Privacy Policy

Last updated: 6 September 2026

rchat is designed to be anonymous. This policy explains exactly what data we collect, why we collect it, and how we store it. We believe in being direct about this.

What we collect

Your display name, age, and gender

When you first open rchat you choose a display name. This is the only piece of information that is required. Age and gender are optional. These are stored on our server and shown to your chat partners when you match.

You choose all of this — none of it is inferred or collected automatically.

A hash of your browser's secret key

When you first visit rchat your browser generates a random 32-byte secret key and stores it in localStorage. We never see this key — only a SHA-256 hash of it is ever sent to or stored by our server. This hash is how we recognise you on future visits without being able to impersonate you.

Visit timestamps

We store when you first used rchat and when you most recently visited. These are used to recognise returning users and for operational housekeeping (closing sessions left open by crashes).

Chat session records

When two users are matched, we record that a session occurred: the anonymous user IDs of both participants, when the session started, when it ended, and which side ended it. We do not record IP addresses.

Message content

The text of messages sent during a chat session is stored in our database. Messages are linked to anonymous user IDs and session IDs, not to any personally identifiable information.

What we do not collect

No real name (only the display name you choose)
No email address
No phone number
No IP address (not logged or stored)
No browser fingerprint
No location data
No cookies (we use localStorage for the secret key only)
No third-party analytics or advertising scripts

How your data is stored

All server-side data is stored in a SQLite database on our server. Your secret key is stored only in your browser's localStorage — it never leaves your device.

If you clear your browser's local storage, your secret key is gone and rchat will treat you as a new visitor on your next visit. Any previous session records on our server remain but are permanently detached from any new identity you create.

We do not sell, share, or transfer your data to any third parties. There are no advertising networks, analytics providers, or data brokers involved. Your display name, age, and gender are shared with your matched chat partner during a session, and with no one else.

Data retention

We do not currently have an automatic data deletion policy. Chat session records and messages remain in our database indefinitely. If you want your data removed, contact us using the address below.

You can abandon your rchat identity at any time by clearing your browser's local storage. This removes your secret key from your device. The server-side hash and associated records remain, but they cannot be linked to any new identity you create.

Your rights

You can request deletion of any data associated with your rchat identity by contacting us. Because our database uses anonymous IDs rather than personal identifiers, we may ask you to provide your secret key (from your browser's local storage) so we can locate your records.

Depending on where you are located, you may have rights under data protection laws such as the GDPR (EU/UK) or CCPA (California). We will respond to legitimate requests within a reasonable time.

Changes to this policy

If we make material changes to how we handle your data, we will update the date at the top of this page. Continued use of rchat after a change constitutes acceptance of the updated policy.

Questions?

If you have questions about this policy or want to request deletion of your data, please open an issue or contact the maintainer through the project's public repository.