What is never stored
The text of an ordinary conversation, audio, video, screenshots and uploads. Calls are not recorded. Selected text is sent to an operator only if you choose to attach it to a report.
We keep as little as we can stand.
This is a pilot, so the honest version is short: ordinary conversations are not stored, and the few things we do keep have a stated life span.
What is kept briefly
Room metadata for seven days if nobody reported it. Report content for thirty days after a case closes. Audit entries for ninety days, unless a legal hold applies and a person recorded why.
What we cannot promise
We do not record, but the person you are with can still photograph their own screen. Treat everything you share as capturable, because it is.
Full privacy notice and retention details
What this version handles
Joining creates an internal participant identity and records your admission status, policy version, acceptance time, and session expiry. The service stores hashed invitation, recovery, and session tokens. Your browser receives a secure, HttpOnly session cookie so you can return without redeeming another invitation.
Why that identity persists
Your identity supports controlled admission and account recovery. Recovery restores the same identity and revokes older sessions. Blocks, restrictions, and daily video allowances also use this identity. Clearing your browser does not delete your membership record.
Hello Hours attendance
For scheduled Hello Hours, we store your plan to attend separately from your actual arrival. Other members see aggregate commitment and current check-in counts, not an attendee list. Event measurements use your internal participant reference to measure waiting time, whether you reached a conversation, and attendance at the next session. Commitment and attendance records are retained for 90 days. These measurements contain no conversation text. You can cancel your commitment before the event ends.
Shared Sparks
Shared Sparks are optional two-choice questions inside a conversation. Your submitted choice is temporarily held to coordinate the activity and stays hidden from your partner until both of you answer. Pending choices are removed when the activity finishes, either person passes, the conversation ends, or the activity expires after 60 seconds. A revealed result stays only in the current tabs and clears when the conversation ends or the page reloads. Spark choices are not added to report evidence, used to build a profile, or sent to an AI service. Ordinary chat remains available if you pass.
The services involved
Cloudflare hosts the application and its operational records. Cloudflare Turnstile performs a security check before admission and recovery; network and browser information is processed for that check. Visit Cloudflare’s privacy policy for its practices.
Conversations and optional evidence
The service stores room and connection metadata, but does not store ordinary transcripts or automatically record calls or screenshots. The latest 100 messages stay in the current tab’s memory during a conversation. On departure, up to 10 delivered messages remain temporarily for optional report evidence, expiring after 10 minutes and clearing on a new room or reload. Evidence is sent only if you explicitly opt in and select individual messages. Operators see it labeled participant-submitted and unverified. Video and device capture remain unavailable.
Retention and your choices
Optional conversation feedback stores only your Yes or No answer and minimal duplicate-prevention details for 30 days, without conversation text. Ended, unreported room metadata is retained for 7 days. Report content is retained for 30 days after closure, and audit records for 90 days. Legal holds protect associated records. Admission, acceptance, identity, and block records persist for pilot operation; automatic deletion of those records is not implemented. Signing out revokes the current session. For access, deletion requests, or appeals, contact the operator below or your inviter. The privacy notice and request process must be finalized before production admission opens.
Before public operation
The responsible operator, contact address, participating countries, and applicable privacy terms are not yet finalized. This draft must be completed and reviewed for the intended markets before production admission opens.
A question about the pilot?
Contact the person who invited you.