Privacy policy

1. Operator and contact

ProxyChat is operated by Jung Hakyoung. Contact fsseer@gmail.com for service questions, access, correction, erasure, processing restriction or withdrawal. Proportionate ownership checks are explained where needed. Do not send unsolicited passwords or identity documents.

2. Information and purposes

We process account/basic-service information, user content and selected features for these purposes. Account-linked expression numbers are treated as personal information.

Reports are reviewed according to severity and urgency. Reports of serious harm, including child sexual exploitation, are prioritized. When a violation is confirmed, necessary action is taken promptly, including content removal, access blocking and restrictions on use. Confirmed child sexual abuse material is reported to the relevant authorities in accordance with applicable law.

3. Camera and optional storage

Camera frames are analyzed inside the browser, without original-frame upload or recording by the app. Expression numbers are temporarily transmitted for Proxies/feed reactions. Explicitly attached photos are stored separately.

A representative Proxy is one displayed state explicitly captured and saved by the user, managed separately from eye calibration, feed recording and recent reaction audience.

Preparing expressions downloads the MediaPipe SDK 0.10.35 WASM runtime from jsDelivr and the fixed version 1 model from Google. These public-file requests send IP and HTTP request information to the providers and can include the service domain as Origin. The app omits login credentials and does not send the page path as Referer for these downloads. Original camera frames, expression numbers and chat content are not sent to these file providers; face inference runs on the device. If a provider path fails, the same files are available at the service origin. Section 7 describes the external processing scope.

Completed eye measurements are saved to the account after starting calibration; Reset deletes calibration. Turning camera expression tracking on enables new feed reactions; turning it off stops feed expression measurement and automatic reactions on this device. Existing records and their audience remain unchanged. Public, friends or private recent reaction visibility is selected separately on the profile. Camera permission and feature controls do not replace each other.

The former scene-summary comparison and matching feature is retired. Existing historical data has not been bulk deleted or restored; existing deletion, account erasure and restore protection remain.

Only the post's author can see the current reacting accounts' public names and proxies by expression, including existing saved reactions. Other visitors cannot access the list.

Friend recommendations narrow candidates using laughter and big-laughter results already saved by automatic feed expression reactions, in order of eligibility/blocks, country-level region, self-reported age band and shared laughter. Reaction visibility, blocks and deletion are respected: private/friends-only posts and deleted reactions do not provide shared-laughter evidence, and unanswered posts are not dislikes. Without usable saved reactions, exploration suggestions can use country and self-reported age band. Separate comparison measurement/summary recommendations remain disabled. Videos, expression intensity, estimated age and inferred gender are not recommendation inputs. Recommendation scores/exposure history are not stored separately.

Friend recommendations in Settings starts on. Turning it off stops recommendations to you and excludes you from other people’s suggestions. It also removes recommendation country from active storage; original feed reactions and feed-recording settings remain. Reading the default creates no setting or consent record. An explicit change stores only on/off, change time and revision; an existing explicit off value is not turned on by an upgrade. The default and existing consent for other purposes are not created or reused as a new affirmative consent record.

Recommendation region uses only a country code supplied by a proxy already configured as trusted; missing means unknown. Precise location is not obtained and IP is not sent to an external location service. Thirty days is recommendation-use validity, not an automatic deletion schedule. A stale code is treated as unknown but may remain stored until friend recommendations are turned off or the account is deleted. Earlier backups follow existing retention. Account deletion removes this information with account data; existing account-deletion reapplication procedures apply to restores. Age uses the existing self-reported band; unknown age is not replaced with an estimate.

4. Retention and disposal

Accounts/profiles/social information remain during service use; posts/photos/comments until item/account deletion. Rooms retain up to their latest 500 messages. The latest 100 are shown initially, and earlier retained messages load in pages of 100 on request. Messages beyond 500 are removed oldest first from the current store; hiding is not erasure. Eye calibration remains until reset or account deletion; feed reactions remain until cancellation, account deletion or other applicable deletion. Sessions expire after 30 days; relevant credentials are revoked on logout/password change/deletion.

Only the current representative proxy customization state is kept and is replaced by the next capture. Resetting the representative proxy or deleting the account removes it from the operational store; changes to other feature settings alone do not remove it. Account-deletion procedures and exceptions follow section 5 below; remaining backups follow the existing retention rules in this section.

Online status is off by default. Only when enabled in settings do we share foreground status with mutual friends, based on screen visibility, focus and a valid connection. Only the latest foreground signal per connection is stored; it becomes invalid after at most 45 seconds. We hide this indicator in the background, on disconnect, when disabled, and after friendship ends, blocking or account deletion. Last-seen times are not shared. Any valid foreground device may qualify; this does not prove human activity or immediate availability. Connection state required for room participation and duplicate-alert prevention is handled separately. The sharing preference is stored with the account and removed on account deletion.

To prevent duplicate alerts and keep connection and conversation state consistent, we store and update the latest state for each connection in the server SQL database, including account/session references, an app-generated random device ID, foreground status, the current conversation, and whether the requests screen is active. State remains valid for up to 45 seconds after the last update; this is not an automatic deletion deadline for all information. We attempt to delete this connection state when the connection closes and clean up expired state when processing new state. Abnormal shutdowns or storage errors can delay actual cleanup. The random device ID remains in this browser’s localStorage and is not erased merely by turning notifications off. Push subscriptions store the device/account/session link and subscription address/keys on the server. Related server subscription links are cleared on unsubscribe, notifications-off, revocation of the linked session or account deletion.

The existing maximum retention for diagnostic logs and recovery data backups is 30 days each. The operator reviews the inventory, access, recovery needs and preservation exceptions before disposing of expired copies. This does not mean that every file expires automatically. Report evidence, safety handling and access/action records, and support tickets/replies/edit history are separate from ordinary diagnostic logs and are not all deleted under this rule. Certificates, app keys and operating settings are also separate from data backups and remain protected while needed.

An actual statutory retention obligation or lawful preservation order retains only necessary information separately with restricted access for its required period. Its basis/items/period are explained. No blanket extra long statutory period is assigned to all information.

A separate restore-protection ledger keeps HMAC targets, scopes, events, times and sequence without content/photos/raw expressions. Completed confirmation receipts last 24 hours. Ledger/verification keys do not expire before all restorable copies containing erased information are verified absent; the ordinary 30-day backup limit does not directly apply.

Report evidence and linked handling/access history, and ticket contents/replies/edit history with linked handling/access history, are retained for one calendar year from the case’s final closure. Information linked to open or reopened cases is retained until final closure, after which the same period applies. Independent operator access/action records without a case link are retained for one calendar year from their recording date. This criterion was announced on October 11, 2026 and takes effect on October 18, 2026. Applicable legal preservation duties or lawful orders are handled separately with restricted information scope and a disclosed basis and period, as described above. Content and account-link minimization follows the existing account-deletion cleanup process without waiting for these retention periods.

Closing a report or support ticket does not delete it. The current timestamps 30 days after report closure and 90 days after an operator action schedule a review of preservation needs; they are not automatic disposal dates or maximum retention periods. Automatic expiry and scheduled disposal of report/support information are not enabled. After the criterion takes effect, the operator must review closure, preservation exceptions and the exact inventory before disposing of expired information. Information is not described as deleted before actual disposal. Access, correction, deletion and other rights requests can be sent to the contact address above.

5. Deletion and remaining copies

After reauthentication and final confirmation, deletion immediately stops account access and all sessions and starts erasing the account and related personal information. Operational account, sign-in, profile, representative proxy customization, own conversation/content/media, comments, reactions, stored expression values, social and notification links are removed. Deleted accounts and content cannot be restored. There is no seven-day recovery or 30-day account-retention service.

If cleanup partly fails, account access stays stopped and deletion is retried. Completion is reported only after account/data and attachment cleanup finishes. Independent records belonging to other users and copies already downloaded are outside this deletion.

Minimum purchase/refund evidence is kept separately from ordinary account data for five years from the relevant contract, payment, supply, purchase withdrawal or refund event or completion; transaction complaint/dispute records are kept for three years from final closure. Account withdrawal does not restart these periods. Applicable law and necessity are reviewed; this does not mean related personal information must always be retained after consent is withdrawn.

Records are limited to transaction identifiers, products, transaction times, amounts, currencies and states, plus minimum links needed to verify a purchase. Entire emails, profiles or conversations are not retained as transaction evidence or reused for marketing or analytics. Raw purchase tokens are used for purchase verification, unfinished purchase processing and checking refund status. Their necessary purpose and retention period are reviewed separately from ordinary order numbers. Refund-support lookup results do not display raw purchase tokens.

After account deletion, a refund can be requested by matching Google Play order history with the separate minimum purchase ledger. Knowledge of an order number or a matching ledger alone does not prove ownership: support checks evidence from the original purchasing account and current transaction/refund status. Eligibility depends on applicable law and payment policies. Account deletion does not broadly waive statutory refund rights. Contact: fsseer@gmail.com.

Disaster-recovery backups are not an account-recovery service. Existing backup copies follow the separate backup retention/cleanup policy and are not represented as immediately erased. Before restored data becomes available, current deletion records prevent deleted accounts and data from being reactivated. The restore-protection ledger retains minimum HMAC-protected targets/events/times/sequence, not message bodies, photos or purchase tokens.

6. Photos and visibility

Feed visibility can be public/friends/private; conversations are shown to participants. Links do not grant access. New photos are re-encoded without copying EXIF/GPS. Existing photos were not bulk-converted; visible faces/locations/text are not automatically removed. Chat photos are sent one at a time: device input up to20MiB, with up to50MP on supported preparation paths (24MP on the compatibility path), resized to at most1920px/1MiB with thumbnails up to384px/96KiB. HEIC/HEIF/AVIF require device conversion; GIF, SVG and video are unsupported. Original device files are not retained. Room membership, blocking, leave boundaries and the latest500-message window govern access. Files from deleted, evicted or incomplete uploads may remain in private quarantine, inaccessible through the app. No automatic permanent file deletion runs; the latest deletion guard applies before restore. Quarantined files count toward the4GiB chat-photo budget and2GiB disk reserve. When full, new uploads are refused while existing data is kept.

7. External connections and international processing

External policies also govern connection information these providers process. US headquarters does not establish a fixed US processing location. Countries/periods vary by service/route; unverified details are not represented as domestic-only processing or fixed retention.

8. Rights and protection

Use relevant settings or fsseer@gmail.com for access/correction/erasure/restriction/withdrawal. Statutory user/representative rights remain. Statutory exceptions are explained with objection routes. Exercising rights alone does not restrict basic chat.

Password hashes, restricted access, encrypted connections, account checks and a separate deletion ledger provide protection without guaranteeing every incident is prevented. Confirmed unauthorized access/disclosure is handled with legally required measures/notices. Under-14 signup is prohibited; age/guardian checks are self-attestations, not document verification.

9. Changes

Ordinary policy/terms changes are announced at least 7 days before effect; important/adverse changes at least 30 days. Separate consent is requested where needed. Urgent security/legal measures are explained as soon as practicable. Not reading a notice is not new consent.

Email verification and account recovery notice (October 21, 2026)

Email addresses entered at signup or in settings, and their verification status, support account verification, email changes and password changes or resets. An email-shaped login ID and a recovery email are separate. Entering an address alone does not verify ownership or merge accounts or purchases.

User-requested verification messages are delivered through NAVER Cloud SENS MAIL as an email processing provider. We transmit the recipient address, sender address and name, subject, body and one-time code; the message also reaches the recipient mailbox provider. Passwords, conversations, photos and purchase ledgers are not included in the message body. An overseas mailbox provider may process the message under its own policies.

Codes are valid for ten minutes. The app stores a verification hash, expiry and use status instead of the raw code. Addresses and verification status remain subject to account change and deletion policies. Expired code records become eligible for bounded cleanup on later requests after one further day, so expiry is not immediate deletion. NAVER Cloud delivery history is retained for up to two months. Mailbox retention is separate.

This feature does not send marketing or bulk messages to all users. A delivery interruption preserves existing login and email verification safeguards; it does not enable password changes without verification. Contact the operator above for access, correction, deletion or processing inquiries.

Apple App Store purchase information

Apple processes product and payment information through the App Store. The app and server use account-linked purchase identifiers, product and transaction identifiers, and purchase and refund states to verify purchases, grant items and process unfinished transactions. RevenueCat is also used for purchase processing and status verification. Apple and RevenueCat handle external processing and retention under their respective policies and settings.

Apple refund request guidance

Sign in with Apple privacy information

If you choose Sign in with Apple, Apple handles authentication and provides the service with an Apple-specific identifier. The service stores that identifier and link time and encrypts a refresh token for sign-in linkage, revocation and account deletion processing. A name first supplied by Apple may be used as your initial display name. Accounts are not automatically linked merely because their email addresses match. Apple processing and retention follow Apple policies.

Sign in with Apple and privacy

External services and official references

• jsDelivr privacy
• Korean PIPA
• Cloudflare privacy
• Cloudflare analytics collection
• Cloudflare Web Analytics retention FAQ
• Cloudflare analytics dimensions
• Google privacy
• Google sign-in verification
• Mozilla privacy
• Apple privacy