Open Chat Privacy Policy

What We Do Not Require

• No Personal Registration: We do not require your email address, legal name, phone number, or physical address to create an anonymous chat session.
• No Passwords or Social Login: Authentication relies on server-minted anonymous session tokens rather than user passwords or social OAuth accounts.
• No Google Advertising Inside Chat: Google AdSense is restricted to eligible public content and discovery pages and is not loaded in the realtime chat application or direct-message experience.
• No Contact-Book or Social-Graph Mining: We do not ask to import address books or social-network contact graphs.

What We Store & Why (Forensic Safety)

To defend against illegal exploitation, spam bots, and abusive attacks, the server maintains security and operational records:

• Session Credentials: An anonymous session identifier stored in an HttpOnly, SameSite=Lax cookie.
• Client IP Address: Recorded on connection and audit events for rate limiting, abuse mitigation, and security investigation under restricted operator access.
• Messages & Attachments: Messages and sanitized attachments may be persisted according to the service's conversation, moderation, safety, deletion, and retention rules.

Public-Page Advertising

Eligible public content and discovery pages may use manual Google AdSense advertising units when monetization is enabled. Google advertising code is intentionally separated from the realtime chat and direct-message application. Depending on your region, consent choices, and advertising configuration, Google and its advertising partners may use cookies, local storage, device information, or similar technologies to deliver, measure, and personalize advertising. Where consent is required, the applicable advertising consent flow must be completed before personalized advertising is used.

Optional Conversation Profile

When enabled, you may voluntarily provide gender and an age range. Neither is required to enter chat. These private, self-declared attributes belong to your authenticated anonymous chat identity and are not shown to room participants. You can change or clear them in Conversation Profile. They are not proof of adulthood, and do not replace access restrictions or age verification. Conversation invitations are not active.

An interrupted optional save may retain your selected values in this tab for at most two minutes, scoped to the same authenticated identity. Operational profiles are eligible for removal after 24 hours of inactivity only when there is no valid authenticated session or recoverable continuity credential. Removal leaves messages and security records intact.

Optional demographic behavior reporting has a separate server collection control and always requires your analytics consent, including when generic product analytics does not. It records event-time attributes for verified public General engagement and aggregate profile changes, without a permanent visitor-to-chat-identity link or message content. It does not rewrite earlier attributes when you edit your profile. Demographic reporting records expire after 90 days; small groups and related totals are withheld. This feature's production release is subject to privacy and disclosure review.

First-Party Anonymous Product Analytics

Open Chat uses first-party anonymous product analytics to understand usage of the service. By default this measures eligible public browser visits regardless of optional preferences, including Essential Only. If the service is configured to require analytics consent, collection follows your optional analytics choice. Open Chat uses its own anonymous visitor cookie, openchat_analytics_visitor, for aggregate product analytics. It is first-party, HttpOnly, SameSite=Lax and Secure in production, with a requested fixed five-year lifetime from creation. Returning does not extend that expiry. Your browser may expire or remove the cookie sooner; some browsers cap long-lived cookies. A separate openchat_analytics_session cookie groups activity with a sliding 30-minute inactivity timeout. The visitor identifier is cryptographically random; the server stores only a one-way hash, never the raw visitor token. Neither cookie authenticates chat, and no account is required.

At analytics session start, a local DB-IP Lite City database estimates country, region and locality from the network IP. An offline city gazetteer uses transient approximate coordinates to select a nearby city in the same country and, when supplied, the same state/region. Analytics stores the city and original locality; it does not store those coordinates. The IP is used transiently for approximate location lookup; the raw source IP is not retained as analytics data. City estimates may be inaccurate: VPN visitors appear at their VPN exit, and mobile networks may resolve to a nearby or different city. Visit analytics stores only coarse location, a device category, entry pathname, referrer hostname and limited campaign fields. Session information and bounded foreground activity/duration support aggregate DAU (24 hours), WAU (7 days), MAU (30 days), New/Returning users, device, approximate location, session duration, acquisition source and entry-page reporting. Raw User-Agent and Client Hint headers are not persisted. Analytics uses no fingerprinting or GPS location and retains no visitor coordinates, postal codes, screen dimensions, advertising identifiers, usernames, email addresses or phone numbers. It uses no third-party analytics provider. It stores no full external referrer URLs or arbitrary query strings. Optional acquisition measurement also records one join intent, verified General chat entry, first human message and later human message received per visit. It retains no alias, chat identity, message content or message identifier in those event records; message identifiers are used transiently to verify public General activity, never private conversations.

Optional conversation starter analytics concerns potentially intimate interests. It requires a separate explicit choice below, optional analytics consent, and default-off server controls. It records only approved template IDs, template pool, category and server event time against the existing analytics visit. Template choices do not verify gender, marriage, religion or preferences. No chat identity, text, alias, IP or credential is retained in starter events. Short-lived visit evidence is scheduled for expiry after 8 days; unlinked weekly totals after 400 days. Stopped or backlogged maintenance can delay physical removal. Aggregate reports use completed UTC weeks and suppress small groups and related totals, with a minimum of 20 distinct measured browsers per nonzero weekly cell. No individual mood history, advertising audience or raw export is provided. New collection remains subject to privacy and adult-access review.

An analytics visitor represents a browser, not a guaranteed person. Clearing cookies, private/incognito browsing, changing browser/device or allowing the five-year cookie to expire creates a separate identity. We do not correlate them. Analytics history begins when collection is deployed; earlier visitor identities cannot be safely reconstructed. Analytics history is currently retained for multi-year reporting without an automatic deletion schedule. Existing security records have their separate policies described above. Optional preferences continue to control optional discovery events and advertising preferences; they do not disable product analytics under the default policy.

Cookie & Local Storage Policy

Open Chat uses the essential openchat_session cookie to maintain an anonymous chat session. The site may also store local preference and consent choices in the browser. When public-page advertising is enabled, Google AdSense may use additional advertising storage or related technologies on eligible public pages according to the applicable consent and advertising settings.