Privacy Policy

Who we are

The Service is operated by [OPERATOR NAME], [ADDRESS]. For any privacy question or request, contact us at [CONTACT EMAIL].

Information we collect

When you create an account and use the Service, we collect:

• Account details — your email address, username, display name, an optional status line, and your country and (where applicable) state or region.
• Password — stored only as a salted cryptographic hash (scrypt). We never store your password in readable form.
• Content you send — the messages you post in rooms and in direct messages.
• Presence & activity— which room you are in, whether your microphone or camera is on, whether you are typing, and a "last seen" timestamp used to show whether you are online.
• Call records — a log of calls you place or receive (who called whom, the time, and whether it was a video call). We do not record the audio or video of calls.

We do not collect a phone number, a real name, payment details, or an uploaded profile photo, and we do not use any advertising or analytics tracking.

How we use your information

• To create and secure your account and keep you signed in.
• To deliver your messages and connect your voice and video sessions.
• To show presence (who is online and in which room).
• To send you essential account emails — email confirmation and password resets.
• To keep the Service safe and enforce our Terms.

Cookies and local storage

We use a single, strictly necessary cookie (gm_session) to keep you signed in. It contains only a random session token, is marked HttpOnly, and expires after 30 days. Because it is essential to provide the Service and we set no advertising or analytics cookies, we do not show a cookie-consent banner. Your browser also stores your theme choice and your selected microphone/camera locally on your device; that information stays in your browser and is never sent to us.

Messages are stored and are not end-to-end encrypted

Your messages travel over an encrypted connection (HTTPS/TLS) and are stored on our database so we can deliver them and show your history. They are not end-to-end encrypted, which means that, in principle, they can be accessed on the server. Please keep this in mind and do not share highly sensitive information through the Service.

Voice and video calls, and your IP address

Voice and video connect directly between participants using WebRTC; the media does not pass through our servers. To establish these direct connections, participants' devices exchange network information, which means your IP address may be visible to the other people on a call. Your device also contacts Google's public STUN servers (stun.l.google.com) to discover how to connect. We do not operate a relay (TURN) server, so call media is never routed through a third party.

How your information is shared

• With other users — your username, display name, status line, country/region, and online status are visible to other users. Your email address may be returned when another signed-in user searches for you.
• Email delivery — we use Resend to send account emails; it receives the recipient email address and message content.
• Hosting & database — your data is stored with our database/hosting provider under their security controls.
• Connectivity— Google's public STUN service, as described above.
• Legal — where required by law or to protect the Service and its users.

We do not sell your personal data.

Retention and deleting your data

We keep your account information and content for as long as your account is active. To request access to, correction of, or deletion of your data, email us at [CONTACT EMAIL] and we will act on your request within a reasonable time. (A self-service account-deletion option is planned; until then, requests are handled by email.)

Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal data, and to object to or restrict certain processing. To exercise any of these, contact [CONTACT EMAIL]. You may also update your profile in the app's settings at any time.

Children

The Service is not intended for anyone under 13 years old, and you must be at least 13 to use it. We do not knowingly collect personal data from children under 13. If you believe a child has provided us personal data, contact [CONTACT EMAIL] and we will delete it.

Security

We protect your data with measures including TLS encryption in transit and salted scrypt password hashing. No online service can be completely secure, but we work to protect your information and limit access to it.

International users

Waayou is available globally. Your information may be processed and stored in countries other than your own, which may have different data-protection laws. By using the Service you consent to this transfer and processing.

Changes to this Policy

We may update this Policy from time to time. When we do, we will change the "Last updated" date above and, for material changes, take reasonable steps to notify you.

Contact us

Questions about this Policy or your data? Email [CONTACT EMAIL]. See also our Terms of Service.