Privacy Policy

Last Updated: October 19, 2026

1. Information We Collect

1.1 Information You Provide Voluntarily

• No registration required: We don't ask for name, email, or password
• Reports: If you report a user, we collect the reason for the report
• Feedback: If you contact us, we collect the message content

1.2 Information Collected Automatically

• IP Address: For security and abuse prevention (anonymized after 30 days)
• User Agent: Browser and device used (for technical compatibility)
• Connection Timestamp: Start/end time of chat (for aggregate statistics)
• WebRTC Technical Data: Connection quality, codecs used (to improve service)
• Technical Cookies: Only for site functionality (no advertising tracking)

1.4 Device Fingerprinting (Anti-Ban Evasion)

To prevent banned users from circumventing bans using VPNs, proxies, or new browser sessions, we generate a browser fingerprint (SHA-256 hash) from non-personal technical attributes:

• Canvas fingerprint: HTML5 canvas rendering variations
• WebGL fingerprint: GPU/driver rendering characteristics
• Audio context fingerprint: Audio stack latency characteristics
• Screen & hardware: Resolution, color depth, CPU cores, memory
• Timezone & locale: Browser timezone, language settings
• Font enumeration: Installed font list (hashed)

Purpose: Solely to enforce bans and prevent ban evasion (legitimate interest, Art. 6(1)(f) GDPR).
Retention: Stored only while a ban is active; deleted when ban expires or is revoked.
No tracking: Fingerprints are not used for advertising, analytics, or cross-site tracking.
No PII: The hash cannot be reversed to identify you personally.

1.5 What We DON'T Collect

• ❌ Video or audio from chats: Conversations are peer-to-peer, don't pass through our servers
• ❌ Text messages: We don't save chat content
• ❌ Personal identifying data: Name, surname, email, phone
• ❌ Chat history: We don't track who you talked to

2. How We Use Information

2.1 Purpose of Processing

• Provide service: Connect users randomly for video chat
• Security: Prevent abuse, spam, and inappropriate behavior
• Moderation: AI system to detect explicit content (real-time, no storage)
• Explicit Content Safety Feature: Optional mutual-consent mode for explicit content. This is a safety feature, not an adult content feature. It requires explicit, reciprocal consent from both participants before activation. Default platform policy: zero tolerance for nudity/sexual content. The feature exists solely to prevent non-consensual explicit content by requiring deliberate opt-in from both users. In this mode, the Report button is disabled to prevent misuse. No content is recorded or stored.
• Technical improvement: Analyze performance and compatibility
• Aggregate statistics: Number of users online, average chat duration (anonymous data)

2.2 Legal Basis (GDPR)

• Consent: By using the site, you consent to necessary data processing
• Legitimate interest: Security, fraud prevention, service improvement
• Legal obligation: IP retention for law enforcement requests (if legally required)

3. Data Sharing with Third Parties

3.1 We DON'T Sell Your Data

We do not sell, rent, or trade your personal data with third parties for commercial purposes.

3.2 Limited Sharing

• Hosting providers: Secure servers for site operation (encrypted data)
• TURN servers: For peer-to-peer connections (only technical metadata, no content)
• Law enforcement: Only if legally required (e.g., criminal investigations)

4. Data Security

4.1 Technical Measures

• TLS/SSL Encryption: All communications are encrypted (HTTPS)
• WebRTC Encryption: Video/audio encrypted end-to-end (DTLS-SRTP)
• Firewall & DDoS Protection: Servers protected from attacks
• IP Anonymization: After 30 days, IPs are anonymized

4.2 Organizational Measures

• Data access limited to authorized personnel
• Regular security audits
• Data retention policy (automatic deletion of old data)

5. Your Rights (GDPR)

In accordance with GDPR (EU Regulation 2016/679), you have the following rights:

• Right of access: Request a copy of your data
• Right to rectification: Correct inaccurate data
• Right to erasure: Request deletion of your data ("right to be forgotten")
• Right to restriction: Limit processing of your data
• Right to object: Object to processing for legitimate interest
• Right to portability: Receive your data in readable format
• Right to lodge complaint: File complaint with Data Protection Authority

To exercise your rights: Contact us at [email protected]

6. Cookies and Similar Technologies

6.1 Technical Cookies (Necessary)

• Session ID: To maintain active connection
• User preferences: Audio/video settings
• Security: CSRF and attack prevention

6.2 Analytics Cookies (Optional)

• Google Analytics: Anonymous usage statistics (if you consent)
• You can disable analytics cookies from browser settings

6.3 NO Advertising Cookies

We don't use profiling or third-party advertising tracking cookies.

7. Data Retention

• Session data: Deleted immediately at end of chat
• IP Address: Retained for 30 days, then anonymized
• Technical logs: Retained for 90 days for debugging and security
• Abuse reports: Retained for 12 months for moderation
• Permanent bans: IP/fingerprint retained indefinitely for security

8. Minors

If you're a parent and discover your child used the service, contact us immediately.

9. International Transfers

Our servers are located in the European Union. If you access from outside the EU, your data may be transferred to the EU, where we apply the same GDPR protections.

10. Subprocessors (GDPR Article 28)

We engage the following subprocessors to provide the Service. Each has a Data Processing Agreement (DPA) in place in accordance with GDPR Article 28.

Subprocessor	Service	Data Location	DPA Status
DigitalOcean LLC	Cloud hosting (Droplet, VPC, Block Storage)	EU (Frankfurt/Amsterdam)	✅ Included in ToS
Squarespace Inc.	DNS, Domain Registration	USA (EU SCCs applied)	✅ Included in ToS
MongoDB Inc. (Atlas)	Managed Database	EU (Frankfurt)	✅ Atlas DPA accepted
Google LLC	Email SMTP (Gmail/Workspace)	EU	✅ Workspace DPA accepted
Adsterra	Advertising (PopUnder)	Per their policy	🔄 DPA requested

Internal Processors (Our Infrastructure)

• coturn (TURN/STUN) — Self-hosted on DigitalOcean Droplet, EU. No external subprocessor.
• Dragonfly/Redis — Self-hosted on DigitalOcean Droplet (or DO Managed), EU.

12. Changes to Privacy Policy

We may update this policy periodically. Substantial changes will be notified via:

• Banner on the website
• Update of "Last Updated" date

By continuing to use the service after changes, you accept the new policy.

13. Contact

13.1 Data Controller

Name: Grigoli Carmelo Alessandro

Address: Vanottiweg 5, 89584 Ehingen (Donau), Germany

Type: Independent developer / Individual operator

13.2 Contact Information

Privacy inquiries: [email protected]

Legal inquiries: [email protected]

General support: [email protected]

VideoChatCouple is an independent project created for entertainment purposes, operated by an individual developer.

← Back to Home