Last updated: September 2026. This document describes Paranoid Chat's data handling as of the current build. It is written to reflect what the service actually does, not a generic template.
Paranoid Chat is a personal project offering three kinds of chat rooms with different privacy models: password-protected rooms, 24-hour ephemeral rooms, and end-to-end-encrypted (e2ee) rooms. This policy explains what data each model involves.
Creating an account requires a username, a password that is not stored in plain text, confirmation that you are at least 18 years old, and completion of a short-lived abuse-prevention verification step. We store the time of the age confirmation, but we do not collect or store your date of birth through this flow. A short display tag and a display color are derived automatically from your account and are not intended to identify you directly.
Room passwords are stored only as salted hashes, the same as account passwords. End-to-end-encrypted rooms use a one-time "owner key" instead of a room password; it is shown to the room's creator exactly once and is never stored or displayed again in any recoverable form.
Room owners may generate join tokens to invite specific people. We record which account used a given token and when, so the room owner can see who joined via that invitation. This record is tied to the token, not shared outside the room's own management view.
Accounts that have not logged in or sent a message for 90 consecutive days are automatically and permanently deleted, along with their sessions. Ephemeral rooms are deleted 24 hours after creation regardless of activity.
This service uses Cloudflare Turnstile to reduce automated abuse of account registration and login. Cloudflare Turnstile's own privacy practices apply to that interaction and are outside our control.
We do not sell your data. We do not use your messages for advertising, analytics, or any purpose other than delivering them to the room you sent them in. We do not read the content of end-to-end-encrypted rooms — that content is designed to remain unreadable to us. We do not verify or guarantee the identity, intentions, or conduct of other users, and we are not responsible for scams, fraud, impersonation, harassment, threats, or losses resulting from user interactions.
You may delete your account at any time from within the app. This permanently removes your account, active sessions, and messages authored by that account from the service's database and Durable Object history, subject to any retention required by law. Password-room messages otherwise expire after up to 24 hours.
You may request access to information about your personal data and its processing, correction or updating of inaccurate data, erasure where retention is not legally required, or withdrawal of consent where consent is the basis for processing. Email requests and privacy grievances to lime.projects.help@gmail.com. Include enough account information for us to identify the request without sending your password. We aim to respond within the period required by applicable law.
If this policy changes in a way that affects how your data is handled, you will be asked to review and re-accept it before continuing to use the service.
This is a personal project. For privacy questions, rights requests, or grievances, contact lime.projects.help@gmail.com.
The service is offered only where its operation and your use are lawful. Privacy obligations differ by country and region; we do not represent that this service, its policies, or its processing satisfy every law in every jurisdiction. Where the service is not legally permitted or where its policies do not meet mandatory local requirements, you must not use it, and we may restrict access. Nothing in this section excludes or limits any non-waivable consumer, privacy, or other legal right or obligation that applies to the service.