Privacy Policy

Who we are

The Service is operated by [OPERATOR NAME], [ADDRESS]. For any privacy question or request, contact us at [CONTACT EMAIL].

Information we collect

When you create an account and use the Service, we collect:

• Account details — your email address, username, display name, an optional status line, and your country and (where applicable) state or region.
• Password — stored only as a salted cryptographic hash (scrypt). We never store your password in readable form.
• Content you send — the messages you post in rooms and in direct messages.
• Presence & activity— which room you are in, whether your microphone or camera is on, whether you are typing, and a "last seen" timestamp used to show whether you are online.
• Call records — a log of calls you place or receive (who called whom, the time, and whether it was a video call). We do not record the audio or video of calls.
• Profile picture — optional, and only ever which one of our built-in pictures you chose. There is no upload, so we hold no image of you.

We do not collect a phone number, a real name, payment details, or an uploaded profile photo, and we do not use any advertising or analytics tracking.

How we use your information

• To create and secure your account and keep you signed in.
• To deliver your messages and connect your voice and video sessions.
• To show presence (who is online and in which room).
• To send you essential account emails — email confirmation and password resets.
• To keep the Service safe and enforce our Terms.

Cookies and local storage

We use a single, strictly necessary cookie (gm_session) to keep you signed in. It contains only a random session token, is marked HttpOnly, and expires after 30 days. Because it is essential to provide the Service and we set no advertising or analytics cookies, we do not show a cookie-consent banner. Your browser also stores your theme choice and your selected microphone/camera locally on your device; that information stays in your browser and is never sent to us.

Messages are stored and are not end-to-end encrypted

Your messages travel over an encrypted connection (HTTPS/TLS) and are stored on our database so we can deliver them and show your history. They are not end-to-end encrypted, which means that, in principle, they can be accessed on the server. Please keep this in mind and do not share highly sensitive information through the Service.

Voice and video calls, and your IP address

Voice and video use WebRTC and connect directly between participants wherever they can; that media does not pass through our servers. To establish these direct connections, participants' devices exchange network information, which means your IP address may be visible to the other people on a call. Your device also contacts Google's public STUN servers (stun.l.google.com) to discover how to connect.

Some networks — mobile data in particular — will not allow a direct connection. When that happens the call falls back to a relay (TURN) server run by a third-party provider, Metered, and the audio and video travel through it. The relay can see the IP addresses at both ends, but the media stays encrypted between the participants (DTLS-SRTP), so neither the provider nor we can watch or listen to it. We do not operate this relay ourselves.

We keep a count of how many connections were direct and how many needed the relay, so we can judge whether to run our own. These are running totals only — no identifier, timestamp or address is stored with them, and they cannot be traced back to a person or a call.

How your information is shared

• With other users — your username, display name, status line, country/region, and online status are visible to other users. Your email address may be returned when another signed-in user searches for you.
• Email delivery — we use Resend to send account emails; it receives the recipient email address and message content.
• Hosting & database — your data is stored with our database/hosting provider under their security controls.
• Connectivity— Google's public STUN service, as described above.
• Legal — where required by law or to protect the Service and its users.

We do not sell your personal data.

Retention and deleting your data

We keep your account information and content for as long as your account is active. You can delete your account yourself from Settings. Your account is hidden from search straight away and you are signed out; for 30 days the deletion stays reversible, and signing in again cancels it. After 30 days we permanently erase your profile, messages, direct messages, friendships and the rooms you started. To request access to or correction of your data, email us at [CONTACT EMAIL] and we will act on your request within a reasonable time.

Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal data, and to object to or restrict certain processing. To exercise any of these, contact [CONTACT EMAIL]. You may also update your profile in the app's settings at any time.

Children

The Service is not intended for anyone under 13 years old, and you must be at least 13 to use it. We do not knowingly collect personal data from children under 13. If you believe a child has provided us personal data, contact [CONTACT EMAIL] and we will delete it.

Security

We protect your data with measures including TLS encryption in transit and salted scrypt password hashing. No online service can be completely secure, but we work to protect your information and limit access to it.

International users

Waayou is available globally. Your information may be processed and stored in countries other than your own, which may have different data-protection laws. By using the Service you consent to this transfer and processing.

Changes to this Policy

We may update this Policy from time to time. When we do, we will change the "Last updated" date above and, for material changes, take reasonable steps to notify you.

Contact us

Questions about this Policy or your data? Email [CONTACT EMAIL]. See also our Terms of Service.