Privacy Policy

Effective date: 2026-07-24 · Version: 2026-07-24

This Privacy Policy explains what information Iron-chat ("Iron-chat", "we", "us", or "the app") collects, why we collect it, how we use and share it, and the choices and rights you have. We built Iron-chat to collect as little as possible and to keep your conversations private.

1. Who is responsible for your data

Iron-chat is operated by an independent individual operator based in Ukraine (the "operator", the data "controller"). For any privacy or data-protection request, contact us at [email protected]. This is the fastest way to reach a human about your data.

2. Information we collect

2.1 Information you give us

• Account details: your username, email address, and password. Your password is stored only as a salted one-way hash — we never store or see your actual password.
• Sign in with Google (optional): if you use it, we store the permanent Google account identifier from the verified sign-in and the email address on that Google account, so we can recognize you next time. We never receive your Google password, and we do not request access to anything else in your Google account.
• Recovery phone number (optional): if you add one in Account settings, we store it so we can help return the account to you if you lose access.
• Profile details you choose to add: display name (nickname), short "about me" (bio), profile photo (avatar), preferred language, and app theme.
• Content you create: the messages you send (text), the photos and videos you attach, and the stickers you make in Iron Lab together with the packs you keep them in, along with reactions, replies, forwards, pins, @mentions, and the private labels/aliases you set for your chats. Messages you send in one-to-one chats, group chats, and channels are stored so they can be delivered and shown in the conversation. A sticker you send can be added by whoever receives it to their own sticker list, and stays available to them until you delete it.
• Premium purchases: if you subscribe to Premium, we store the purchase token the store gives us, which product you bought, the price and currency the store reports, the tier it grants, and whether the subscription is still active — so we know what you are entitled to. No payment details ever reach us (see Section 2.3).
• Reports and support: if you report a user or a message, we store the report (who reported, who/what was reported, and your stated reason). If you send a bug report, we store its text and your device/browser identifier ("user agent").
• Invitations: if you invite someone by email, we store that email address to send the invitation and to connect you once they join.

2.2 Information we collect automatically

• IP address. We record the IP address you register from and the IP address of your active session, together with your browser/device user agent. We use this to keep the service secure, prevent abuse, and enforce bans.
• Push notification token. If you enable push notifications, we store a device push token (from Google Firebase Cloud Messaging) and your platform (Android/iOS) so we can notify you of new messages.
• Presence and usage signals. We store a "last seen" timestamp and per-chat read position (read receipts) so conversations work as expected.
• Diagnostic and usage data. Basic technical and aggregate usage signals — such as crash reports and which features are used, not tied to the content of your messages — to help us fix problems and improve the app.
• Website analytics (our website, not the app). The public Iron-chat website uses Google Analytics, which sets cookies in your browser and receives your IP address, the approximate location derived from it, and which pages you open, so we can see how many people find us. It runs only on the website; the app itself contains no analytics of this kind. You can stop it with your browser settings or any tracker blocker — nothing on the website needs it to work.

2.3 Information we do not collect

• We do not collect your date of birth, precise GPS location, contacts list, or biometric data.
• We do not collect or store payment card details. Premium is billed by Google Play (and by the Apple App Store if we ship there), which process payment under their own privacy policies; all we receive is the purchase token and the subscription's state, never a card number or payment method.
• We do not receive the photos you edit in Iron Lab. Cutting a sticker out of a photo happens on your phone; nothing leaves the device unless you save the finished sticker to a pack or send it.
• We do not read your messages to profile you, and we do not share message content with advertisers (see Section 5.1 on advertising).

3. How we use your information

4. Content moderation and reporting

Iron-chat has zero tolerance for illegal or abusive content. Any user can report a message or another user from inside the app. When content is reported, we may review it and remove it, and we may suspend or ban the responsible account. We may also use automated tools to help detect illegal material (especially child sexual abuse material), spam, and abuse; we do not use these tools to read your private messages in order to profile you or to advertise.

To make moderation and any required legal reporting possible, when content is reported we keep a copy of the relevant evidence (including reported media) and we retain deleted messages in a hidden form. This evidence is kept separately, is not shown to other users, and is retained for as long as needed to handle the report, protect our users, and meet legal obligations.

5. How your information is shared

We do not sell your personal data. We share data with the service providers and partners that operate the app — including any advertising partners described in Section 5.1 — and only as needed:

We may also disclose information if required by law, to respond to valid legal process, to enforce our Terms, or to protect the rights, safety, and property of our users or the public.

Business transfers. If Iron-chat is ever involved in a merger, acquisition, reorganization, or sale of assets, your information may be transferred to the successor or new owner as part of that transaction. It stays protected under this Privacy Policy (or one at least as protective), and we'll tell you if the controller of your data changes.

5.1 Advertising

Iron-chat may show advertising in various places in the app — including inside one-to-one and group chats and within the message feed (for example, "sponsored messages" shown among other messages) — and including optional "rewarded" ads you can watch in exchange for temporary access to paid features or perks. Where ads are shown:

• ads may be delivered by third-party ad networks, which may collect data such as a device advertising identifier, coarse (non-precise) location derived from your IP address, and ad interaction/measurement data, under their own privacy policies;
• ads shown inside a chat or group may be selected based on context such as the group or channel you are viewing — not the content of your private messages;
• we do not share the content of your messages with advertisers;
• on iOS we ask your permission through Apple's App Tracking Transparency before any cross-app tracking, and you can limit ad personalization at any time in your device settings;
• depending on where you live, ad personalization may count as "sharing" or a "sale" of personal information under local law (such as California's CCPA/CPRA); where it does, you can opt out through the device ad settings above.

6. Where your data is stored and international transfers

Your data is stored and processed on servers located in the European Union (Oracle Cloud, EU region). If you use Iron-chat from outside the EU — for example from the United States — your information will be transferred to and processed in the EU. Where we transfer personal data of EU/EEA users to providers outside the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

7. How long we keep your data

• Account and profile data: kept while your account exists, then deleted or anonymized after you delete your account (subject to the exceptions below).
• Messages: kept until you or the other participant delete them, or your account is deleted.
• Media (photos/videos): automatically expires and is deleted after a set retention period — currently about 90 days for images and 30 days for videos — unless a longer retention applies to your plan. There is also a per-user upload limit.
• Stickers: kept for as long as you keep them. Stickers deliberately do not expire, so a pack stays complete for everyone who added it; deleting a sticker or a whole pack deletes the underlying file too.
• Premium subscription records: kept while the subscription is active and for a period afterwards, as needed to handle renewals, refunds, disputes, and tax/accounting duties.
• Moderation evidence and safety data (reported content, deleted-message copies, IP/ban records): kept as long as necessary to handle reports, prevent repeat abuse, and comply with the law, even after an account is deleted.
• Deleted-account suppression: when you delete your account we keep a one-way cryptographic hash of your email address (never the email itself) so that the account cannot be recreated with the same address.

8. Your rights and choices

Depending on where you live (for example under the EU/UK GDPR, or California's CCPA/CPRA), you have some or all of the following rights over your personal data:

• Access a copy of the data we hold about you;
• Correct inaccurate data;
• Delete your data ("right to erasure");
• Receive your data in a portable format;
• Restrict or object to certain processing;
• Withdraw consent at any time (this does not affect processing already carried out);
• Not receive discriminatory treatment for exercising your rights.

Deleting your account. You can delete your account at any time directly in the app (Profile → Delete account). You can also request deletion by emailing [email protected]. Deletion removes your profile, messages, and media from the app and signs you out of all sessions. To stop the account being recreated, we keep a one-way hash of your email on a suppression list (not the email itself), which also means the same email cannot be used to register again. We complete verified deletions within 30 days. Some data may be retained where the law requires it or where we need it to resolve reports, prevent abuse, or defend legal claims, as described in Section 7.

If you are in the EU/EEA or the UK, you also have the right to lodge a complaint with your local data protection authority.

9. Security

We protect your data with measures including one-way password hashing, encrypted transport (HTTPS), access-scoped API tokens, time-limited signed links for media, and IP-based abuse controls. No system is perfectly secure, but we work to protect your information and to limit what we collect in the first place.

10. Children

Iron-chat is not directed to children. You must be at least 13 years old to use it (and older where your country requires a higher age for consent). We do not knowingly collect personal data from children below the minimum age. If you believe a child has provided us data, contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy. When we make material changes we will update the version and effective date above and, where appropriate, ask you to review and accept the updated policy in the app before you continue using it.

12. Contact us

For privacy and data-protection requests (access, deletion, complaints), email [email protected]. For general questions, email [email protected].