1. Information We Collect

We collect information you provide when creating an account, including your username, email address, and any profile information you choose to add. This includes any profile picture you upload. We also collect message content you send through the chat service.

When you use the following system, we record the accounts you follow and the accounts that follow you, along with the relationships established through blocking (the accounts you block and the accounts that block you). This information is used solely to provide these features.

Connection data. To operate the service securely, we automatically process your IP address and connection details (such as active connections, request frequency, and a device fingerprint used for rate limiting). This information is used for abuse prevention, rate limiting, and monitoring service health. Administrator monitoring tools may display aggregate connection counts and the IP addresses responsible for the highest connection volumes. This data is used only for operational security and is not sold or shared for marketing or advertising.

Sign-in sessions. Each time you sign in with your credentials, we record a login session on your account so you can see and manage where your account is signed in. A session record includes: a device description (the browser and operating system as reported by your device), an anonymous device identifier, your IP address, and an approximate location derived from your IP (such as a city and country, which may include approximate coordinates). This information is used to recognise the devices and locations you actually use, to show you your active sessions under Settings → Security, and to alert you if your account is signed into from a device or location it has not been seen from before. We keep only the most recent fifty session records on your account, plus a capped list of your known devices and regions (used to recognise your sign-ins); older records are automatically removed as new activity is added. You can sign a session out remotely — which immediately ends that device’s access to your account — or delete its record at any time from your Security settings.

Push notifications. If you enable push notifications, your browser generates a unique push subscription for this device, which we store so we can deliver native notifications to you. A stored subscription consists of the delivery endpoint and two encryption keys for this device — it does not contain your message history or any other account data. Notification delivery is handled by your browser’s push service (Google for Chrome and Edge, Mozilla for Firefox, or Apple for Safari), and the notification content sent to that service is encrypted in transit. Stored subscriptions identify your device only and are used solely to deliver the notifications you choose to receive.

2. How We Use Your Information

Your information is used to provide, maintain, and improve our chat services. This includes displaying your messages and profile picture to other users, managing your account, and communicating with you about service updates.

Following. Your follower and following counts, and your follower/following lists, are shown publicly on your profile and can be seen by other users.

Online status. Your real-time online status (shown as a green dot) is only visible to users you mutually follow — that is, accounts that follow you and that you follow back. Users who do not mutually follow you cannot see whether you are currently online. You may additionally enable Hide active status in Settings → Privacy, which hides your presence from everyone; while enabled, you also won’t see others’ online status, including the global online count.

Sign-in security. If we detect a sign-in to your account from a device or approximate location your account has not used before, we send you an in-app notification and alert, with a link to review it. You can review every session — device, location, and last activity — and sign a device out remotely from Settings → Security. Signing a session out revokes it immediately: that device is disconnected and can no longer access your account until you sign in again.

Push notifications. When you have enabled push notifications, we may deliver native notifications to your device while you are away from the app — for example, new followers, direct messages, account security alerts, and announcements. These notifications carry the relevant message content so they are useful at a glance. They are only sent to devices you subscribed with, and you can turn them off (and delete your stored device subscription) at any time under Settings → Notifications.

3. Data Storage & Security

We implement reasonable security measures to protect your data. Your account information is stored securely, and we use industry-standard practices to prevent unauthorized access.

If you enable two-factor authentication (2FA), your TOTP secret is encrypted at rest using AES-256-GCM. Backup codes are hashed using bcrypt and stored as one-time-use tokens. We never store plaintext 2FA secrets or backup codes.

If you register a passkey, a public key is stored on our servers to verify your identity. The private key and any biometric data never leave your device. Passkeys are stored as credential IDs and public keys only—we cannot access your device's biometric data.

Sign-in sessions. Your sign-in session records (described in section 1) are used to keep your account secure and are automatically limited to the most recent fifty. You can inspect them, sign a device out remotely, and remove session records yourself at any time from your Security settings.

4. Profile Pictures & Uploaded Media

When you upload a profile picture, the image is stored and delivered using a third-party service (Cloudinary) that processes media on our behalf. This service may access the image to store, optimize, and serve it.

Metadata is stripped. Before your profile picture is stored, we remove embedded metadata (such as EXIF, IPTC, and XMP data) so that details like GPS location and camera information are not exposed to other users or retained.

Automated moderation. Uploaded profile pictures are reviewed by an automated content-screening system to help prevent inappropriate, abusive, or illegal imagery. If an image is flagged, it will be rejected and not made public. You remain responsible for the content you upload in accordance with our Terms of Service.

Supported formats are JPG, PNG, GIF, and HEIC. We do not scan or knowingly collect data from your device beyond the image you choose to upload.

Animated GIF avatars. To use an animated GIF as your profile picture, choose one from the GIF picker next to Upload Image. Picked GIFs are saved by their URL — they are not uploaded to our image storage or run through our image moderation; they have already passed the picker provider’s own content screening.

GIF search. The GIF picker in chat is powered by a third-party service (KLIPY) that provides the GIF library. When you search for a GIF, the search keyword is sent to this service to find matching results, and the GIFs shown to you are served from its content-delivery network. We do not send your account information, messages, or other personal data to this service, and we do not retain a record of your GIF searches.

5. Message Content & Chat Moderation

Chat moderation. Messages you send through the chat are screened automatically for toxic content (such as profanity, hate speech, insults, threats, or graphic content). Screening happens in real time before a message is delivered: messages that are flagged are blocked and are not sent. This text is processed by an automated classification system for moderation purposes only — it is not used to profile you, sold, or used for advertising, and it is not shared publicly. Blocked messages are stored securely in a moderation log for abuse prevention and audit.

6. Data Sharing

We do not sell your personal information. Message content and profile information you post are visible to other users in the chat rooms you participate in. We may share data with trusted service providers (such as our media and infrastructure providers) solely to operate the service. We may disclose information if required by law.

7. Blocking

Blocking a user is a privacy and safety control available from any user’s profile. When you block another user:

• The blocked user can no longer follow you or send you messages.
• Existing mutual follows between you are removed in both directions.
• You no longer see that user’s messages in the chat.
• The blocked user’s online status is hidden from you.
• The blocked user will see your profile as not found if they try to visit it.

Blocking is one-way: it controls what the blocker sees and from whom the blocker receives contact. Your own message history remains intact; blocking conceals the blocked user’s newer messages from your view rather than deleting any data. You can manage and unblock users at any time from your Settings → Privacy.

8. Your Rights

You can access, update, or delete your account information at any time through your profile settings. You may remove or replace your profile picture at any time. You may contact us to request removal of your data.

You can control your following relationships at any time by following or unfollowing users, manage your blocked users list, and adjust who can see your online status by controlling who you follow.

You can review and manage the devices and locations signed into your account, sign a device out remotely, and delete session records at any time from Settings → Security.

You can enable or disable push notifications at any time from Settings → Notifications. Turning them off unsubscribes this device and deletes its stored subscription, so no further notifications will be delivered to it.

9. Contact

If you have questions about this Privacy Policy, please contact us through the app or at privacy@livechatapp.com.