Privacy Policy

VayChat · Last updated: 14 July 2026

This policy explains what personal data VayChat (“we”, “us”) processes when you use the VayChat app, why, and what rights you have. We keep it short and honest: VayChat shows no ads, contains no analytics or tracking SDKs, and never sells your data.

Responsible for data processing (controller): the operator of VayChat. Contact: support@vay-chat.com.

1. Data we process

• Account data — your email address, chosen @username, display name, optional profile photo and bio, app language, and the date you accepted the Terms.
• Content — the messages you send and receive, including photos and voice messages, plus channel names and descriptions you create.
• Usage signals needed for chat features — your “online / last seen” timestamp, read receipts, and transient typing/recording indicators.
• Safety data — your block list and any reports you submit (a report stores the reason and a snapshot of the reported content so it can be reviewed even if the original is deleted).
• Notifications — when push notifications are enabled, a device push token so your device can receive them.

We do not collect your location, your address book, or advertising identifiers.

2. Why we process it (legal bases under the GDPR)

• To provide the Service — delivering messages, showing profiles, sending sign-in codes by email (performance of a contract, Art. 6(1)(b) GDPR).
• Safety and moderation — reviewing reports, enforcing the Terms, preventing abuse (legitimate interests, Art. 6(1)(f) GDPR, and legal obligations where applicable).

3. Message privacy — an honest note

Messages are encrypted in transit and stored on protected infrastructure, but they are not end-to-end encrypted. Content that is reported can be reviewed by moderation. Please don’t use VayChat for secrets that require end-to-end encryption.

4. Where your data lives and who helps us run the Service

Your data is stored with Supabase (database, sign-in, and file storage) on servers in London, United Kingdom (AWS region eu-west-2). The UK is covered by an EU adequacy decision, so this storage satisfies EU data-transfer rules. We also use:

• Resend — delivers the sign-in code emails;
• Cloudflare — our domain, DNS, and the hosting of these pages;
• Expo — delivers push notifications, when enabled.

These providers process data only as needed to run the Service. We share nothing with advertisers or data brokers.

5. How long we keep data

• Account data and content are kept while your account exists.
• Messages you delete are hidden immediately and permanently purged from storage within about 30 days.
• If you delete your account (Profile → Delete account), your account, profile, and sign-in data are deleted. Your direct-message conversations may become unavailable for both participants; your channel messages are detached from your identity and show as coming from a deleted account.
• Reports may be kept after the reported account is deleted, in a form no longer attributable to it, to keep moderation history intact.

6. Your rights

Under the GDPR you can ask us at any time for: access to your data, a copy (portability), correction, deletion, restriction of processing, or object to processing based on legitimate interests. Email support@vay-chat.com and we will respond. You also have the right to complain to a data-protection supervisory authority — for example, the authority of the German federal state where you live.

7. Children

VayChat is not directed at children under 13, and you must be at least 13 to use it. Where the law of your country sets a higher age for consenting to data processing, that higher age applies (in Germany: 16, or use with a parent’s or guardian’s consent).

8. Changes

If we change this policy in a meaningful way, we will announce it in the app and update the date at the top of this page.

9. Contact

support@vay-chat.com