Privacy policy

• Account, when you sign in with Google or Apple: your name, email address, profile picture, and the identifier provided by that provider. We never receive or store your password.
• Age declaration, when you create your account: the date of your declaration that you are 18 or over, and the IP address and browser used at that moment. This is what lets us show that the account was properly opened.
• Profile, the gender and country you declare, used for matching.
• Subscription, a Stripe customer ID and your subscription status. Your bank details never pass through our servers: they are entered directly with Stripe. A subscription taken in the app is paid to Apple (App Store) or Google (Google Play): through RevenueCat, we receive its status, product, store, and expiry date, never your payment details.
• Technical, IP address, browser type, and connection timestamps, needed for security and to fight abuse.
• Reports, when one user reports another, the reason given and anything attached to the report, including a capture of the conversation.
• Streamer mode consent, when someone agrees or refuses to be broadcast live: the two accounts involved, the room, and the date.

Your video conversations are never recorded, stored, or rebroadcast. The stream passes directly from one browser to the other; it only passes through our servers when a direct connection is not possible, and it is never retained.

Text messages sent during a conversation pass through our servers to be relayed, but are not recorded: they disappear at the end of the conversation.

• Camera and microphone: the app asks for them only for video chat. You can withdraw these permissions at any time in your phone’s settings.
• On-device analysis: nudity and face detection runs on your phone, using a model built into the app. The analysed images do not leave the phone, except when an alert is raised: a capture is then attached to a report, reviewed by a human moderator.
• Last people met: so that you can report or block someone afterwards, the app keeps on your phone a thumbnail of the last five people you met, taken during the call. These thumbnails are only sent to our servers if you make a report, attached to it.
• No advertising: the app shows no ads and contains no advertising tracking tool.

• to run the service and put you in touch with someone
• to enforce the rules and permanently keep out accounts that break them
• to manage subscriptions and payments
• to respond to your requests

We do not sell any data. We work with:

• Google and Apple, for authentication
• Stripe, for payments on the website
• Apple and Google (App Store and Google Play), for in-app purchases, and RevenueCat, the provider that manages those subscriptions on our behalf
• MongoDB Atlas, to host the database
• OVH, to host the servers, in France
• a messaging provider, used by our moderation team to review reports and to follow new sign ups. It receives only what those two tasks require, in private channels closed to anyone outside the team

We also disclose information when required by law, or to report content involving a minor, without condition or delay.

• Account (name, email address, picture, gender, country, subscription): for as long as it exists. On deletion, this data is erased immediately; the account remains, in anonymised form and with no time limit, for the moderation history described below
• Age declaration (date, IP address, browser): with no time limit, including after the account is deleted, in anonymised form, because it is what justifies opening the account
• Sign-in sessions (with the IP address and browser used): each one expires thirty days after it was last extended, at most once per day of use. It is erased on sign out and when the account is deleted; an expired session is not erased automatically
• Reports: for as long as they are pending, then ninety days after they were made once they have been handled
• Captures attached to reports: thirty days, except the capture behind a suspension, kept for as long as that suspension is active
• Ongoing suspension (reason, severity, capture, end date): for as long as it is active; erased when it is lifted
• Suspension history (number of suspensions, dates): with no time limit, including after the account is deleted, in anonymised form, to prevent a banned account from coming back
• Keyed hash of a deleted account’s email address: with no time limit. It cannot be turned back into the address; it only lets us recognise a new sign up during an ongoing suspension
• Moderation signals (reports received, automatically detected nudity, people leaving a conversation with you immediately): ninety days
• Conversation history: none is recorded today. If such a history were kept (the two participants’ accounts and the date, with no image, sound, or message), it would be erased after ninety days
• Suspension appeals sent from the app: with no time limit
• Blocks: until the block is lifted or one of the two accounts is deleted
• Streamer mode consent records: 180 days, longer than captures because a complaint about being broadcast can surface well after the fact
• Payments: we only keep the Stripe customer ID, erased when the account is deleted. Invoices and payment details are kept by Stripe, Apple, or Google, under their own rules

You can request access to your data, its correction, its erasure, its portability, or object to its processing. Write to hello@decal.ink: we reply within one month.

Deleting your account erases your data, except for what we keep to prevent a banned account from coming back, for the periods set out above. You can delete your account directly in the app, from Settings, Delete my account; the full steps are on the Delete your account page.

If our response does not satisfy you, you can lodge a complaint with your country’s data protection authority.

We only use cookies that are necessary for the service to work: one that keeps you signed in, and one that secures forms. No advertising or tracking cookie is set without your consent.

The service is for people aged 18 and over. We do not knowingly collect data about a minor. If you think a minor is using the service, report it immediately: we close the account and delete the associated data.