Last updated: October 2026

Privacy Policy

Crosschatter ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use and store it, and what choices you have. It applies to all users of the Service, including anonymous users and registered account holders.

By using Crosschatter, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use the Service.

1. Information We Collect

Information You Provide Directly

Anonymous users: When you use Crosschatter without an account, we collect:

  • IP address (for connection routing and abuse prevention)
  • Browser type and version, operating system, and device type
  • Chat session metadata (timestamps, duration, mode selected)
  • The chat messages you send, linked to a random session identifier and the IP address they were sent from
  • Filter preferences you enter (age range, location preferences, interests) — stored locally in your browser, not on our servers unless you create an account

Registered account holders: If you create an account, we additionally collect:

  • Email address
  • Username
  • Password (stored as a bcrypt hash — we never store your plaintext password)
  • Location data (country, region, city, zip/postcode) — optional, used for matching
  • Interests, hobbies, and topic preferences
  • Age, gender, height, weight — optional, used for matching filters
  • Profile bio and display name
  • Profile avatar, banner image, and photo gallery uploads
  • Social links (Twitter, Instagram, Spotify, etc.) you choose to add
  • Political preference answers — optional, stored encrypted, used only for matching
  • Hotbed question answers — optional, used for matching and debate features
  • Account creation date and last login timestamp

Two-Factor Authentication

If you enable 2FA, we store an encrypted TOTP (Time-based One-Time Password) secret used to verify your identity during login. We also generate and store hashed backup codes at setup time. Magic link tokens are stored temporarily (expiring after a short window) for passwordless login.

Content You Create

We store content you actively create on the platform, including:

  • Direct messages (DMs) between registered users
  • Community posts, comments, and reactions
  • Feed posts, reposts, replies, and likes
  • Forum threads and replies
  • Message citations (URLs and descriptions you add to messages)
  • Endorsements you give or receive
  • Bug reports and support messages you submit

Chat messages sent without an account are stored together with a random session identifier and the IP address they were sent from, so that we can investigate reports, enforce our Terms and Community Guidelines, prevent abuse, and respond to lawful requests. See Data Retention below for how long this is kept.

Information Collected Automatically

  • IP address and approximate geolocation derived from IP
  • Browser and device information (user agent, screen resolution)
  • Pages visited and features used within Crosschatter
  • Socket connection events (connect, disconnect timestamps)
  • Error logs and crash reports
  • Performance metrics

Public Page Analytics

On our public pages (the home page, the /talk pages and shared connection pages) we record anonymous usage events: page views, how far down the page you scroll, and which buttons, FAQ questions, animation steps or demo features you click. When a chat ends, we also record whether the “Share this connection” button was used. These events are only recorded if you allow analytics in our cookie settings. They are linked only to a random identifier kept in your browser's session storage for the current tab, not to your account, username or a cookie, and we do not store your IP address with them. If your browser sends a Do Not Track signal, these events are not recorded at all.

Country Pairings & Live Activity

When two people are matched, we record the two countries shown as their flags in the chat, the chat type (text, voice or video) and the time. Nothing else is stored with it: no usernames, session identifiers, IP addresses or message content. A country is only recorded if it is being shown to your chat partner; registered users can turn this off with the “Show Location” setting in Privacy settings. These records are deleted automatically after 7 days.

We may show recent pairings publicly on our home page with the time rounded (for example, “Brazil ↔ Poland · video call · 2h ago”). Our public pages may also show how many people are online and which countries currently have someone online. These are aggregate figures and do not identify anyone.

Advertising (Google AdSense)

Crosschatter is free and is partly funded by ads served by Google AdSense. Ads may appear on our public pages, beside the chat and on the screen shown after a chat ends; they are never placed inside your conversations. Premium and Pro members don't see ads while signed in. When a page with ads loads, your browser contacts Google, and Google receives information such as your IP address, browser and device details, the page you are viewing, and identifiers stored in cookies or similar technologies. We do not give Google or advertisers your account details, profile, messages or matching preferences.

Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this and other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to Crosschatter and/or other sites on the Internet. Ads are only personalized this way if you allow it in our cookie settings (or, in the EEA, UK and Switzerland, in Google's consent message). Otherwise you see non-personalized ads, which are based on context such as the page and your general location; these may still use cookies or similar technologies for frequency capping, fraud prevention and aggregated reporting where the law allows.

You can change your choice at any time with the “Cookie settings” link in our footer or in Settings → Privacy. You can also opt out of personalized advertising through Google's My Ad Center or, for other participating vendors, at aboutads.info (US) and youronlinechoices.eu (EU). Learn how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites.

Third-Party Service Data

  • Spotify: If you connect Spotify, we receive and display your currently playing track. We do not store your Spotify credentials — only the display data (song title, artist) is temporarily cached.
  • Klipy (GIF search): GIF searches are sent to Klipy's API. We do not store your GIF search queries beyond the current session.
  • Email providers: We share your email address with our email delivery provider solely to send transactional emails (magic links, password resets, notifications).
  • MyMemory (message translation): When a chat message is in a different language from yours, its text (up to 500 characters) is sent from our servers to the MyMemory translation API so it can be shown in your language. Only the message text and the language pair are sent, not your username, IP address or any other information about you or your chat partner. We do not store the translations. MyMemory processes the text under its own privacy policy.

2. How We Use Your Information

  • To match you with compatible chat partners based on your location, interests, and filter preferences.
  • To authenticate your account, manage your sessions, and maintain security.
  • To display your public profile information to other users.
  • To enable the endorsement and reputation system.
  • To send transactional emails: magic links, password resets, account security alerts.
  • To operate community features, including membership, posts, and group chats.
  • To moderate content and enforce our Terms and Community Guidelines.
  • To detect, prevent, and investigate fraud, abuse, and security threats.
  • To improve the Service through aggregated, anonymized analytics, including measuring how visitors use our public pages.
  • To show aggregate live activity on our public pages, such as the number of people online, which countries have someone online, and recent country-to-country pairings.
  • To translate chat messages into your language.
  • To show ads that keep the Service free, personalized only with your consent (see Advertising in Section 1).
  • To comply with legal obligations and respond to lawful requests from authorities.
  • To calculate and display reputation scores from endorsement data.

We show ads through Google AdSense, as described in Section 1. We do not build advertising profiles ourselves, and we never give advertisers your account details, profile, messages or matching preferences. Google may personalize ads using cookies only if you consent, and you can withdraw that consent at any time. We do not sell your data for money.

3. Message Privacy

All data in transit between your device and our servers is encrypted using TLS/SSL. WebRTC video and voice calls are peer-to-peer and encrypted end-to-end by the WebRTC protocol; we do not route or record call media.

  • Anonymous chat messages (sent without an account) are stored in our database with a random session identifier and the sender's IP address. They are not shown to other users outside the conversation, except in chats both participants chose to make public.
  • Public chats that both participants opt into are visible to viewers while live and remain available in the public archive.
  • Direct messages between registered users are stored in our database and accessible to the participants. They are not accessible to other users or our staff without legal process or a moderation report.
  • Community and feed content is stored and may be visible to other members according to community privacy settings.
  • Messages may be reviewed by our moderation team if reported for a policy violation.
  • In exceptional circumstances, messages may be disclosed to law enforcement as required by law.
  • Messages that need translating are sent to our translation provider as described in Section 1; they are not stored there by us.

Sharing a connection: after a chat ends you can choose to share a link to it. The link contains only your country, your chat partner's country and the chat type, and anyone who receives it can see them. It never includes names, usernames or messages. Nothing is shared unless you share it yourself.

4. Public Profile Data

If you have a registered account, certain profile information is publicly visible by default, including:

  • Username and display name
  • Profile avatar and banner image
  • Bio and social links you choose to add
  • Interests and public trait information
  • Endorsement score and badge
  • Public photo gallery images

Sensitive information (email address, password hash, 2FA secrets, political answers, precise location) is never publicly visible. You can control what appears on your profile through account settings.

5. Data Sharing

We do not sell, trade, rent, or share your personal information with third parties for marketing purposes. We share information only in the following circumstances:

  • With other users: Only the profile and content information you choose to share, as described above.
  • With service providers: We use hosting, infrastructure, and email delivery providers who process data on our behalf under strict data processing agreements. These providers may not use your data for their own purposes.
  • With our translation provider: The text of chat messages that need translating is sent to MyMemory, without any information identifying you, as described in Section 1.
  • With Google (advertising): When a page with ads loads, Google receives the technical information described under Advertising in Section 1, and uses cookies to personalize ads if you have consented.
  • Publicly, in aggregate: Live activity figures and recent country pairings, as described in Section 1. These never identify individual users.
  • Legal compliance: We will disclose information if required by applicable law, court order, or government authority, or to protect the rights, property, or safety of Crosschatter, our users, or the public.
  • Business transfers: If Crosschatter is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.
  • With your consent: We may share information with third parties when you explicitly consent.

6. Data Retention

  • Anonymous chat messages: Messages sent without an account in private chats are deleted after 90 days. The session identifier and IP address attached to anonymous messages are deleted after 90 days.
  • Public chats: Messages in chats both participants made public are retained indefinitely as part of the public archive; identifying data attached to anonymous messages in them (session identifier, IP address) is still deleted after 90 days.
  • Chat session records (timestamps, duration, chat type) are retained; the anonymous session identifier on them is deleted after 90 days.
  • Account data: Retained for the duration your account is active.
  • IP address records: For registered accounts we record every IP address used with the account (to sign up, sign in, connect and use the Service), with the time and browser. These records are kept while your account exists and deleted 180 days after the account is deleted, as some countries require. They are visible to our moderators and are used only to investigate abuse, security incidents and ban evasion, and to respond to lawful requests.
  • Direct messages: Retained until you or your conversation partner deletes them, or until account deletion.
  • Community and feed content: Retained until you delete the content or your account.
  • Profile media (avatars, gallery): Deleted when you remove them or delete your account.
  • Deleted accounts: Personal data is removed within 30 days of account deletion. Aggregated or anonymized data may be retained indefinitely. Certain data may be retained up to 90 days to fulfill legal obligations or resolve disputes. When the law requires us to preserve an account (for example after a report of child sexual exploitation, or a preservation request from law enforcement), we keep its data, including IP address records, for as long as that obligation lasts, and delete it afterwards.
  • Moderation records: Records of policy violations may be retained for longer periods to enforce bans and prevent abuse.
  • Magic link tokens: Expire within 15 minutes of generation and are deleted upon use.
  • Country pairings: Deleted automatically 7 days after the match.
  • Public page analytics events: Deleted automatically after 90 days. Aggregated counts derived from them may be kept longer.

7. International Data Transfers

Crosschatter operates globally. Your information may be transferred to and processed in countries other than your own. We take steps to ensure that any cross-border transfers comply with applicable data protection laws, including through standard contractual clauses or other approved mechanisms where required.

8. Your Rights & Choices

Depending on your location, you may have the following rights regarding your personal data:

  • Access: Request a copy of the personal data we hold about you.
  • Correction: Request correction of inaccurate or incomplete data.
  • Deletion: Request deletion of your personal data. You can also delete your account directly in settings.
  • Portability: Request your data in a portable, machine-readable format.
  • Restriction: Request that we restrict processing of your data in certain circumstances.
  • Objection: Object to processing of your data for certain purposes.
  • Opt-out of communications: Unsubscribe from non-essential emails at any time.
  • Withdraw consent: Where processing is based on consent, you may withdraw it at any time.
  • Cookie and ad choices: Turn analytics and personalized ads on or off at any time with “Cookie settings” in our footer or in Settings → Privacy. These choices are saved in your browser, so set them on each device you use.

To exercise any of these rights, contact us at privacy@crosschatter.com. We will respond within 30 days. We may need to verify your identity before fulfilling requests. Some requests may be subject to legal exceptions.

9. Security

We implement industry-standard security measures to protect your information, including:

  • HTTPS/TLS encryption for all data in transit
  • bcrypt hashing (12 rounds) for password storage
  • Encrypted TOTP secrets for 2FA
  • Secure WebRTC peer-to-peer encryption for video and voice calls
  • Rate limiting and account lockout to prevent brute force attacks
  • CSRF token protection on all state-changing requests
  • JWT-based session management with short-lived access tokens
  • Regular security reviews

No security system is impenetrable. We cannot guarantee the absolute security of your data. You use the Service at your own risk, and you are responsible for maintaining the security of your own credentials. If you discover a security vulnerability, please report it responsibly to security@crosschatter.com.

10. Age Requirement & Children's Privacy

Crosschatter is intended only for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal information from a person under 18, we will take steps to delete that information promptly and terminate the associated account. If you believe we may have collected information from someone under 18, please contact us at privacy@crosschatter.com. This policy also satisfies our obligations under COPPA with respect to users under 13.

11. GDPR & CCPA Disclosures

GDPR (EU/EEA Users)

If you are located in the EU or EEA, we process your data on the following legal bases: contract performance (to provide the Service), legitimate interests (security, fraud prevention, service improvement), legal obligations, and consent (for optional data like location and political preferences, for analytics on our public pages, and for personalized advertising). In the EEA, UK and Switzerland, consent for advertising may be collected through Google's certified consent message, which you can reopen from our cookie settings. You have the right to lodge a complaint with your local supervisory authority.

CCPA (California Users)

California residents have the right to know what personal information we collect, the right to delete and correct it, and the right to opt out of its “sale” or “sharing”. We do not sell personal information for money. However, allowing Google to use advertising cookies for personalized ads may count as “selling” or “sharing” for cross-context behavioral advertising under California law. You can opt out at any time with the “Do Not Sell or Share My Personal Information” link in our footer, which turns personalized ads off. We also treat a Global Privacy Control (GPC) signal from your browser as an opt-out. We will not discriminate against you for exercising these rights. To exercise your other rights, contact privacy@crosschatter.com.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will notify registered users of material changes by email and/or by posting a prominent notice on the Service. We will update the "Last updated" date at the top. Your continued use of Crosschatter after changes take effect constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our privacy practices, or to exercise your rights, please contact:

Privacy inquiries: privacy@crosschatter.com
Security vulnerabilities: security@crosschatter.com
General support: support@crosschatter.com