Anonymous Chat Privacy Policy

1. Purpose and scope of this policy

This Privacy Policy explains how we obtain your personal data when you use the Anonymous Chat website, applications and related support services; why we process it; whom we may share it with; how long we retain it; and your rights regarding your data. In this policy, these services are collectively the “Service,” the person operating the Service is “we” or “us,” and a person visiting or using the Service is “you.”

This policy applies to visitors, registered users, and people submitting support requests or safety reports, to the extent we process information about them. If you do not use a feature, we do not collect information specific to that feature from you merely because we process it for other users. Available features may vary by version and platform.

This policy provides a common explanation of our data processing in the countries where the Service is lawfully offered and in its published language versions. Additional rights and notices required by local law also apply to the people concerned. Our aim to offer the Service worldwide does not mean that identical legal requirements apply in every country.

This policy does not cover independent processing by third parties on their own websites or services. For example, an external sign-in provider, an application store, or a website you choose to visit through a link may have its own privacy terms. Our disclosures to those parties through Anonymous Chat are described here where relevant.

This policy is a privacy notice. Reading it, signing in to the Service, or accepting the Terms of Service does not constitute blanket consent to every processing activity that requires separate consent.

2. Who is responsible for your data?

Anonymous Chat is operated by Öcal Özyavuz, an individual based in Türkiye. This person is the data controller for the processing described in this policy where we determine its purposes and means. The name Anonymous Chat does not imply that a separate legal entity exists.

This email address is the common point of contact for users and competent authorities regarding privacy, safety and the Service. We accept communications in Turkish and English. Requests are not closed solely through an automated response and are directed to human review where needed.

3. Anonymity and the privacy of direct messages

Anonymous Chat lets you interact with other users through a username or pseudonym without publicly disclosing your real name. This does not mean that you are unidentifiable to the operator or that the Service keeps no technical records. Your account identifier, sign-in method, content and connection records may, in certain circumstances, be associated with you or your account.

Calling a message “private” does not mean that its technical design prevents the operator from accessing it in every circumstance. The Service does not promise that direct messages are end-to-end encrypted against access by the operator. Content may be processed on the server to the extent necessary for transmission, storage, reviewing user reports, investigating security incidents and complying with applicable legal obligations. Administrative access to content is limited by role and purpose.

An IP address alone does not conclusively establish a person's identity. Shared networks, mobile connections, intermediary services and the use of an account on multiple devices mean that technical records must be assessed in context. This policy does not guarantee that every event or person can be identified without error from technical records.

Information you send to another person may be saved or captured in a screenshot by that person. When sharing your real identity, contact details, sensitive documents or private information about others, consider that the recipient can view and retain it.

4. Categories of personal data we may process

We process the following categories depending on the features you use and the information you provide. Not every category necessarily exists for every user.

This table does not authorize unlimited data collection. Before introducing a new data category or a new use incompatible with the existing purpose, we provide the required information and complete any necessary consent process.

5. Where do we obtain data?

We obtain data directly from you when you create an account, complete a profile, send a message, share content or submit a support request. Technical records also arise from your device and connection while the Service operates. We may receive information through another user when they include you in a conversation or submit a report concerning you.

If you use an external sign-in option, the information involved comes from that sign-in provider. We may also receive information from competent authorities or an authorized representative through a valid legal process. An allegation received from a third party is not treated as true merely because it has been reported; we consider its source, nature and verifiability.

You must have the right to share information you submit about another person. Do not send identity documents, health records or private correspondence unrelated to your request. A safety report should contain the minimum information needed to understand the incident; we request additional information separately if necessary.

6. Processing purposes and legal bases

We process your personal data for specific, disclosed purposes. The applicable legal basis depends on your location, the nature of the processing and the relevant law. A legal basis for one activity does not authorize collecting unrelated data or retaining it indefinitely.

We do not maintain a general evidence archive of every user's deleted messages merely because a request might arrive in the future. Preserving records of particular incidents is limited to necessary records and the restrictions in section 10. An exception to erasure for legal claims is not, by itself, an independent basis for collecting or retaining all content.

A request from a foreign authority does not, by itself, create a valid disclosure or retention obligation in every country. We assess the authority behind the request, applicable law, procedure and international transfer requirements.

If you do not provide information necessary to perform the contract, the relevant feature may be unavailable. Not providing optional information is not used to prevent you from using unrelated core features. You may withdraw consent prospectively for processing based on it; withdrawal does not automatically affect the lawfulness of earlier processing.

7. Sensitive information and special categories of personal data

Submitted content may contain information about health, beliefs, political opinions, sex life or other sensitive matters. This explanation does not permit content prohibited by the Terms of Service. The presence of sensitive information in a message does not authorize us to use it for unrelated purposes or create a sensitive profile about you. We recommend that you do not share such information through the Service when doing so is unnecessary.

A legal basis for ordinary personal data may not be sufficient for special categories of data or information subject to additional rules, such as criminal allegations. We consider the additional conditions and safeguards applicable to the category concerned. Receiving a safety report is not a finding that the reported person committed an offence.

Where California law applies, the contents of private messages for which the business is not the intended recipient may also constitute sensitive personal information. Rights relating to that category do not depend solely on whether the content includes health or similar information.

8. Who may see or receive your data?

Other users: Relevant parts of your profile and public content are shown to other users according to the visibility of your sharing. Direct messages are delivered to the conversation's recipients. Posting content publicly and sending it privately do not have the same visibility consequences.

The operator and authorized reviewers: Access to information needed for support, safety and moderation is limited to what the role requires. Private correspondence may not be examined out of curiosity or for unrelated personal purposes. Assessing a report may require viewing limited conversation context associated with the reported message.

Our infrastructure and external services: The Service's main servers, databases, media storage and operator-managed backups are hosted on private servers managed by the operator in Türkiye. Our email server is also part of our own infrastructure; we do not purchase external email hosting or sending services. However, the provider used by the other party to an email and the networks carrying it may process information in their respective roles. Advertising, analytics, sign-in, application error reporting, reverse proxy and application store services involve processing separate from our own servers. Sections 13–14 explain the roles of Google AdMob, Google AdSense, Google Analytics/Google Analytics for Firebase and Apple App Analytics. These providers may receive necessary information directly from your device; not all information has to pass through our servers first. Google provides sign-in, advertising, analytics and Android store services; Apple provides the iOS store and platform analytics/error reports; and Cloudflare provides reverse proxy and security services. A provider may act as a processor when supplying a service under our instructions and as a separate controller when it determines its own account, store, security or advertising purposes. Its role depends on the particular service and processing activity.

Cloudflare connection and security services: Service traffic routed through Cloudflare passes through its reverse proxy infrastructure before reaching our main servers. Depending on the service used, information such as IP address, request time, requested address, connection information and browser information is processed to carry traffic, prevent attacks and provide security. In configurations where the TLS connection terminates at Cloudflare, this service may also process request and response content. Choosing not to use Cloudflare for content distribution does not mean that no personal data is processed through the reverse proxy. We do not permit public caching of private message or private media responses. See the Cloudflare Privacy Policy for further information.

Error reporting: Server error records obtained through StackExchange.Exceptional are kept on our own infrastructure; naming the software does not mean that error information is sent to its developer. We use Firebase and Apple's error/crash reporting services to investigate mobile application errors. Depending on the enabled product and sharing settings, these services may process technical information such as error traces, device information and application version. We restrict fields and filtering settings to prevent message text, private media, passwords and session tokens from being included in error reports. Application error reporting is limited by the version used and the device's sharing preferences. Details about Firebase processing are available in the Firebase privacy information, and details about Apple services are available in the Apple Privacy Policy.

Google sign-in: If you choose this method, we process the account identifier, email address, email verification information and any name information supplied by Google to create or match your account and authenticate you. We do not receive your Google account password. Communication between Google and your device during sign-in, and Google's processing within its own service, are also subject to the Google Privacy Policy. Removing the Anonymous Chat sign-in connection from your Google account does not automatically delete your Anonymous Chat account or the data stored here; use the channel in section 11 to request deletion.

Competent authorities and legal advisers: Where necessary for a valid legal process, security incident or protection of a right, we may disclose information limited to the scope of the request. Not every request results in automatic disclosure of an entire account or message history.

Transfer of the business: If operation of the Service is transferred, any transfer of personal data is considered only within applicable requirements and disclosed purposes. We provide required information about changes affecting users' rights. A business transfer does not authorize unlimited new uses of existing data.

9. International processing and transfers

Our main application infrastructure, email server, databases and media storage are on private servers managed by the operator in Türkiye. If you are outside Türkiye, your account information and submitted content are processed in Türkiye. This does not mean that all your personal data is processed only in Türkiye.

Google, Apple and Cloudflare use international infrastructure. Depending on the service, processing or access may occur in the United States, countries within the European Economic Area, and other countries where the provider or its subprocessors operate. Their explanations of global processing locations are available from Google, Apple and Cloudflare. Information these providers collect independently for their own accounts and services is also subject to their own disclosures.

Where an international transfer legally requires additional safeguards, we carry it out only after establishing a valid mechanism and necessary measures under the relevant legal system. These may include an applicable adequacy decision whose conditions are met, or safeguards such as appropriate standard contractual clauses. Requirements for the EEA, United Kingdom and Türkiye are assessed separately; a mechanism does not automatically satisfy requirements under another legal system. Hosting in Türkiye does not imply that Türkiye has an adequacy decision for EEA purposes.

Providing information directly to the operator in Türkiye is different from a controller or processor transferring information to another organization. Rules appropriate to the nature of the processing and any transfer apply. Accepting this policy does not waive necessary transfer safeguards or give explicit consent to every transfer to a foreign country.

You may request information about the recipients, countries and safeguards involved in transfers relating to you, or copies of safeguard documents that can be disclosed, by contacting support@anonymouschat.app. Other people's data, security information and protected commercial information may be redacted where necessary; this restriction is not applied in a way that undermines the substance of your rights.

10. Retention periods, deletion and preservation of specific incidents

We retain data only for as long as necessary for the disclosed purpose. The periods below are our ordinary retention policy; listing a period does not authorize collecting unnecessary information throughout it or refusing a justified request for earlier erasure. An applicable mandatory period or valid preservation need for a specific record applies separately and only to the records concerned.

When deletion begins: For a deletion operation you complete within your permissions in the application, the period starts when the server accepts the operation. For a rights request sent by email, it starts when necessary identity and scope verification is complete and the deletion decision is put into effect. Verification is not used to delay deletion arbitrarily; statutory request deadlines also apply. Deleted content is removed from ordinary visibility and access, and physical removal proceeds without delay. The 24-hour period is an operational target, not a right to reuse all information throughout that period.

No general archive of deleted messages: We do not retain the text and attachments of all messages subject to ordinary deletion in a separate general archive merely because a court request might arrive later. Traffic and security logs do not contain message text or media. Once content has been lawfully destroyed, we do not promise that we can recover it following a later report.

Connection records: Depending on the purpose, records may contain a necessary user or session identifier, IP information obtained from a trusted source, a port where available and necessary, a timestamp, service/event type and outcome. The one-year policy for publicly accessible hosting records is not a statutory one-year retention period for all private message content. Deleting an account does not restart the period for an existing connection record. Records that can still be linked to a person remain protected as personal data even if identifiers have been changed.

Reports and legal preservation: Reported content and necessary conversation context may be preserved in a separate incident file to review a report. An entire conversation or account history is not copied into that file merely because a report exists. Where there is a valid preservation request, an applicable reporting/retention obligation or a specific need to protect a right, ordinary deletion is suspended only for necessary records. The reason, scope, starting point, end condition and authorized access are recorded. Continued necessity is reviewed at least every 90 days; that review does not create an automatic entitlement to another 90 days of retention.

Where applicable to the operator and request, a preservation request under United States law, 18 USC §2703(f), may require preservation of existing relevant records for 90 days and another 90 days upon a renewed request. For child abuse reports submitted under 18 USC §2258A, reported content and necessary context are preserved for one year from the report. Other valid orders or obligations may require different periods. Not every communication from a foreign authority is automatically treated as a valid order. These specific periods do not apply to all users' content; prohibited content is separately removed from ordinary access and applicable reporting obligations are fulfilled.

End of retention and backups: Once a record's period expires and no valid preservation need or other necessary basis remains, destruction proceeds without delay. Changing a user identifier or hiding information from a chat screen is not permanent destruction. Deleted information in backups is not made available for ordinary use or maintained as a separate evidence archive. If a backup is restored, earlier deletion decisions are reapplied. Statistics that have been fully and irreversibly anonymized may be retained independently of personal data retention periods; pseudonymization or changing an identifier does not by itself anonymize data.

11. What happens when an account or message is deleted?

Deleting only for yourself: Removing a message from your own view does not remove it from the other participant's view. This is different from asking for destruction of the server conversation record that is still being provided to the other person.

Deleting for everyone or removing an attachment: The scope of an available option that you are authorized to use is explained during the operation. Content deleted for everyone and an attachment that is removed are taken out of ordinary user access, and the removal target in section 10 applies. A “message deleted” marker containing no message content may remain to preserve the coherence of the conversation. Removing only an attachment does not also delete message text that you have not chosen to delete.

Account deletion: You may submit your request to support@anonymouschat.app or through the account deletion channel provided in the application. After necessary verification of account ownership and request scope, the account is closed and sign-in and active sessions are terminated. Your profile, Google account link, notification tokens and account-generated content within the deletion scope are removed from active systems. Our target is 24 hours after the authorized deletion operation is accepted. Content created by other users is not deleted indiscriminately merely because your account closes; where necessary, a marker containing neither your identity nor your deleted content may be used.

The limited traffic, security, request and destruction records described in section 10, and preservation necessary for a particular incident, may continue under their own periods and bases. Account closure does not restart these periods. Where a retention exception applies, we explain which categories are retained and why, to the extent we may lawfully do so.

We may have no control over a screenshot previously taken by a recipient, an exported copy or information moved outside the Service. A local copy on an offline device may need a connection before it receives the server-side change. Section 13 explains management of device data.

The fact that you cannot access a limited incident record or another lawfully retained record in the application does not remove statutory access and other rights. We protect other people's rights, communications confidentiality and applicable legal exceptions when assessing requests. Uninstalling the application, revoking Google sign-in permission or canceling a subscription does not by itself delete an Anonymous Chat account; deleting an account may also not automatically cancel a store subscription.

12. Security, reports and authority requests

Security measures are proportionate to the nature and risks of the information processed. Account verification, authorization boundaries, access controls for private content and necessary action logs form part of this approach. No internet service can guarantee elimination of every risk of unauthorized access or data loss.

When you report a user or content, we may examine the content and technical context relevant to the report. The reporter's identity or private contact details are not disclosed to the person reported unless necessary and lawful to resolve the matter. We cannot promise absolute confidentiality in every case; a valid legal process may require disclosure.

We assess the source, scope and legal authority of an authority request. Where necessary, we ask for clarification or narrowing. We do not claim that unavailable data exists, and we preserve the meaning and technical limitations of the records we hold. Whether to notify a user is assessed under applicable law and the circumstances; a prohibition on notice or a need to protect an investigation may apply.

If a personal data breach occurs, we assess it and notify the relevant authority and, where required, affected people under applicable notification obligations. We do not promise that people continuously read every user's messages as part of security review.

13. Mobile platforms, device data and notifications

Apple iOS/App Store and Google Android/Google Play: If you obtain the application through the Apple App Store or Google Play, your store account, downloads and updates, and the store's processing relating to its own service are also subject to that platform's terms and privacy disclosures. Apple's explanations are available through the Apple Privacy Policy and App Store & Privacy; Google's explanations are available through the Google Privacy Policy.

Premium purchases: Premium membership, offering an ad-free experience and messaging without a membership-based message count quota, is purchased only through the Apple App Store and Google Play as a monthly or annual automatically renewing subscription. Eligibility for the one-week free trial and the conditions for conversion to a paid period are shown on the purchase screen. We do not sell subscriptions on the web or use another payment/subscription intermediary. We process transaction references, plan, trial/renewal status, validity and refund information supplied by the store to manage your membership; we do not directly receive your payment card details in this purchase flow. Restricting purchase channels does not separately promise which platforms can use an entitlement purchased through a store; that scope is stated in the purchase description.

Section 4 describes Anonymous Chat's processing of device and application information. Running on iOS or Android does not mean that the operating system providers receive all Anonymous Chat messages. Disclosures caused by notifications, sign-in or another integrated service are explained separately according to that feature's actual data flow. A platform's privacy notice does not replace our own explanations of our processing.

The Service may store information locally on your device to display conversations faster and remain usable during connection interruptions. Application and browser versions may use different local storage methods. The end of a session does not mean that every message or conversation record on the device is automatically deleted.

If you use a shared device, it is important not to leave your session open, to use a device lock and, where needed, to clear the relevant application or browser data. Clearing local data does not automatically delete the server account or another user's copies; server-side deletion also does not control every copy created outside the device.

In versions supporting notifications, device permissions and application preferences apply. Turning notifications off does not change the other rules for retaining account information or messages. Depending on device settings, people nearby may see notifications displayed on the lock screen. A token and limited routing information needed to direct a notification to your device may be sent to platform notification infrastructure. We do not include private message text or private media content in notification payloads.

14. Cookies, usage analytics, advertising and tracking choices

The website and web application may use cookies or browser storage for session management, security, language preferences and the functioning of features you request. Storing information on a device is not limited to files called “cookies”; similar rules may also apply to other storage methods.

Information about the provider, purpose and storage duration of optional technologies in use is also presented in the relevant privacy/advertising preferences screen. A technology's lifetime on your device may differ from the retention period of event data in an analytics service; a two-month analytics setting does not mean every cookie lasts two months.

Google Analytics and Google Analytics for Firebase: We use Google's analytics services on web and mobile surfaces to understand usage, evaluate features and improve the Service. This includes Google Analytics for Firebase integration, commonly called Firebase Analytics on mobile applications; naming Firebase does not mean that every Firebase product is used.

Depending on the active configuration and permissions, processing includes page or screen views, session and interaction events, application/browser and device information, cookie or application instance identifiers, and approximate region information. Google states that Google Analytics does not log or store IP addresses when collecting data; this does not mean that Anonymous Chat keeps no connection records of its own. We set user/event data retention in our analytics tools to two months. Private message text, media content, passwords and directly identifying account information are not included in analytics events.

Apple App Analytics: On Apple platforms, we use the application and store performance reports Apple makes available to developers. Depending on Apple's sharing conditions and user choices, these may provide aggregated or non-personally identifying statistics about usage, engagement and performance. You can manage sharing of device analytics with developers through your device's analytics and improvements settings. This does not describe Apple App Analytics as a separate tracking tool installed on the web or Android.

Google AdMob and Google AdSense: We use Google AdMob for mobile advertising and Google AdSense on web surfaces. Depending on the ad format, region, configuration and your permissions, Google and active advertising partners may process IP/connection information, device and browser information, cookies or similar identifiers, an advertising identifier where access is permitted, and advertising interactions. Information is used for disclosed purposes such as serving ads, measuring impressions and clicks, managing frequency and preventing advertising fraud.

The Service offers personalized advertising; required consent and platform permissions are obtained, and applicable opt-out rights are respected. With appropriate permissions and settings, analytics services may be linked to advertising services so usage events or audiences derived from them can be used for advertising measurement and personalization. This does not include adding private message text, media content, passwords or directly identifying account information to advertising or analytics events. Page/screen views, feature usage, ad impressions/clicks and related technical events may be used for these purposes. If you do not permit advertising personalization, we do not create or share audiences for that purpose; your separate analytics choice is also applied where relevant.

Google selecting ads does not mean that there is no third-party processing in Anonymous Chat. Even without a separate customer list upload or additional transmission from our server, advertising and analytics software may receive information directly from your device. We remain responsible for obtaining permissions, communicating choices to the relevant tools and explaining our own processing. Premium membership removes advertising; removing ads does not automatically stop all usage analytics or error reporting. Your permissions and rights concerning those activities remain separately applicable.

Further information about Google processing is available in the Google Privacy Policy, use of data from partner sites and applications, and Google Analytics data protection explanation. See Apple App Analytics & Privacy for Apple reports. These links do not replace our responsibility to explain our own processing.

When an advertising service is offered, we explain ad delivery, measurement of how often ads are shown, abuse prevention and personalization separately. An ad described as non-personalized is not assumed to involve no technical processing. Access to cookies, device identifiers, advertising identifiers or application interactions is described according to the system's actual configuration. We clearly explain which activities a preference stops and which continue.

For technologies requiring prior consent under applicable law, the relevant processing does not begin before consent is given. Where such a choice is offered, withdrawing consent must be as accessible as giving it. Blocking cookies through your browser may affect certain session or preference functions; merely blocking a technology does not remove rights outside its scope.

You may use My Ad Center and your device's advertising privacy settings to manage Google advertising preferences. These external settings are not the sole alternative to an Anonymous Chat consent choice or statutory opt-out request. Tracking subject to Apple's App Tracking Transparency also requires the relevant system permission; that permission does not replace consent required under other laws.

We do not respond to a browser's general “Do Not Track” signal as an instruction, by itself, to stop all processing. We process legally recognized “Global Privacy Control” (GPC) and similar signals as applicable requests to opt out of sale, sharing and targeted advertising. These signals are different from DNT. You can communicate your choice through the privacy/advertising controls in the web or application service and through support@anonymouschat.app. Where a linked account can be identified and the law requires it, the choice also applies to that account; unidentified devices are not assumed to be automatically linked.

15. People under eighteen

Anonymous Chat is intended only for people aged 18 or over. People under eighteen are not permitted to use the Service. On web and mobile, age eligibility is based on the user's declaration of adulthood; we do not routinely use identity documents or an external age verification service for this purpose. Store age ratings and device/account restrictions may provide additional measures, but they do not independently verify that every user is an adult. A report or finding suggesting an inaccurate age declaration may lead to further review of the account.

If you believe that someone under eighteen is using the Service or that information about such a person is being processed improperly, you may report this through the safety or privacy contact address. We handle the report to review the account, apply necessary restrictions and assess the data involved. Where a preservation or reporting obligation applies, necessary records are managed under that obligation.

Do not email, re-upload or distribute material depicting child sexual abuse. Provide information that helps locate it, such as an account, content or conversation identifier and approximate time. In an emergency, contact local emergency services or competent authorities directly; the support address is not an emergency response service.

16. How can you exercise your rights?

Although their scope depends on applicable law, your rights may include requesting information, access, correction, erasure, restriction of processing, objection and portability where the relevant conditions are met. You may withdraw consent for processing based on it. You will not be unlawfully discriminated against for exercising your rights.

You may send a request to support@anonymouschat.app. State the subject of your request and a user identifier or relevant contact address that helps us associate it with your account. Do not send your password, access token or an identity document unnecessary for the request.

We may carry out verification proportionate to the request's risk to prevent disclosure to unauthorized people. We do not request excessive identity information by default. If we cannot reliably verify the connection between you and the account or request, we explain this and consider reasonable verification methods available to us.

If we cannot fulfill a request completely, we provide the reason that can lawfully be disclosed and any available appeal or complaint route. We protect other people's personal data, trade secrets and legally protected investigation information when preparing a response. These limitations are not used to reject every request automatically.

17. European Economic Area and United Kingdom

Where the GDPR or relevant local data protection law applies, you have rights of access, correction of inaccurate data, erasure when its conditions are met, restriction, portability, and objection to processing based on legitimate interests on grounds relating to your particular situation. You may object at any time to processing for direct marketing.

As a rule, we respond to a GDPR rights request within one month. Where a legally permitted extension is necessary because of the complexity or number of requests, we notify you and explain the reason within the first month; the additional period is no more than two months. Requests are generally free of charge; a fee or refusal is considered only in the limited circumstances permitted by law.

If a decision is based solely on automated processing and produces legal or similarly significant effects, you may have rights to human intervention, to express your view and to challenge the decision, subject to applicable exceptions and safeguards. Not every technical filter or content ranking automatically falls into this category. If we use a decision process of this kind, we provide the required additional explanation of its logic, significance and expected consequences.

If you believe your rights have been infringed, you may contact the competent data protection authority without first contacting us. In the Netherlands, the relevant authority is the Autoriteit Persoonsgegevens, whose official website provides information and complaint routes. In the United Kingdom, the relevant authority is the Information Commissioner's Office. Your rights to approach other competent authorities based on your location, workplace or the location of the alleged infringement remain available.

18. People in Türkiye and rights under the KVKK

Where Turkish Personal Data Protection Law No. 6698 applies, you have the right to learn whether your personal data is processed, obtain information if it is processed, learn the processing purpose and whether information is used consistently with it, and know the third parties to whom it is transferred domestically or abroad.

You may also request correction of incomplete or inaccurate data, erasure or destruction when the legal conditions are met, and notification of these actions to third parties that received the information. You may object to an adverse result arising from analysis exclusively through automated systems and seek compensation if unlawful processing causes you damage.

Our electronic contact channel for KVKK requests is support@anonymouschat.app. Applying from an email address you previously supplied and that is registered in our system is one method recognized by the rules. Other legally recognized request methods and rights remain available; listing this email channel does not remove them. A request must include mandatory elements such as your first and last name, identity or nationality information required by the rules, an address for notification, the subject of your request and, for a written application, a signature. This does not mean that a copy of your identity document is required for every request; information security and proportionality are maintained.

KVKK requests are resolved as soon as possible according to their nature and within thirty days at the latest, generally free of charge; fees may be charged only where permitted by the rules. Statutory request and complaint routes remain available if a request is rejected, the response is inadequate or no timely response is received. Before complaining to the Board, you must first use the request procedure with the controller. See the Turkish Personal Data Protection Authority's explanation for procedures and deadlines.

19. Additional information for California residents

This section applies to the extent that we process California residents' information and the relevant provisions apply to Anonymous Chat. Application of the CCPA, as amended by the CPRA, depends on the activity and legal scope; being located in California does not by itself make every provision automatically applicable. Other applicable California privacy rules are also considered.

Information described in this policy may fall into categories including identifiers, internet or other electronic network activity, user-provided profile information, visual/audio content and, where applicable, sensitive personal information. Collection of precise location is not assumed; deriving an approximate region from an IP address is different from sensitive precise geolocation. The table below brings together the categories, purposes and recipients described in this policy and also covers the preceding twelve months to the extent those activities actually occurred during that period. It does not imply twelve months of activity that did not occur for a newly launched service.

Section 10 contains retention periods for these categories. We do not disclose private message content for advertising targeting or derive sensitive advertising profiles from that content.

Under California law, “sale” is not limited to providing information for money. “Sharing” may specifically include disclosure for cross-context behavioral advertising. We do not sell your personal information for money. However, disclosing online/advertising identifiers and usage activity to Google and active advertising partners for personalized advertising may constitute “sharing” and, in some circumstances, a “sale” under California law. We provide applicable opt-out rights for these activities. A general service provider relationship and a sale or sharing are not treated as identical; the actual conditions of the relationship determine the assessment.

Where the CCPA/CPRA applies, you may have the following rights subject to its conditions:

• To learn the categories of personal information collected about you, their sources and purposes, the categories of parties receiving disclosures, and specific pieces of information, and obtain an accessible copy.
• To have inaccurate personal information corrected and request deletion, subject to exceptions.
• To opt out of the sale or sharing of your personal information.
• To limit certain uses and disclosures of sensitive personal information; this is not interpreted as a right to stop every use of sensitive information.
• To be free from prohibited discrimination or retaliation for exercising your rights.

You may send requests to support@anonymouschat.app and communicate choices to opt out of sale/sharing or targeted advertising through the Service's privacy/advertising controls. Describing the type of request in your email is sufficient; a specific subject line is not required. Legally required direct preference links and options to limit sensitive information use are kept accessible. Legally valid general opt-out signals are respected for the processing to which they must apply; section 14 explains how they are handled.

You may act through an authorized agent. Verification appropriate to the authority and request type may be required; not every request is subject to the same identity verification. In particular, we do not impose verification obstacles that the law prohibits for opt-out rights. Receipt of CCPA requests to know, delete and correct is generally acknowledged within 10 business days, and the requests are answered within 45 calendar days; an allowed, explained extension may bring the total to no more than 90 days. Opt-outs of sale/sharing and applicable sensitive information limitation requests are implemented as soon as feasible and within 15 business days at the latest. Any shorter mandatory deadline under another applicable rule is preserved.

20. Other United States states

Privacy rights in the United States do not derive solely from one federal privacy statute or California law. Depending on whether your state's law applies to Anonymous Chat and the processing concerned, you may have rights of access, correction, deletion, portability, opt-out from targeted advertising or sale, and objection to certain profiling with significant consequences.

If your request is denied, you may appeal to the extent provided by applicable state law. Send your appeal to support@anonymouschat.app, identify your earlier request and explain why you challenge the decision. Appeals are directed to necessary human review; the decision, reasons and any complaint route to a competent authority are communicated within your state's statutory deadline. No paid membership, particular email subject line or new account not required by law is a condition of applying. An exception in one state does not automatically remove a right in another.

If an applicable state rule requires prior consent for sensitive information, universal opt-out signals or additional notice, we apply the requirements specific to the processing. This section does not make a blanket claim that every state's laws apply to the operator or that the operator falls outside their scope.

21. Other countries and regional rights

Offering the Service in another country does not displace that country's mandatory data protection rules. If this policy describes a right more narrowly than applicable mandatory law provides, your broader right remains protected. We provide country-specific additional notices or contact information where needed.

The language in which you read this policy does not by itself determine the law that applies. Applicable rules depend on the legal characteristics of the activity, the operator and its connection to the data subject. An explanation for one region does not waive your rights in another.

22. Policy changes and contact

We may update this policy when Service features, actual processing activities or legal requirements change. The effective date of the applicable text appears at the top of the page. Changes materially affecting your rights or use of your data receive a visible notice appropriate to their nature; where necessary, we inform you before the change takes effect.

Where a new use requires consent, changing the text, your silence or continued use of the Service does not replace that consent. Information already obtained does not automatically become available for unlimited new purposes through a later policy change.

For questions about this policy or your personal data rights, contact support@anonymouschat.app; for issues using the Service, contact support@anonymouschat.app; and for safety or abuse reports, contact support@anonymouschat.app.