Your Privacy is Our Default

The Short Version

This policy covers the FunChat web application available at funchat.in. It applies to all users worldwide.

What We Collect

You never need to create an account or give us your real identity to use global chat, random chat, or video chat. Here is exactly what we collect, and why:

• Display name: You choose any username you like — it doesn't have to be your real name.
• Chat messages: Relayed in real time between users. Global chat messages are deleted 15 minutes after they are sent and chat-room messages after 10 minutes; random chat is not stored. We do not read, analyse or sell your messages; a small number may be retained longer only if reported for moderation/safety review (see "How Long We Keep Data").
• Images and GIFs: Media you share in chat follows the same short retention window as messages, unless it's part of a safety report under review.
• Flagged-image choices: When the image screening flags an image in random chat, we record that a sender chose to send it and that a receiver accepted or declined it, together with the username, IP address and time. We do not record or keep the image content for this purpose.
• IP address: Stored to enforce bans, block abuse/bot traffic, and detect VPN/proxy misuse. Not used for advertising or sold to third parties.
• Device ID cookie: A random, non-identifying ID (not a browser fingerprint) stored in a cookie so we can recognize the same browser across visits — used to prevent ban evasion, protect a username you've been actively using from being taken over, and let VIP status follow you if you change your display name. It contains no personal information.
• Session token: A randomly generated token in your browser's localStorage to keep you signed into features like VIP status across visits. Expires after 30 days of inactivity. Contains no personal information.
• Email address (VIP purchases only): If you buy VIP/premium, we collect the email you provide to send your activation confirmation and let you recover access. Not collected for regular free chat.
• Payment/donation reference: If you buy VIP, we store the transaction reference (UTR) and amount you report, and optionally a payment screenshot, to verify and process your purchase. We never see or store your card, UPI PIN, or bank login — that stays entirely with your payment app.

What We Never Collect

• Your real name or phone number, for regular chat use
• Your location or GPS data
• A browser/canvas fingerprint built from your device's hardware or rendering characteristics
• Your browsing history or activity outside FunChat
• Your payment card, UPI PIN or bank login — that never reaches our servers

Note: Google's own advertising and analytics cookies (see "Third-Party Services" below) are set directly by Google when you use the site, under Google's own privacy practices — not something we control at the data-collection level, but something you can opt out of.

Cookies and Local Storage

FunChat does not use advertising cookies, tracking cookies or third-party analytics cookies of any kind.

We use browser localStorage solely to store your temporary session token and UI preferences (such as your selected chat mode). This data never leaves your device and is never sent to third parties.

No cookie consent banner is required because we don't set any tracking cookies — ever.

Third-Party Services

FunChat uses a small number of third-party services to deliver the product and keep it free. Here is what each one does and what, if anything, they may collect:

• Google AdSense: Serves the ads that keep FunChat free to use. Google may use cookies to personalize ads based on your activity across sites. You can opt out of personalized ads via Google's Ads Settings.
• Google Analytics / Tag Manager: Used to understand aggregate site usage (e.g. which pages are visited, roughly how many people use the site) so we can improve it. This does not involve reading your chat content.
• Cloudflare: Our CDN/security provider — sits in front of the site for every request, providing DDoS protection, bot filtering, and (for voice/video features) call routing. Cloudflare processes connection metadata as part of standard CDN operation.
• Google Fonts: Used to load the DM Sans and DM Mono typefaces. Google may log font request metadata (IP address, browser). You can review Google's privacy policy at google.com/fonts/privacy.
• Giphy: Used to power the GIF search feature. If you search for or send a GIF, your search query is sent to Giphy's API. Giphy's privacy policy applies to that interaction.
• QR Server (api.qrserver.com): Used to generate UPI QR codes for optional VIP purchases. No personal data is transmitted.
• AI providers (for moderation and the in-chat AI companion): Message content may be sent to a third-party AI model provider to check for policy violations (harassment, threats, CSAM, self-disclosed age) when a message is reported, and to power the optional AI companion feature. These providers process the text to return a response and do not use it to build an advertising profile of you.

Some of the above (AdSense, Analytics, Cloudflare) may involve processing outside India as part of how these global services operate — see "Cross-Border Data" below.

How Long We Keep Data

• Global chat messages: Permanently deleted 15 minutes after they are sent (including text, images and voice notes).
• Chat room messages: Permanently deleted 10 minutes after they are sent (text, images, GIFs, voice notes, polls).
• Random chat: Messages are relayed live and not stored; images and voice notes sent in random chat are deleted from our servers within a few hours.
• Uploaded images and media: Follow the windows above, unless attached to an active safety report.
• Reported content (under moderation review): Retained for as long as needed to investigate the report and enforce any resulting ban, then deleted.
• Session/device tokens: Expire after 30 days of inactivity.
• Flagged-image consent records (username, IP, time, choice): Kept for at least 180 days, and longer where needed to answer a legal request or complaint.
• Ban and security records (username, IP, reason, duration): A permanent history of every ban issued is kept in a secure internal log, independent of whether the ban itself later expires, to prevent evasion and to comply with Indian legal requirements (including CERT-In's directions under the Information Technology Act, 2000 requiring intermediaries to preserve such records for at least 180 days). Permanent-ban and CSAM/underage-safety records are retained indefinitely for platform safety and any applicable legal reporting obligation.
• Account deletion records: If a registered account is deleted, a minimal internal snapshot (account details, associated IP/device history) is retained for at least 180 days after deletion, as required under the IT (Intermediary Guidelines) Rules, 2021, to support fraud prevention and legal compliance.
• VIP/donation records: Retained for as long as needed for accounting, fraud prevention, and to honor your purchase, and as required by applicable tax/financial record-keeping law.
• Server/connection logs (IP address, timestamps): Retained for at least 180 days as required under CERT-In's directions for all intermediaries operating in India.

Cross-Border Data Transfer

FunChat's infrastructure uses global service providers (including Cloudflare for security/CDN, and third-party AI providers for moderation) whose servers may be located outside India. Where this happens, we rely on those providers' own security and privacy safeguards. We do not sell your data to any third party, in India or abroad.

Child Safety and CSAM Reporting

FunChat has a zero-tolerance policy for child sexual abuse material (CSAM) and any content that exploits, sexualizes, or endangers minors. Our platform is intended for users aged 18 and over only, and this is enforced through age confirmation at signup, automated AI moderation of reported content, and account/IP bans.

Under Indian law (the POCSO Act, 2012 and the Information Technology Act, 2000), any person who becomes aware of an offence against a child is legally required to report it — and this obligation applies to us as a platform. When CSAM or child endangerment is detected or reported on FunChat, we:

• Immediately and permanently ban the account and its associated IP address;
• Preserve the relevant evidence for law enforcement; and
• Report the matter to India's National Cyber Crime Reporting Portal (cybercrime.gov.in) and/or the jurisdictionally appropriate Special Juvenile Police Unit or local police, as required under the POCSO Act — this is our primary reporting channel as an India-based platform. Where relevant, we may additionally report to the National Center for Missing & Exploited Children (NCMEC) in the US as a supplementary international channel, but this does not replace our reporting obligation to Indian authorities.

Anyone who self-discloses that they are under 18 while using FunChat will also have their account and IP permanently banned, since the platform is not intended or permitted for minors.

If you encounter any content that exploits or endangers a child, please report it immediately using the in-app report button, or contact us at contact@funchat.in. You can also report directly to cybercrime.gov.in or your nearest police station at any time — you do not need to wait for us.

AI Moderation

FunChat uses automated AI moderation to detect and act on abusive, harmful or rule-violating content when a message is reported. This scanning is automated — no human routinely reads your conversations; a human reviews a case only where a report requires it.

Some content, including AI-generated content (e.g. AI-assisted image generation or the AI companion feature), is subject to the same moderation and Indian IT Rules due-diligence obligations as user-posted content.

Users who violate the rules are banned by username and IP address, for durations matching the severity of the violation (from a few minutes for minor issues, up to permanent for severe violations like CSAM, self-disclosed underage use, or serious threats of violence). IP-based enforcement exists specifically so that banning is not trivially bypassed by simply choosing a new username.

Your Rights

Under India's Digital Personal Data Protection Act, 2023 and general privacy principles, you have rights over the personal data we do hold about you (primarily: your VIP purchase email, if any, and security/ban records). You can:

• Access: Ask us what data we hold linked to a username, email, or IP you control.
• Correct: Ask us to correct inaccurate data (e.g. a billing email typo on a VIP purchase).
• Erase: Ask us to delete data we hold about you, subject to our right/obligation to retain safety records (bans, reports, CSAM/underage-safety records) as needed for platform safety and legal compliance — we cannot delete a ban record simply because the banned account requests it.
• Withdraw consent for optional data uses (like personalized ads) at any time via Google's Ads Settings.
• Grievance redressal: Raise a complaint with our Grievance Officer (see below) if you're unsatisfied with how a privacy request was handled.

Simpler things you can always do without asking us:

• Clear your session/device cookie at any time via your browser settings — this resets your device ID.
• Chat history clears automatically — global chat after 15 minutes, chat rooms after 10 minutes.
• Stop using FunChat at any time — no formal account deletion process needed for casual (non-VIP) use, since no account was created in the first place.

To exercise any of the rights above, contact us at contact@funchat.in. We will respond within a reasonable time and in line with applicable law.

Grievance Officer

In accordance with the Information Technology Act, 2000 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (as amended), the contact details of our Grievance Officer are:

Grievance Officer: [Name to be filled in by site operator]
Email: contact@funchat.in
Address: [Registered address to be filled in by site operator]
Response time: Complaints are acknowledged within 24 hours and, where possible, resolved within 15 days, as required under the IT Rules.

Personal Information and Images You Choose to Share

FunChat is anonymous, and you decide what to say and send. Please do not share personal information (real name, phone number, address, school/workplace, social media handles, ID or financial details) or personal, private or intimate photos with other users.

Anything you send can be seen by the person you are chatting with, and that person (or anyone they show it to) can screenshot, save, forward, publish or misuse it — we have no technical ability to stop that. Deleting a message or image (a feature we provide) removes it from the chat, but it cannot erase copies someone has already saved or screenshotted.

If personal information or images you choose to share are leaked, saved, re-shared or misused by another user or any third party, FunChat is not responsible or liable for it. That risk is yours. If someone misuses what you shared, report them in the app and, where appropriate, to the police or the National Cyber Crime Reporting Portal (cybercrime.gov.in).

To help keep the platform safe, images you send or receive in random chat are screened by a model that runs inside your own browser; the image is not uploaded to us for that check. FunChat blocks NSFW images. Sexually explicit or nude images, and anything involving minors, are not allowed on FunChat at any cost, and any image our AI flags as possibly NSFW is blocked and not delivered. Our AI is super strict, so it can also block normal, harmless images — we would rather block a harmless image than let a prohibited one through. We operate in line with Indian law, including the Information Technology Act, 2000, the IT Intermediary Rules, 2021 and the POCSO Act, 2012, and we cooperate with Indian authorities. Users who send prohibited content can be banned permanently and reported to the authorities. This automated check is imperfect, and it does not make FunChat responsible for content sent by users or for what a user chooses to view.

Security

FunChat serves all content over HTTPS. Real-time chat uses encrypted WebSocket connections. We take reasonable technical measures to protect the platform against unauthorised access.

Because we don't store personal data, a data breach at FunChat would not expose your identity, email address, password or payment information.

Changes to This Policy

If we make any material changes to this privacy policy, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically. Continued use of FunChat after changes are posted constitutes acceptance of the updated policy.

Privacy Questions

If you have any questions about this privacy policy or how FunChat handles data, please reach out: