Privacy policy
The short version: we store what's needed to run a private messenger for friends, delete messages after 30 days, never sell your data, show no ads, and use no analytics or tracking tools.
Who is responsible
Y2K Chat is run by Abhishek Rai, an individual based in India, who is responsible for your personal data. Contact: support@y2kchats.com. That address is also our grievance contact under India's Digital Personal Data Protection Act, 2023.
What we store
- Your sign-in: your Google account's email address and account id, or the email address you sign in with. It's used only to sign you in.
- Your profile: display name, buddy icon, friend code, personal message, away message, and the status you pick (online, away, invisible). Only people you are friends with, or share a circle with, can see it.
- Your connections: friends, buddy requests, blocks, circles and circle membership requests, and per-friend settings such as muting.
- Messages and voice messages you send, who they were sent to, and when. Also whether each voice message has been played.
- Presence: whether the app is open (shared live with your friends), and the time you were last active.
- Technical details: a push notification token for each device, which app you last used (Android or web), and when you agreed to these terms. We use them to deliver notifications, and the app type only as a total count.
- Reports you make or that are made about you, including a copy of the reported messages or voice messages.
Optional features (off unless you turn them on)
- Online when you're free (Android): your phone works out whether you're free (recently unlocked, Do Not Disturb off, and if you allow it, not in a busy calendar event). We receive only the result, "online" or "away", for up to 20 minutes at a time. Unlock times, your calendar and Do Not Disturb never leave your phone.
- Now listening (Android): while music plays, we receive the artist and title and show them to your friends. It uses Android's notification access only to see what's playing; we never read, store or send your notifications.
- Microphone: used only while you record a voice message or circle greeting.
What we don't do
- We don't sell or rent your data, and we don't show ads.
- We don't use analytics, tracking or advertising tools.
- We don't collect your location, contacts, photos or files.
- We don't log the content of messages or voice messages.
How long we keep it
- Messages and voice messages: deleted automatically 30 days after they are sent, or straight away if you unsend them (possible within 10 minutes).
- Your account: until you delete it. Deleting your account removes your profile, friends, requests, push tokens, messages and voice messages.
- Reports: the copy of reported content is kept until a moderator handles the report, and deleted 30 days after it's closed. For reports about child safety, the copy is kept for 365 days after closing and only moderators can access it.
- Bans: if we ban an account, we keep a one-way, keyed hash of the sign-in identity so the same person can't sign up again. It cannot be turned back into your email or Google id.
- Copies may remain in our providers' backups for a short time before they are overwritten.
Who processes it for us
We use a few providers to run Y2K Chat. They process data only on our behalf, and their servers may be outside India.
- Supabase: database, sign-in, file storage for voice messages, and live presence.
- Google: Google sign-in, and Firebase Cloud Messaging for Android notifications.
- Browser push services (Apple, Google, Mozilla) for web notifications. These carry only ids, encrypted; notification text is generic.
- Cloudflare: hosting this website and the web app.
- GoDaddy: our support email.
We may disclose information if the law requires it, to protect people from harm, or to report child sexual exploitation to NCMEC and the authorities.
Security
Data is encrypted in transit (HTTPS) and stored by our providers with encryption at rest. Access is limited by strict database rules: people can read only conversations they belong to. Y2K Chat is not end-to-end encrypted. Moderators can see content that is reported to them.
Your rights
You can see and change your profile in the app, and delete your account at any time (Settings → Delete account, or see account deletion). You can also ask us for a copy of your data, to correct it, or to delete it, and you can withdraw consent for optional features at any time by turning them off. Depending on where you live (for example under India's DPDP Act, or the GDPR in the EU and UK), you may have further rights, including complaining to a data protection authority. Write to support@y2kchats.com. We reply within 30 days.
Children
Y2K Chat is only for people aged 18 and over. If we learn an account belongs to someone younger, we delete it.
Changes
If we change this policy in an important way, we'll tell you in the app first.