What we collect, how we use it, and your choices. Compliant with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA).
1) What We Collect
- Account info: email address, display name, age, gender, country (from IP geolocation). If you sign in with Google OAuth, we receive your Google email and name.
- Chat content: messages you send in registered chat rooms (stored for moderation and abuse prevention). Random chat / Talk to Strangers messages are not persisted — they exist only in real-time and are not stored on our servers.
- Technical data: IP address, browser type, device info, access timestamps — used for security, rate limiting, abuse prevention, and service operation.
- Reports & blocks: when you report another user or block someone, we store that action for enforcement purposes.
- Payment data: if you make a donation, payment processing is handled by Stripe. We do not store your credit card number or payment details. Stripe processes and stores that data under their own privacy policy and PCI-DSS compliance.
2) Legal Basis for Processing
Under PIPEDA and BC PIPA, we collect and use your personal information only with your consent or for purposes that a reasonable person would consider appropriate. Specifically:
- Consent: you provide consent when you create an account, sign up, or use the service.
- Legitimate purposes: to prevent abuse, enforce our terms, maintain security, and operate the service.
- Legal compliance: when required by law, court order, or to protect rights and safety.
3) How We Use Information
- Provide, maintain, and improve the Service.
- Prevent abuse, spam, fraud, and security incidents.
- Moderate content to keep the community safe.
- Communicate with you about your account (e.g., verification emails).
- Process donations via Stripe.
4) Data Sharing
We do not sell your personal information. We may share data with:
- Service providers: hosting (VPS), PostgreSQL database, Redis, email delivery (Gmail SMTP), payment processing (Stripe), and AI inference (Groq). All process data on our behalf.
- Legal requirements: when required by law, court order, valid subpoena, or to protect rights, safety, and property.
- Law enforcement: if we become aware of illegal activity, CSAM, or threats to safety, we will report to the appropriate authorities (e.g., Cybertip.ca, RCMP).
5) International Data Transfers
Some of our service providers (Stripe, Groq) are based in the United States. By using ChatvLink, you consent to your personal information being transferred to and processed in the US and other jurisdictions. These providers are contractually obligated to protect your data. Under PIPEDA, we remain accountable for data transferred to third parties.
6) Data Retention
- Account data: retained until you delete your account.
- Chat messages (registered users): retained for up to 90 days, then automatically deleted.
- Random chat / Talk to Strangers messages: not stored. Messages exist only in real-time during the active session.
- Reports: retained for 1 year for abuse pattern analysis.
- Technical logs: retained for 30 days.
- Payment records: Stripe retains transaction records as required by law. We store only the transaction ID and amount for our records.
7) Your Rights Under Canadian Privacy Law
Under PIPEDA and BC PIPA, you have the right to:
To exercise any of these rights, use the Contact page or email us directly. We will respond within 30 days as required by PIPEDA.
8) Account Deletion
You can delete your account at any time from your Profile page. This permanently removes your account, profile data, and all associated content. This action cannot be undone. Some anonymized or aggregated data may be retained for analytics purposes.
9) Cookies
We use essential cookies for authentication (session cookies). No tracking or advertising cookies are used. See our Cookie Policy for full details.
10) Security
We use industry-standard security measures including HTTPS/TLS encryption, password hashing (bcrypt), rate limiting, CSRF protection, and content moderation. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
11) Children & Minors
ChatvLink is intended for users who are at least 18 years old. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us immediately for deletion. If we become aware that a user is under 18, we will delete their account and associated data.
12) Breach Notification
In the event of a data breach that poses a real risk of significant harm to affected individuals, we will:
- Notify affected individuals as soon as feasible, as required by PIPEDA s. 10.1.
- Report the breach to the Office of the Privacy Commissioner of Canada.
- Include details about the breach, the information involved, and steps individuals can take to protect themselves.
12) Breach Notification
In the event of a data breach that poses a real risk of significant harm to affected individuals, we will:
- Notify affected individuals as soon as feasible, as required by PIPEDA s. 10.1.
- Report the breach to the Office of the Privacy Commissioner of Canada.
- Include details about the breach, the information involved, and steps individuals can take to protect themselves.
13) Changes to This Policy
We may update this policy from time to time. Material changes will be notified via email or a prominent notice on the site. Continued use after changes means acceptance. The "Last Updated" date at the bottom of this page will always reflect the most recent revision.
14) Contact
For privacy questions, to exercise your rights, or to file a complaint, use the Contact page.