Privacy Policy

This policy explains what personal data ChatToAnyone collects and how we use it. We are the data controller. We aim to collect as little as possible and to protect younger users in line with the UK Age Appropriate Design Code.

What we collect

• Account data: an anonymous ID by default; an email address only if you choose to save your chats or sign in.
• Connection data: your IP address and approximate country (provided by Cloudflare), used for security, rate-limiting, and to apply regional safety rules.
• Messages: moderated before display and stored so you can reopen chats. Chats are kept unless you explicitly choose automatic deletion for that conversation. We also retain a snapshot of a message when it is reported or flagged, for safety and legal compliance.
• Payment data (Plus): handled entirely by Stripe. We never see or store card numbers; we store your Stripe customer id, subscription status and renewal date. If you tick “Keep me updated” on the Stripe checkout page and leave without paying, we may email you a link to finish checkout, at most once a week. Every such email has a one-click unsubscribe, and we keep only a one-way hash of your address to honor it.
• Cookies: essential cookies keep you signed in, remember your age band, language and topic, and operate the service. If analytics is allowed (see below), Google Analytics may also set its _ga cookies. Advertising is never loaded in the chat, so there are no advertising cookies here. The full list is in the website privacy policy.
• Product analytics: we use PostHog's EU service to count page views, referring domains and a small set of product events such as starting a chat, linking an account and starting or completing checkout. In the EU and EEA, the UK, Switzerland and Brazil, and whenever we cannot tell your country, PostHog runs only after you allow analytics using “Analytics choices” at the bottom of the page. Everywhere else it starts enabled, like Google Analytics, and stops as soon as you decline there. We remember that choice for up to 180 days; you can change it at any time. A random identifier in session storage connects events in the same browser tab, including checkout returns. It is cleared when you decline or close the tab. We do not use analytics cookies or person profiles in PostHog. Where an opt-in is required, Google Analytics storage remains denied until you allow analytics; limited cookieless requests may still be sent. Advertising consent is separate. We send only fixed categories such as chat mode, sign-in method and billing interval. Chat subpaths are grouped; messages, email addresses, profiles, room or customer identifiers, query strings and recordings are not sent. It respects Do Not Track and Global Privacy Control. Network requests still disclose your IP address to the service for delivery.

How your analytics choice is asked for depends on where you are. In the EU and EEA, the UK, Switzerland and Brazil — and whenever we cannot determine your country — analytics and advertising signals both start denied until you choose: on a page that carries advertising (our public guides, never a chat), Google's certified consent platform is the only banner and we follow the analytics answer you give it; everywhere else on the site our own “Analytics choices” banner asks. Outside those countries, analytics and Google's advertising signals start enabled and you can switch analytics off at any time with the “Analytics choices” control at the bottom of the page, which stays available in every case; Google's own notice covers US state privacy rights. In every region a browser Do Not Track or Global Privacy Control signal keeps everything denied and overrides both banners. Your approximate country comes from your network connection when the page loads, is used only to pick which of these applies, and is remembered in your browser for the current session.

Why we use it (lawful bases)

We rely on: performing our contract with you (to provide the chat service); our legitimate interests (to keep the service safe and prevent abuse); and legal obligations (for example, reporting child sexual abuse material). Where required, we rely on consent.

How long we keep it

Chats are kept until you delete them or explicitly choose automatic deletion for that conversation. Photos sent in a chat are deleted with that chat’s messages, when the chat is deleted or after 7 days if you chose automatic deletion, and are never kept longer than those messages. Safety and legally required evidence may be retained separately. Snapshots tied to a report or a safety/legal investigation are retained only as long as necessary (and up to one year where preservation is legally required). Inactive anonymous accounts and their connection data are deleted automatically after a period of inactivity. Subscription records are kept for as long as tax and accounting law requires.

Sharing

We use Cloudflare (network/security, and some AI model requests when configured), our own servers, Stripe (payments, for Plus), ZeptoMail (sending sign-in and checkout-reminder emails), OpenRouter (the AI companions’ language models, which receive the conversation text needed to reply), OpenAI (when configured, its moderation service checks messages and every uploaded photo before anything is shown), Google Analytics and PostHog’s EU service (analytics, as described above) to run the service. We share data with authorities such as NCMEC or law enforcement where we are legally required to, for child safety. We do not sell your personal data.

Children

Under-13s may not use the service. For users aged 13–17, we apply higher privacy protections by default, limit them to AI companions, and do not profile them for advertising.

Your rights

You can request access to, correction of, or deletion of your personal data, and you can object to certain processing. Email privacy@chattoanyone.com. You can also complain to the UK Information Commissioner’s Office (ico.org.uk).

Changes

We may update this policy; the “last updated” date above reflects the latest version.