Privacy Notice

Last updated: 29 August 2026

This notice describes exactly what data PrivChat stores, transmits, and shares — based on a direct review of the application's source code. If anything listed here seems unclear, you can verify it yourself: the code is open-source at github.com/arko252007-dot/PrivateChat.

1. What Is Stored on Your Device

PrivChat stores exactly two items in your browser's localStorage:

Key	Purpose	Values
theme	Remembers your dark/light mode preference	"dark" or "light"
privchat_tutorial_seen	Remembers that you dismissed the "Getting Started" tutorial	"true"

No sessionStorage is used. No cookies are set. No chat messages, room IDs, passwords, or user names are ever written to persistent storage. Messages exist only in the browser's DOM while the tab is open and are discarded when you leave the chat or close the tab.

2. How Connections Work

PrivChat uses PeerJS (v1.5.4) to establish WebRTC peer-to-peer connections. The process involves two third-party services:

PeerJS Cloud Signalling Server

• Host: 0.peerjs.com (operated by the PeerJS project)
• What it sees: Peer IDs (which include the room ID for the host, e.g. privchat-HOST-yourroom) and IP addresses of both parties during the signalling handshake.
• What it does not see: Message content, room passwords, or user names. These are sent over the WebRTC DataChannel after signalling completes.
• Privacy policy: PeerJS is an open-source project. The free cloud server does not publish a separate privacy policy. See peerjs-server on GitHub.

Google STUN Server

• Host: stun:stun.l.google.com:19302 (operated by Google)
• What it sees: Your IP address, used for ICE candidate discovery (helping your browser determine how to reach the other peer).
• What it does not see: Any application data, messages, or identifiers.
• No TURN (relay) server is configured. If a direct peer-to-peer connection cannot be established (e.g., behind a symmetric NAT), the connection will fail.
• Privacy policy: Google Privacy Policy

3. Password Handling

Room passwords are transmitted over the DTLS-encrypted WebRTC DataChannel as a plaintext JSON payload. They are not independently encrypted or hashed beyond that transport-layer encryption. Do not reuse sensitive passwords for room access.

4. Encryption

All data transmitted between peers travels over WebRTC DataChannels, which are encrypted in transit using DTLS (Datagram Transport Layer Security). This is a transport-layer encryption provided automatically by the WebRTC protocol. There is no additional application-layer encryption — the app code does not perform its own key exchange, encryption, or decryption.

5. CDN Resources

The following external assets are loaded from Cloudflare's CDN (cdnjs.cloudflare.com):

• PeerJS client library (v1.5.4)
• Bootstrap Icons CSS (v1.11.3)

Standard CDN request logs (IP address, user agent, timestamp) may be collected by Cloudflare. See Cloudflare's Privacy Policy.

6. Hosting & Access Logs

PrivChat is hosted on Netlify as a static site. Netlify may collect standard HTTP access logs (IP addresses, request timestamps, user agents) as part of its infrastructure. These logs are outside the app's control and are governed by Netlify's Privacy Policy.

7. Analytics & Tracking

PrivChat does not include any analytics, tracking scripts, or telemetry. There is no Google Analytics, no Facebook Pixel, no Mixpanel, no Sentry, and no other third-party tracking code in the application.

A google-site-verification meta tag is present in the HTML for Google Search Console verification. This is a passive tag — it does not load any scripts or transmit any user data.

8. Questions or Concerns

If you have questions about this privacy notice or want to report a concern, please open an issue at:
github.com/arko252007-dot/PrivateChat/issues