Privacy policy
the short version
- We collect what Boredchat needs to work: your profile, likes, matches, chats, games and purchases.
- Your data is stored in the EU. We don't sell it and we don't show ads.
- Moderators never read your private chats. They only see the item someone reports.
- Usage stats and crash reports stay off unless you turn them on.
- You can download your data and delete your account in the app at any time.
1. Who we are
Boredchat is a chat app for strangers aged 18 and over, on iPhone and Android. This policy explains how we handle personal data in the app and on this website.
The controller responsible for your data is:
Merieu Private Limited
C-20, G Block, Bandra Kurla Complex, Mumbai 400 051, India
Privacy questions: [email protected]
"We" and "us" in this policy mean that controller.
2. What we collect
When you sign up
- Birth date. We use it to check you are 18 or over and to show your age. We show your age, never your birth date.
- Sign-in data from Google or Apple. Your email address and the account ID that Google or Apple gives us. We never see your Google or Apple password. If you use Apple's "Hide my email", we get the relay address Apple makes for you.
- Your profile. First name, gender, country and bio. Other people see these on your card.
- Profile photos, if you add them. Only your matches can see them.
- Your consent choices for usage stats and crash reports, and when you made them.
When you use Boredchat
- Likes, passes and stars you give and get, including the short message that comes with a star.
- Matches and when they started or ended.
- Chats: messages, photos, videos, voice notes and GIFs you send, with their labels (Camera clicked, One-time view, GIF) and when they were sent, delivered and opened.
- Games: the moves you make, scores and how many free turns a match has used.
- Calls: who called whom, when and for how long. Never the audio.
- Filters and settings, like the gender, age and country filters, mute settings and theme.
- Activity times, like when you last opened the app. We use this to delete accounts that are not used for 2 years.
Safety
- Reports you make or that are made about you: the reason, any note, and a copy of only the reported item (a profile, a message, a photo, a voice note or a call).
- Blocks you make.
- Moderation records: warnings, suspensions and bans, with the reason and date.
- Ban list: if an account is banned, we keep its Google or Apple account ID and email address so the same person can't sign up again.
Purchases
- Purchase records from Apple or Google: which plan or star pack you bought, transaction IDs, dates, renewal status, expiry, refunds and cancellations. Apple and Google handle the payment itself. We never see your card or bank details.
Your device
- Push token, if you allow notifications, so we can tell you about new matches, messages, your turn in a game and incoming calls. Notifications show the sender's first name and the kind of message, never the message text.
- Technical data your phone sends when it talks to our server, like your IP address, app version and operating system. Our server uses it to deliver the service and to keep it secure.
Optional: usage stats and crash reports
Both are off by default. If you turn them on in Privacy and data (or during sign up), the app sends:
- Usage stats (PostHog): which screens you open and which features you use, linked to a pseudonymous ID, never your name, bio or chats.
- Crash reports (Sentry): what went wrong, the app version and your device model.
You can turn either off at any time in Profile, Settings, Privacy and data.
Things you choose to share
Your bio and your chats can contain anything you write. If you share sensitive things, like your health, beliefs or sexuality, you choose to make them visible to the people who see your bio or your chat. We don't use them for anything else.
3. Why we use it and our legal bases
Under the GDPR we need a legal basis for each use of your data. Here are ours.
| What we do | Legal basis |
|---|---|
| Create your account, show your card, match you, deliver chats, media, games, calls and notifications | Performing our contract with you (Art. 6(1)(b)) |
| Check you are 18 or over | Our legitimate interest in keeping minors out, and legal duties to protect children (Art. 6(1)(f) and 6(1)(c)) |
| Reports, blocks, moderation, the ban list and preventing abuse | Our legitimate interest, and yours, in a safe service (Art. 6(1)(f)); legal duties where the law requires it (Art. 6(1)(c)) |
| Premium, stars, renewals and refunds | Performing our contract with you (Art. 6(1)(b)) |
| Keeping purchase records for tax and accounting | Legal obligation (Art. 6(1)(c)) |
| Security, fixing errors on our server, keeping the service running | Our legitimate interest in a working, secure service (Art. 6(1)(f)) |
| Usage stats and crash reports from the app | Your consent, which you can withdraw at any time (Art. 6(1)(a)) |
| Push notifications | Performing our contract, and your permission on your phone |
| Answering your emails and requests | Performing our contract, or our legitimate interest in helping you |
Where we rely on legitimate interest, we have weighed it against your rights. You can object, see your rights.
We don't make decisions about you based only on automated processing that have legal or similarly significant effects. People review reports and decide on warnings, suspensions and bans.
4. The nude filter runs on your phone
Boredchat has a nude filter that checks photos and videos you receive. It runs entirely on your phone. Nothing is sent to us or anyone else for this check, and we never learn the result. If the filter flags something, it shows a cover with Tap to see, and you decide whether to look.
5. One-time view and other media
- One-time view photos and videos open once. The app blocks screenshots and screen recording while they are open. After they are opened, the file is deleted from our storage, usually within minutes.
- Normal photos, videos and voice notes stay in the chat until either of you unmatches or deletes your account. The person you send them to can save normal photos and videos to their phone. Once saved, they are outside our control.
- Camera clicked means the photo or video was taken with the camera inside the app.
6. Voice calls
Voice calls are only possible between matches. Calls go directly between the two phones (peer to peer) where possible. When a direct connection isn't possible, the call is relayed by our own relay server in the EU. Calls are encrypted in transit and never recorded. We keep only the call record: who called whom, when and for how long.
7. Where your data lives
- App data (accounts, profiles, likes, matches, chats, games, reports) is stored on our own server in the EU, run by us.
- Media (photos, videos, voice notes) is stored in Cloudflare R2 with EU jurisdiction, which keeps the files inside the EU.
- Call relay runs on our own server in the EU.
8. Who we share it with
We share data only with the services we need to run Boredchat. Each one gets only what its job needs.
| Who | What for | What they get |
|---|---|---|
| Cloudflare | Storing media in an EU-jurisdiction bucket | Your photos, videos and voice notes, stored encrypted at rest |
| Sign in with Google; Google Play billing on Android | That you use Boredchat to sign in; your Google Play purchases | |
| Apple | Sign in with Apple; App Store billing on iPhone | That you use Boredchat to sign in; your App Store purchases |
| Expo (push service) | Delivering notifications through Apple and Google | Your push token and the notification: sender's first name and the kind of message |
| Klipy | GIF search, in premium matches | Your search words, sent through our server so Klipy does not see who searched. The GIF images then load from Klipy's servers, so Klipy can see your phone's IP address when a GIF shows. |
| PostHog | Usage stats, only if you turn them on | Screens and features used, with a pseudonymous ID |
| Sentry | Crash reports, only if you turn them on | Error details, app version and device model |
Cloudflare, Expo, Klipy, PostHog and Sentry act as our processors under data processing terms. Google and Apple are independent controllers for sign-in and payments under their own privacy policies.
Other people on Boredchat see your card (first name, age, gender, country, bio). Only your matches see your photos, chats and games.
We may also share data when the law requires it, for example with the police or a court, or to report child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC) and the relevant authorities. See child safety.
9. Transfers outside the EU
We store your data in the EU. Some services we use are run by companies based in the United States or elsewhere:
- The Expo push service sends notifications from outside the EU, and Apple and Google deliver them through their own networks.
- Cloudflare, Klipy, PostHog and Sentry may access or handle limited data from outside the EU, for example for support or security.
Where data leaves the EU, we rely on the European Commission's standard contractual clauses, or on an adequacy decision such as the EU-US Data Privacy Framework where the company is certified. You can ask us for a copy of the safeguards.
10. How long we keep it
| Data | Kept until |
|---|---|
| Chats, photos, videos, voice notes and games | Either of you unmatches, or either of you deletes your account |
| One-time view photos and videos | Opened once, then deleted from storage |
| Your profile, likes, stars and matches | You delete your account |
| Accounts not used | Deleted after 2 years without use |
| Reports and the reported item | 1 year after the report |
| Ban list (Google or Apple account ID and email) | As long as the ban stands, so the same person can't sign up again |
| Purchase records | You delete your account, except where tax law makes us keep them longer. Apple and Google keep their own records. |
| Usage stats and crash reports | Up to 12 months, or until you ask us to delete them |
When you delete your account, see delete your account for exactly what goes and what stays.
11. What moderators can see
Our moderators and admins never read your private chats. When someone reports something, they see a copy of only that item: the profile, message, photo, video, voice note or call that was reported, with the reason. They use it to decide whether to warn, suspend or ban. Every admin action is logged.
12. Your rights
Under the GDPR you have these rights. Most you can use right in the app.
- Access and a copy. Download all your data as a file in Profile, Settings, Privacy and data, Download my data.
- Correction. Edit your profile in Profile, Edit profile. For anything you can't edit, email us.
- Deletion. Delete your account in Profile, Settings, Delete account. See delete your account.
- Portability. The download is a machine-readable file you can take elsewhere.
- Objection. Object to uses based on our legitimate interest.
- Restriction. Ask us to pause using your data while we check a complaint.
- Withdraw consent. Turn off usage stats or crash reports at any time. This doesn't affect what was collected before.
- Complain. You can complain to a data protection authority, in particular in the EU country where you live or work. Our lead authority is the data protection authority of the EU country where you live, because we have no establishment in the EU. We'd like the chance to fix things first, so do write to us.
To use any right by email, write to [email protected] from the email address on your account. We answer within one month. We may ask you to confirm it is you.
13. 18+ only
Boredchat is only for people aged 18 and over. We check your birth date at sign up and stop anyone under 18. If we learn that someone under 18 has an account, we delete it. If you think a user is under 18, report them in the app or email [email protected].
14. No ads, no sale of data
Boredchat has no ads. We don't sell your data, rent it or share it for advertising. We don't use your chats to profile you.
15. Security
Data travels encrypted between your phone and our servers. Media is fetched with short-lived links that our server gives only to the people in the chat. Admin access is limited by role and logged. No system is perfectly safe, so if we ever have a breach that puts you at risk, we will tell you and the authority as the law requires.
16. This website
This website sets no cookies, has no analytics and loads nothing from other sites. Fonts and images are served from this site. Our web server keeps short technical logs (IP address, page, time and browser) to keep the site secure, and deletes them within 14 days.
17. Changes to this policy
If we change this policy, we update the date at the top. If a change matters for how we use your data, we tell you in the app before it applies.
18. Contact
Privacy questions or requests: [email protected]
Everything else: [email protected]
Post: Merieu Private Limited, C-20, G Block, Bandra Kurla Complex, Mumbai 400 051, India