Privacy Policy
Last updated: 25 October 2026
The short version
- No accounts, no real names, no email sign-up.
- No advertising, no analytics trackers, no selling or renting of personal data.
- Chats are relayed live and kept only in memory, except a short excerpt when someone files a report.
- Music streams straight from Audius to your device; the light show analyses songs inside your browser.
- Wall posts are public on purpose and are mostly deleted at each weekly reset.
The rest of this page explains each part in detail. Our Cookie Policy lists exactly what is stored in your browser.
Who is responsible
ChatSpark (chatsparkrc.com) is run by its operator, who decides how your information is used (the "controller" under laws such as the GDPR). You can reach us at the Report button in any chat (a contact email address will be listed here soon).
What we collect and why
| Feature | What is processed | Why |
|---|---|---|
| Every connection | Your IP address is visible to our hosting providers when you connect. Our realtime server turns it into an opaque keyed code (an HMAC) and does not store, show or log the raw address. | To run the service and to enforce bans and rate limits. |
| Random chat | Messages you send, relayed to your chat partner and kept briefly in server memory. Your matching preferences (your gender, who you would like to meet, topic and interests), used only to find a match and not stored on the server. | To deliver the chat and to make reports possible. |
| Underground FM | A random stage name and colour made from a random key your browser creates, the room you are in, room chat lines (the last 40 per room, in memory), reactions, votes, song requests and typing signals. | To run shared rooms in real time. |
| Light show | Your browser downloads the current song from Audius and analyses it on your device. Only a small summary (tempo and song sections, no audio) is sent to the room. | To sync the lights to the music for everyone. |
| Reports | The reason you choose, an optional note, the opaque code of the person reported, and up to 12 of their recent messages. | So a person can review abuse and keep the service safe. |
| Poem and Graffiti Walls | What you publish, your chosen artist tag, likes and reports, a random anonymous ID stored in your browser, and keyed codes used for rate limits. | To publish the walls, count likes fairly and stop abuse. |
We do not use your information for advertising, profiling or automated decisions with legal effects.
Legal bases
Where laws such as the GDPR or UK GDPR apply, we rely on: performing the service you ask for (relaying chats, running rooms, publishing your posts); our legitimate interests in keeping the service safe, secure and working (rate limits, reports, bans); and legal obligations where they apply. We do not currently rely on consent for anything, because we do not use optional cookies or trackers. If that changes we will ask first.
How long we keep it
| Information | Kept for |
|---|---|
| Random chat and room chat messages | Only in server memory while the chat or room is active; gone when it ends or the server restarts. |
| Report excerpts and notes | Deleted automatically after 7 days. |
| Ban records (opaque codes only) | Until the ban expires. |
| Wall posts, likes and reports | Until the weekly reset (Monday, UTC). The top five posts per wall each week are kept in the public winner archive. |
| Data in your browser | Until you clear it, or until you close the tab for per-tab data. See the Cookie Policy. |
| Hosting provider logs | Set by those providers, usually days to weeks. |
Who we share it with
We use these service providers to run ChatSpark. They process data for us under their own security and privacy commitments:
- Vercel: hosts the website.
- Railway: hosts the realtime chat and Underground FM server.
- Supabase: hosts the database behind the Poem and Graffiti Walls.
Audius is an independent service. When you play music, your browser connects to Audius directly, so Audius receives your IP address and the songs you stream under its own privacy policy. Song artwork is also loaded from Audius.
We may disclose information if the law requires it or to protect someone from serious harm, for example reporting child sexual abuse material to the authorities. We never sell or rent personal data.
International transfers
Our providers may process data in countries other than yours, including the United States. Where the law requires it, we rely on the safeguards these providers offer, such as standard contractual clauses.
How we protect it
Connections are encrypted (HTTPS and secure WebSockets). We keep raw IP addresses out of our application data, strip control characters and links from messages, rate-limit every room action, and restrict what pages may load through a strict Content Security Policy. Reports and bans are stored with restricted file permissions and expire automatically. No method is perfect, so please never share anything you would not want a stranger to keep.
Your rights
Depending on where you live, you may have the right to access, correct, delete or object to the use of your personal data, to restrict it, to receive a copy, and to complain to your local data protection authority.
Because ChatSpark has no accounts, we usually cannot link data to you. To make a request, contact us at the Report button in any chat (a contact email address will be listed here soon) with the approximate time and place of the interaction (for example the room and your stage name) and any report details. You can delete everything stored in your browser yourself at any time by clearing this site's data.
Children
ChatSpark is not for anyone under 18. If we learn that a minor has used the service, we block them and delete related data where we can.
Changes
We will update this page when our practices change and change the date at the top. Significant changes will be highlighted on the site.