Last updated: this document describes Paranoid Chat's data handling as of the current build. It is written to reflect what the service actually does, not a generic template.
Paranoid Chat is a personal project offering three kinds of chat rooms with different privacy models: password-protected rooms, 24-hour ephemeral rooms, and end-to-end-encrypted (e2ee) rooms. This policy explains what data each model involves.
Creating an account requires a username, a password that is not stored in plain text, and completion of a short-lived abuse-prevention verification step. A short display tag and a display color are derived automatically from your account and are not personal information.
Room passwords are stored only as salted hashes, the same as account passwords. End-to-end-encrypted rooms use a one-time "owner key" instead of a room password; it is shown to the room's creator exactly once and is never stored or displayed again in any recoverable form.
Room owners may generate join tokens to invite specific people. We record which account used a given token and when, so the room owner can see who joined via that invitation. This record is tied to the token, not shared outside the room's own management view.
Accounts that have not logged in or sent a message for 90 consecutive days are automatically and permanently deleted, along with their sessions. Ephemeral rooms are deleted 24 hours after creation regardless of activity.
This service uses Cloudflare Turnstile to reduce automated abuse of account registration and login. Cloudflare Turnstile's own privacy practices apply to that interaction and are outside our control.
We do not sell your data. We do not use your messages for advertising, analytics, or any purpose other than delivering them to the room you sent them in. We do not read the content of end-to-end-encrypted rooms — that content is designed to remain unreadable to us.
You may delete your account at any time from within the app. This permanently removes your account and active sessions. It does not retroactively delete messages you previously sent in password rooms that are still within their 7-day retention window, since those are tied to the room, not solely to your account.
If this policy changes in a way that affects how your data is handled, you will be asked to review and re-accept it before continuing to use the service.
This is a personal project. Questions can be directed to the developer via the portfolio link in the app's settings.