Privacy Policy

We are committed to collecting the absolute minimum amount of information necessary to operate the service. Here is exactly what we handle:

• Your chosen display name - This is the nickname you type before joining a room. It is stored temporarily in memory only while your session is active and is never saved permanently.
• Your messages (encrypted) - Text messages are encrypted with AES-256-GCM before being saved to our database. They are stored temporarily so late-joining room members can see recent history. All messages are automatically deleted after 15 minutes.
• Voice recordings - Voice messages are transmitted in real-time to other room members and are not saved to our database. Once a voice message is delivered, it is gone.
• Room code and activity timestamps - We store the room code and a last activity timestamp to manage auto-deletion. This is also auto-deleted within 15 minutes of inactivity.

We do not collect or store your IP address, browser fingerprint, device information, location, or any other identifying data.

To be crystal clear, the following data is never collected, stored, or processed by Anonymous Chat Online:

• Email addresses or phone numbers
• Passwords or authentication credentials
• IP addresses or geolocation data
• Browser fingerprints or device identifiers
• Cookies for tracking or advertising purposes
• Third-party analytics data
• Payment information of any kind
• Voice recordings in our database
• Any form of government ID or personal identification

Every text message you send is encrypted before it is written to our database using AES-256-GCM - the same encryption standard used by governments and financial institutions worldwide.

Here is how the encryption works:

• A unique encryption key is derived from your room code and a server-side secret using PBKDF2 with 100,000 iterations of SHA-256.
• A fresh random Initialization Vector (IV) is generated for every message, meaning no two messages are encrypted identically even if the content is the same.
• GCM mode includes an authentication tag, which means any tampering with the stored ciphertext is detected and rejected during decryption.
• Messages are only decrypted when delivered to authenticated room members and are never stored or transmitted in plain text.

Even if someone were to access our database directly, they would see only encrypted ciphertext.

We believe data you cannot access cannot harm you. Here is our auto-deletion policy:

• Text messages - Automatically deleted from our database 15 minutes after they are created.
• Chat rooms - Deleted 15 minutes after the last activity in the room. When a room is deleted, all associated messages are deleted with it.
• Voice messages - Never written to the database. Delivered in real-time and immediately discarded.
• Session data - Your display name and connection state are held in server memory only for the duration of your active session.

There is no manual deletion process required. Everything cleans itself up automatically.

Anonymous Chat Online does not use tracking cookies, advertising cookies, or third-party analytics services.

The only session-related data maintained on your device is your active Socket.IO connection, which is a technical necessity for real-time communication. This is not a tracking cookie and does not persist after you close the browser tab.

We do not sell, rent, or share any data with third-party advertisers. We do not run behavioral profiling of any kind.

Our service is self-contained. However, to operate, we rely on the following infrastructure providers:

• Hosting Provider - Our server runs on a cloud hosting platform. Standard server access logs may be retained by the hosting provider per their own policies.
• MongoDB Atlas (or self-hosted MongoDB) - Our encrypted message database. Messages are encrypted before reaching the database.
• Google Fonts - We use Google Fonts (Playfair Display, Nunito) to load typography. This results in a standard network request to Google's CDN servers, which may log your IP.

We do not integrate with social media platforms, advertising networks, or data brokers.

Anonymous Chat Online is not intended for children under the age of 13. We do not knowingly collect any information from children under 13.

Parents and guardians are encouraged to supervise their children's internet usage. If you believe a child under 13 is using our service, please contact us so we can take appropriate action.

Because we collect virtually no personal data, many traditional data rights are not applicable in the conventional sense. However:

• Right to anonymity - You are never required to provide real identifying information.
• Right to erasure - All your messages are automatically erased within 15 minutes.
• Right to know - This privacy policy fully discloses all data handling practices.
• Right to opt out - Simply stop using the service. No cancellation process is required.

If you are a resident of the EU or California, applicable privacy rights still apply. Contact us if you have specific concerns.

We take the security of your communications seriously and implement the following measures:

• AES-256-GCM encryption for all stored message data
• PBKDF2 key derivation with 100,000 iterations
• Random IV generation per message
• GCM authentication tags for tamper detection
• HTTPS or TLS for all data in transit
• Automatic data expiry at the database level
• No third-party access to message content

No system is 100% secure. If you discover a security vulnerability, please report it responsibly.

We may update this Privacy Policy from time to time. When we do, we will update the Last Updated date at the top of this page.

Since we do not collect your email, we cannot notify you of changes directly. Material changes will be posted prominently on our homepage.

Continued use of Anonymous Chat Online after changes are posted constitutes your acceptance of the updated policy.