Chatly privacy notice

This page summarizes information handled by the current Chatly application. It is a technical summary for users and is not a substitute for a jurisdiction-specific privacy policy reviewed by the service operator.

Operator action required before broad public launch: publish the legal operator identity, a monitored privacy contact, applicable jurisdiction, and final retention periods. This page is marked noindex until those details are reviewed and completed.

Account information

When you register, the application stores your email address, a password hash (not the raw password), display name, and account identifier. Optional profile fields include an avatar, bio, country, and country code. Account preferences include discoverability, notification preference, and theme.

Friendships and private messages

Friend requests and accepted friendships are stored in the database. Persistent private conversations between accepted friends can store text message records and attachment metadata. Images and voice-note files shared through private messages are stored in private application storage and are served only after account and conversation authorization checks.

Temporary random-match chat

Text and compressed images exchanged in a guest random match are sent through the active Socket.IO room and are not saved as persistent message records by the current call-chat handler. They are cleared in the client when the match ends. Do not assume another participant will not make their own recording or screenshot; never share information you would not want disclosed.

Camera, microphone, and call media

The browser requests camera and microphone access only after you choose to start. The application uses WebRTC for audio/video and a signaling service to coordinate the connection. Depending on network conditions, media may travel directly between participants or through a TURN relay. The current application code does not implement a feature that records call audio or video into Chatly's database.

Visitor analytics and retention

The analytics endpoint can record visitor IP address, page path, browser user-agent, referrer, and an optional account reference. Country is derived from a Cloudflare country header only when the operator explicitly enables trusted-proxy handling. Visitor records are deleted after the configured retention period, which defaults to 30 days and can be configured between 1 and 365 days.

Security and access

Account endpoints require a valid session. Private message history and attachments are restricted to conversation members, and live conversation message rooms are joined only after server-side membership and friendship checks. No online service can guarantee absolute security; use a unique password and keep your session and account credentials private.

Account deletion and questions

The account center provides an account deletion action. The current database uses related-record deletion rules for account-owned profile, friendship, and conversation data; some operational report and analytics records may follow separate retention rules. For privacy requests, the operator must publish a monitored contact channel before public launch.

Changes to this notice

This summary should be updated whenever data collection, storage providers, retention, moderation processes, or account features change. The operator must review it against the actual deployment and applicable laws.