Privacy Policy

1. Who we are

theChatStage operates a real-time chat and live-debate platform. This policy explains what personal data we collect, why we collect it, and your rights.

2. Data we collect

• Account data: email, display name, password hash (or Google OAuth identifier), age, country, gender.
• Profile media: avatar images you upload.
• Conversation data: chat messages, debate messages, uploaded audio and images.
• Ratings: ratings you give and receive across five dimensions.
• Technical data: IP address, browser type, session cookies, connection telemetry needed for real-time messaging. The IP address is used to limit abuse (rate limiting).
• Website analytics (optional): only if you allow the Analytics category in the cookie banner, the website loads Google Tag Manager, which may set analytics cookies and collect usage data through the tags we configure in it. Nothing from Google Tag Manager loads before you allow it. You can withdraw at any time with "Cookie preferences" in the footer.
• Mobile app data: if you use the mobile app, a push notification token and your device name, so we can send you notifications. The app contains no advertising or analytics software and does not track you.
• Reports and moderation records: abuse reports you file or that are filed about you, and the moderation actions taken.

3. How we use your data

• To provide the chat, queue, scheduling, and debate features.
• To match you with other users based on your filter preferences.
• To maintain reputation summaries derived from ratings.
• To secure the Service and investigate abuse reports.
• To communicate essential service notices.

4. Legal bases (GDPR)

We process personal data under the following bases: performance of a contract (to provide the Service you signed up for), legitimate interests (security, abuse prevention), consent (for optional features where applicable), and legal obligation.

5. Sharing

We do not sell personal data. We share data only with:

• Infrastructure providers that host the database, files, and servers under data-processing agreements.
• Push notification services (Expo, and Apple or Google), which receive your push token and the notification text in order to deliver notifications to your phone.
• Google, if you choose to sign in with Google (Google receives minimal authentication data).
• Google (Google Tag Manager and the tags loaded through it), on the website only and only if you allow the Analytics category in the cookie banner.
• Law enforcement when legally required.

Debate rooms are public and visible to anonymous viewers by design. Do not share sensitive information in debates.

6. Retention

Account data is retained while your account is active. When you delete your account, we immediately remove your profile, avatar, sign-in credentials, push tokens, blocks and reactions. Messages you sent stay in the conversations of the people you talked to, shown as from "Deleted user", and are not linked to your name. Photos and voice messages sent in a conversation are kept together with that conversation. Stored conversations are also deleted automatically after the retention period that administrators set, and administrators can delete a conversation at any time. Abuse reports are kept as long as needed for moderation and legal obligations.

If you register but never confirm your email address, we delete that unconfirmed account, including your email address, automatically 14 days after you registered.

Administrators can open stored chats and direct messages for moderation and to handle abuse reports or deletion requests. Every such access is logged, and administrators can delete stored conversations at any time.

7. Your rights

Depending on your jurisdiction (GDPR, CCPA, and similar laws) you have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, contact contact us. You can delete your account in the mobile app (Profile, Delete account) and on the website (Settings).

8. Children

The Service is not directed to children under 16. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

9. Security

We use encryption in transit (HTTPS/WSS), hashed credentials, and access controls. No system is perfectly secure; please use a strong, unique password.

10. International transfers

Your data may be processed in countries other than your own. Where required, we use appropriate safeguards such as Standard Contractual Clauses.

11. Changes

We will post updates to this policy here and revise the "last updated" date. Material changes will be announced in-app or by email.

12. Contact and data controller

Data controller:

For all privacy and data-protection requests, use either channel. We treat the contact form as the primary intake; email is accepted for jurisdictions that require direct electronic contact (e.g. Germany TMG §5, France LCEN, UK e-Commerce Regulations).