Privacy Policy

This policy explains what personal data ChatToAnyone collects and how we use it. We are the data controller. We aim to collect as little as possible and to protect younger users in line with the UK Age Appropriate Design Code.

What we collect

• Account data: an anonymous ID by default; an email address only if you choose to save your chats or sign in.
• Connection data: your IP address and approximate country (provided by Cloudflare), used for security, rate-limiting, and to apply regional safety rules.
• Messages: moderated before display and stored so you can reopen recent chats. Free chats are kept for 7 days; chats on a saved (email) account or a Plus subscription are kept until you delete them. We also retain a snapshot of a message when it is reported or flagged, for safety and legal compliance.
• Payment data (Plus): handled entirely by Stripe. We never see or store card numbers; we store your Stripe customer id, subscription status and renewal date.
• Cookies: strictly-necessary cookies only — to keep you signed in, remember your age band, language and topic, and operate the service. No advertising or tracking cookies on the chat experience.

Why we use it (lawful bases)

We rely on: performing our contract with you (to provide the chat service); our legitimate interests (to keep the service safe and prevent abuse); and legal obligations (for example, reporting child sexual abuse material). Where required, we rely on consent.

How long we keep it

Free chats are deleted automatically 7 days after the last message. Chats belonging to a saved account or a Plus subscription are kept until you delete them or close your account. Snapshots tied to a report or a safety/legal investigation are retained only as long as necessary (and up to one year where preservation is legally required). Inactive anonymous accounts and their connection data are deleted automatically after a period of inactivity. Subscription records are kept for as long as tax and accounting law requires.

Sharing

We use Cloudflare (network/security), our own servers, Stripe (payments, for Plus), Resend (sending sign-in emails) and OpenRouter (the AI companions’ language models, which receive the conversation text needed to reply) to run the service. We share data with authorities such as NCMEC or law enforcement where we are legally required to, for child safety. We do not sell your personal data.

Children

Under-13s may not use the service. For users aged 13–17, we apply higher privacy protections by default, limit them to AI companions, and do not profile them for advertising.

Your rights

You can request access to, correction of, or deletion of your personal data, and you can object to certain processing. Email privacy@chattoanyone.com. You can also complain to the UK Information Commissioner’s Office (ico.org.uk).

Changes

We may update this policy; the “last updated” date above reflects the latest version.