Privacy Policy

Data we collect

• Account data: email, hashed password, username, age, gender, and selected interests.
• Session data: matches you've been paired with, room metadata, timestamps.
• Chat messages: stored as ciphertext only — they are end-to-end encrypted between you and your match. We cannot read them.
• Signaling data: short-lived WebRTC negotiation payloads required to start a video call.
• Technical data: IP address, user-agent, and basic device info, used for security and abuse prevention.

How we use it

• To provide and operate the service (matchmaking, signaling, message delivery).
• To enforce our Community Guidelines and respond to abuse reports.
• To secure the platform against fraud, spam, and abuse.
• With your consent, for analytics and marketing (see Cookies).

Legal basis (GDPR)

• Contract: providing the service you signed up for.
• Legitimate interest: security, abuse prevention, basic logging.
• Consent: optional analytics, marketing, and non-essential cookies.
• Legal obligation: responding to lawful requests from authorities.

Sharing

We do not sell your personal data. We share limited data with infrastructure providers (database, hosting, email) strictly to operate the service, under data processing agreements. We may disclose data when required by law or to protect rights, safety, and property.

Retention

• Account data: retained until you delete your account.
• Chat ciphertext: retained for the lifetime of the room. Encryption keys are ephemeral and discarded with the session, making historical messages unreadable.
• Abuse reports & moderation logs: up to 24 months for safety enforcement.

Your rights

Depending on your jurisdiction (GDPR, UK GDPR, CCPA, etc.) you may have the right to access, correct, delete, restrict, port, or object to processing of your data, and to withdraw consent at any time. You can exercise most rights directly:

• Submit a data request
• Delete your account
• Manage cookie preferences

You also have the right to lodge a complaint with your local data protection authority.

Children

The service is not intended for anyone under 16. We do not knowingly collect data from children below this age. If you believe a child has provided us data, contact privacy@chatmeup.app and we will delete it.

International transfers

Our infrastructure providers may process data outside your country. Where required, we use Standard Contractual Clauses or equivalent safeguards.

Security

See our dedicated Data Security page for details on encryption, access controls, and incident response.

Contact

Privacy inquiries: privacy@chatmeup.app.