Privacy Policy

ShatChat is a chat app you can only get into by proving, to your own phone, that you're on a toilet. This policy explains what information the app and its server handle, who can see it, how long we keep it, and the choices you have. ShatChat runs a server — messages have to reach other people somehow — but the photos the verification ritual takes never leave your device. See the Terms of Use for the rules around using the Service; this page is about data.

Information We Collect

To run the app, our server stores:

• A device credential. On first launch, the app generates a random credential and our server stores only a scrambled, one-way version of it, plus when your device was last seen. This is how we recognize your device — it isn't tied to your name, email address, or phone number, none of which we ask for.
• Session data. Each time you sign in, we store the food word you enter, the handle made from it (that word plus random digits, different every time), when the session started, was last verified, and ended, and whether you chose to be visible to friends that session. This runs the 3-minute and 15-minute clocks and the "sitting" count.
• Messages you post to the chat room, including reaction cards and replies, with the handle they were posted under, which reaction cards you've double-tapped, and the emoji you've added to messages. A reply stores a short quote of the message it answers. Emoji are linked to your account, but other people only ever see a count.
• An account name, if you set one. It's optional and shown only to your friends — never in the chat room.
• Friend connections. When you invite someone, we store a scrambled, one-way version of the invite link (never the link itself) and whether and when it was accepted or declined. An accepted invite is what makes two people friends. If you unfriend someone, we store that too.
• Direct messages. For each DM thread, we store who's in it, its name if someone gave it one, the messages, replies, and emoji sent in it with the name they were sent under, and whether you've turned on notifications for it.
• Blocks: who you've blocked, so the block can be enforced in both directions.
• Toilet map locations, only if you opt in. When you check "track this toilet login" and allow location access, we store that login's latitude, longitude, and time. Nothing is recorded for a login where you didn't check the box.
• An Apple account identifier, only if you choose to connect your Apple account on the account page. We receive the anonymous identifier Sign in with Apple provides for our apps, which lets you keep your account when you switch phones. We don't ask Apple for your name or email address, and we don't receive them.
• A push notification token, only if you allow notifications — which the app first asks for when you turn them on for a DM thread — along with the generic device name your phone reports (such as "iPhone"). It's used solely to deliver notifications.
• Standard server logs, like most servers keep — for example, IP address, time, and the address requested — used for security, abuse prevention, and fixing problems.
• If you use the web form to request account deletion, the email address and account name you enter, used only to find your account and reply to you.

The app does not ask for or collect your email address, phone number, contacts or address book, or payment details — ShatChat sells nothing, so there's no billing information to collect. We never collect your location unless you opt in for a specific login as described above.

What Never Leaves Your Device

The two photos the verification ritual takes — the toilet photo and your loo-view photo — are analyzed entirely on your device using on-device image recognition (Apple's Vision framework on iPhone; Google's ML Kit and MediaPipe, running on the device, on Android). Neither photo is ever uploaded, saved, or seen by anyone, including us. The loo-view photo is converted to a numeric similarity signature, used to confirm you're re-photographing the same spot every few minutes, and only that signature — not the photo — is kept, encrypted, in your device's secure storage (the Keychain on iPhone). It's cleared when your session ends and is never sent to us.

What Other People Can See

• Everyone in the chat room sees your messages and reaction cards under that session's handle, and the number of people currently sitting. When you double-tap a reaction card, everyone in the room briefly sees a banner naming your handle and the poster's. Emoji added to a message are shown as counts, without saying who added them. A reply shows a short quote of the message it answers, with that message's handle or name.
• Your friends see your account name, if you've set one. If you're visible to friends for a session, they also see that you're sitting and your handle for that session — which means they can tell which of that session's room messages are yours.
• Whoever opens an invite link you've shared sees your account name, if you've set one, before deciding whether to accept.
• Everyone in a DM thread sees the messages sent in it, the thread's name, and who's in it. Your DM messages appear under your account name, or under your current handle if you haven't set one. Renaming a thread announces the change to everyone in it.
• Your toilet map is visible only to you — never to other users, friends or not.
• Someone you've blocked, or who has blocked you, sees none of the above from you, and you see none of it from them.

How We Use Information

• To run the Service: recognize your device, manage sessions, deliver and display messages, show presence, connect friends, run DM threads, show your toilet map, and send the notifications you've turned on.
• To let you keep your account on a new phone, if you've connected your Apple account.
• To enforce the rules in our Terms of Use: reviewing reports, enforcing blocks, removing content, and banning accounts that violate them.
• To prevent abuse, such as limiting how often an account can post, send reports, or create invites.

We do not use your information for advertising, to build a behavioral profile of you, or to train machine learning models.

No Ads, No Tracking

ShatChat shows no ads and doesn't track you across other companies' apps or websites. The iPhone app contains no third-party analytics or advertising SDKs, does not use your device's advertising identifier, and doesn't ask for App Tracking Transparency permission because there's nothing to ask for.

The Android app uses Google's Firebase to deliver push notifications, and Firebase includes Google Analytics for Firebase, which automatically collects basic usage and device information — such as an app-instance identifier, device model and operating system, approximate location derived from your IP address, and when the app is opened — and may collect your device's advertising ID. Google processes that data under its own privacy policy. We don't use it for advertising or to identify you, and we don't send it anything that identifies your ShatChat account.

The chat room occasionally shows a labeled promotional card — for example, for one of our other apps, a prompt to rate ShatChat, or a link to tip the developer on Buy Me a Coffee. Every person sees the same set of cards; nothing is targeted to you individually and no data is collected to show them. If you follow a link off the app, the site you land on handles your information under its own policy.

How Long We Keep Things

• Chat room messages are kept for 24 hours, then permanently and automatically deleted, along with any double-taps and emoji on them.
• Session records are deleted automatically once the session has ended and every chat room message posted in it has been deleted. Toilet map locations aren't deleted with the session.
• Direct messages don't expire. Your DM messages and emoji are kept until you delete your account. A quote of your message inside someone else's reply is kept as long as their reply is.
• Toilet map locations are kept until you delete your account.
• Your account name, device credential, friend connections, blocks, and Apple account identifier are kept until you delete your account (or, for a block, until you undo it). If we ban an account, we keep its record so the ban holds.
• Invites: an unanswered invite link stops working after one year and is then deleted; a declined one is deleted after about a day. An accepted invite is kept as the record of that friendship until one of you deletes your account.
• Push notification tokens are kept until you turn off ShatChat's notifications in your device's Settings or delete your account, or until Apple or Google tells us the token is no longer valid.
• If you report a message, we receive a copy of it by email, and we keep that copy for as long as needed to review and act on it — which can outlast the message itself.
• Server logs are rotated automatically and overwritten as new ones come in; logs held by a logging provider are deleted automatically after its retention period.
• A web account-deletion request is kept by email only as long as needed to act on it and reply.
• Backups: we take a nightly backup of our database and keep each one for 30 days, so anything deleted from the Service can remain in a backup for up to 30 days before it ages out. Backups are used only to restore the Service after a failure.

Reporting, Blocking, and Moderation

Tapping any message another person wrote, in the chat room or in a DM thread, lets you report it and block its author. Doing so emails us a copy of the message, along with the handle or name it was posted under, when and where it was posted, and internal identifiers for the account that posted it and the account that reported it, so we can act on it. The person you reported isn't told. We act on reports of content that violates our Terms of Use within 24 hours.

Blocking works in both directions: the two of you stop seeing each other's chat room messages, any DM thread you share is hidden from both of you, neither of you gets notifications about the other, and you're unfriended. You can see and undo your blocks on the account page. You can also unfriend someone without blocking them. For anything else, email us at [email protected].

Sharing of Information

We do not sell your information, and we do not share it with advertisers or data brokers. We use a small number of service providers to operate the Service, each handling only what its job requires:

• Our cloud hosting provider, which runs the server our database lives on.
• Cloudflare, which carries traffic between the app and our server and stores our backups.
• Our email delivery provider, which delivers message reports to our inbox.
• A logging provider, which may store and search our server logs for us.
• Apple (on iPhone) or Google (on Android), which deliver push notifications. A notification carries the thread's name as you see it — which may be your friends' account names — and, in a group thread, the sender's account name. It never includes the text of a message.

We may also disclose information we hold: to comply with a law, regulation, or legal process; to investigate or act on a report under our Terms of Use; to protect the rights, property, or safety of our users or the public; or if Nordighund LLC is involved in a merger, acquisition, or sale of assets, in which case we'd notify you before your information becomes subject to a different privacy policy.

Since ShatChat has no purchases, we don't share any purchase or billing information with Apple or Google. If you use the App Store or Google Play to leave a review or contact them about the app, that interaction is governed by their own privacy policies, not this one.

Where Your Data Lives

Our server runs on a cloud server we rent in Ashburn, Virginia, and your data is stored in our own database on it — we don't use a third-party backend-as-a-service or hand your data to a cloud database vendor. Backups are stored with Cloudflare in North America. The iPhone app contains no third-party SDKs beyond what Apple provides; the Android app's Google SDKs are described above.

Your Choices

• Location. The toilet map is off unless you check "track this toilet login" when you sign in, and you can turn off ShatChat's location access at any time in your device's Settings.
• Visibility to friends. You can choose, for each session, whether friends can see you're sitting, and set the default on the account page.
• Account name. It's optional, and you can change or clear it at any time.
• Unfriend. You can remove anyone from your friends list at any time.
• Notifications. They're off for every DM thread until you turn them on, and you can turn them off per thread or in your device's Settings.
• Report and block. Any message another person wrote can be reported, and its author blocked; blocks can be undone from the account page.
• Delete your account. On the account page, tap Delete account. This immediately and permanently deletes your account name, device credential, friend connections, invites and blocks, your DM messages and your place in DM threads, your emoji, your toilet map, your push notification registration, your session records, and your chat room messages. Copies in backups age out within 30 days, a copy of a message someone reported may be kept as described above, and a quote of your message in someone else's reply stays with that reply. If you can't get into the app, you can ask us to delete your data using the web form at the link below.
• Deleting the app is not the same as deleting your account: your account stays on our server. On iPhone, iOS keeps the app's device credential in your Keychain, so reinstalling ShatChat on the same phone brings back the same account. To delete your account, use Delete account first.

Depending on where you live, you may have additional rights over your personal information under laws such as the GDPR or CCPA, including rights to access, correct, delete, or receive a copy of your data. Because we don't know your name, email address, or phone number, Delete account in the app is the most reliable way to delete your data. If you can no longer use the app, use our account deletion form, or contact us for anything else, and we'll work with you to find the records that are yours.

Children's Privacy

ShatChat carries a 17+ App Store age rating because of its unfiltered chat, and is not directed at children. We do not knowingly collect information from anyone under 13, and if we learn that we have, we will delete it. If you believe a child has used ShatChat, contact us.

International Users

Our server and backups are located in the United States. If you use ShatChat from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your country.

Security

Secrets that act like keys — your device credential and invite links — are never stored in plain text on our server; we keep only a scrambled, one-way version that can't be turned back into the original. Traffic between the app and our server is encrypted in transit. Messages, including DMs, are not end-to-end encrypted: they're stored on our server so they can be delivered, and we may access them when needed to operate the Service, act on a report, or comply with the law. No method of storage or transmission is perfectly secure, but we work to protect your information using reasonable technical and organizational measures.

Changes to This Policy

We may update this policy from time to time. If we make a material change, we will update the effective date at the top of this page and, where appropriate, notify you in the app.

Contact Us

Questions about this policy or your data? Email us at [email protected].