic data, users' inferred interests and browsing context. These services track your online activities over time and across multiple websites and apps by collecting information through automated means, including through the use of cookies, web server logs, web beacons and other similar technologies."

Chime enables third-party ad services to track users across multiple websites and apps over time, building cross-context behavioral profiles for targeted advertising.

"We retain personal information for as long as necessary to provide the Services and fulfill the transactions you have requested, comply with our legal obligations, resolve disputes, enforce our agreements, and other legitimate and lawful business purposes. Because these needs can vary for different data types in the context of different Services, actual retention periods can vary significantly based on criteria such as user expectations or consent, the sensitivity of the data, the availability of automated controls that enable users to delete data, and our legal or contractual obligations."

Chime provides no specific retention timelines, using vague 'as long as necessary' language with open-ended criteria that allow indefinite retention of personal information.

"We may update this Privacy Notice from time to time and without prior notice to you to reflect changes in our personal information practices or applicable law. We will indicate at the top of the Notice when it was most recently updated."

Chime reserves the right to change its privacy practices at any time without giving users advance notice, with no requirement for consent to the new terms.