Effective 11 September 2026 · Updated 26 October 2026
This policy describes what ProxChat collects, why, and what you can do about it. It describes how the app actually works, including the parts that limit what we can see.
The controller of your personal data is Machariel OÜ, registered in Estonia under registry code 17573220, registered address Sepapaja tn 6, Tallinn 15551, Estonia. You can reach us at support@proxchat.chat.
Because we are established in the European Union, the General Data Protection Regulation applies to everyone who uses ProxChat, wherever they live. If you are in Saudi Arabia or Jordan, your national data protection law applies in addition.
| Data | Why | Legal basis |
|---|---|---|
| Phone number | To verify you are a real person and to sign you in. It is never shown to other users and is never used for marketing. | Performance of a contract |
| Display name, photo, bio, gender | Your profile, which other users see. You choose all of it. Your photo, bio and gender can be changed or cleared at any time; your display name is fixed once your profile is created, because it is part of your reputation with the people you talk to. If you have a good reason to change it, write to us. | Performance of a contract |
| Date of birth | To make sure you are 18 or older, and to show your age on your profile. Other users see your age in years, never the date itself. It cannot be changed after you enter it; if it is wrong, write to us and we will correct it. | Legal obligation and performance of a contract |
| Achievements | Which of ProxChat's achievements you have earned and when — for example finishing your profile, reading the safety tips, or someone you invited becoming an established member. Worked out from information we already hold; never from how many messages you send or when you use the app. Two of them, Explorer and Traveller, note only that you opened ProxChat 20 km or more from, or in a different country from, the last place we held for you; we keep no record of where. Only you see them, except the ones you choose to show on your profile. | Performance of a contract |
| The ProxChat chat | The chat called ProxChat is where we post news and what is new in each version; nobody can reply to it. We record when you last opened it and whether you muted it, to show how many posts are unread and so that a muted chat sends you no notifications. Only you see this. | Performance of a contract |
| Communities | Communities are group chats we set up for busy places, such as a university or downtown. Unless you turn Communities off in Settings, we use the approximate location we already hold for people nearby to see whether you are within 2 km of a community, so that the app can offer it to you, or join it for you if you switch that on; you leave it again when you move away. We keep which community you are in, when you joined and when you last posted there, when we last notified you about it, your Communities settings, and what you post, including whom you mention in it. You can only mention people whose posts you can already see in that community. Everyone in the community sees your posts with your name, photo and trust level. Nobody can see who is in a community, only a rough count (3 or more, 10 or more, 50 or more), and nobody sees where you are. Before anyone else sees a message or photo you post in a community, it is checked automatically for prohibited content; if it is removed, the app tells you why and you can appeal. | Performance of a contract; the check before others see a post: legitimate interests (keeping a public community safe for the people in it) |
| What Apple or Google says about your age | When you give your date of birth, and about every 90 days after, we ask your phone's app store whether you are 18 or older. It answers only if you have shared your age with Apple or Google, and it tells us an age range, never your birthday. We keep only the conclusion (18 or older, under 18, not shared, or not available), how your age was established there (for example, declared by you or confirmed by them), and when we asked. If it says you are under 18, a new account cannot be created, and an existing one is suspended until a person on our team checks it; you can appeal. We use this for nothing else. | Legal obligation and legitimate interests |
| Approximate location, city and country | To show you people nearby, and to place you in other people's lists. See below — we do not store your exact position. | Consent |
| Messages | To deliver your conversations. Stored so that a message sent while the other person is offline still arrives. This includes replies (which point to the message they answer) and emoji reactions — who reacted with what, which the other person sees and may be notified of. If you edit a message (possible for 15 minutes after sending), the other person sees only the new text, marked “Edited”; we keep the earlier wording so that a report about the message can still be judged, and only a moderator ever sees it. You can delete any message for yourself, which removes it from your phone only, or a message you sent for everyone within about two days, after which both of you see “This message was deleted”. A message deleted for everyone disappears for both of you at once, but we keep what it said or showed for 30 days, unreadable by either of you, so that the other person can still report it: only a moderator sees it, and only if it is reported. After 30 days it is erased, unless a report about it is still open. All of these are deleted with the message. | Performance of a contract |
| Ratings | After a real conversation, you can say what the other person was like, choosing from positive traits only. Your rating is private: the person you rated sees only totals, and only once five people have rated them — unless they rate you too, in which case you each see what the other said (only ratings given after 5 October 2026, when this was added). From ratings, reports that we have upheld, and how long you have been here, we show a trust level (New, Established or Trusted) on your profile. Complaints are never ratings; they are reports, which a person reviews. You can also ask someone you have talked with to rate you; the request is deleted when they answer, or after 30 days. | Legitimate interests in helping people judge who to talk to |
| Identity after deletion | When an account is deleted, we keep its display name, date of birth, ban status and the date of the last upheld report for 12 months, linked to a keyed hash of the phone number that cannot be turned back into the number. If the same number signs up again in that time, the name, age and any ban carry over. See "How long we keep things". | Legitimate interests in preventing abuse and ban evasion |
| Waiting list and invites | While ProxChat opens area by area, a new account may wait in line until an invite lets it in. We record when you were let in and how (a friend's invite, one we handed out, or from the line), your place in the first 300 if you are a Founder, the invite codes you create, and whether each was used. When a friend's code lets someone in, we record who used it, so we can give the friend an extra invite later. See "Invites and the waiting list". | Performance of a contract; legitimate interests for the record of who used a friend's code |
| Blocks and reports | To keep the blocks you set working, and to review reported behaviour. | Legitimate interests in user safety |
| Device push token | To notify you of a new message, of something about your account, that you can rate someone you have been talking to, or, now and then, of a post in the ProxChat chat (unless you mute it), or that someone replied to you or mentioned you in a community, or, if you choose “Every new message”, that someone posted there (unless you turn community notifications off; the notification names who wrote and the community, never what they wrote). Only if you allow notifications. A message notification shows what the message says unless you turn off “Show message text” in Settings: your phone fetches the text from our servers in the EU, so the notification Apple or Google delivers contains only the sender’s name, never the message. | Consent |
| Age confirmation and acceptance of these terms, each with the time given | To show that you confirmed you are 18 or older and agreed to our terms. | Legal obligation and legitimate interests |
We do not use analytics or advertising software. ProxChat contains no advertising identifiers, no third-party trackers, no behavioural profiling, and we never upload your contacts.
Location is the most sensitive thing this app handles, so here is exactly what happens.
Messages are stored on our servers so they can be delivered when you are offline. They are not end-to-end encrypted, which means we are technically able to read them. We access message content only when investigating a report, responding to a lawful request, or automatically screening for prohibited content. That screening reads each message together with the one before it in the same chat, because a message such as “I’ll find you” only shows its meaning in context; nothing about a message that passes is kept. Please do not treat ProxChat as a secure channel for confidential information.
What our team sees. To run the service, our team uses a staff console. It shows account details such as your display name, when you joined and how you got in, when you were last active, which kind of phone and app version you use, and counts of your activity — never your location or your phone number. Opening one person's record requires a stated reason, and every time anyone looks is written to a log that cannot be edited and is kept for a year. When we investigate a report, the console shows the reported message or post and up to five messages either side of it in the same chat, so we can tell what happened — a photo, voice message or video among them opens only when a team member clicks it, and each one is logged; for something our automatic filter flagged and nobody reported, it shows only that item, and the message before it when that is what the filter read it with. Each of these views is logged too. When someone joins, our team is notified with their display name.
Your profile and messages are free text. If you choose to write something that reveals your health, religion, political opinions, sexual orientation, or similar, you are asking us to process that information by publishing it yourself, and you can remove it at any time. We recommend you do not put such information in a public profile.
We do not sell your data and we do not share it with advertisers. We use a small number of service providers, each under a contract that limits them to acting on our instructions. If you would like to know which companies they are, write to support@proxchat.chat and we will name them.
| Provider | What for | Where |
|---|---|---|
| Our hosting provider | Servers and encrypted backups | Germany / Finland (EU) |
| Our SMS provider | Sending your one-time sign-in code | United States, under EU standard contractual clauses |
| Apple and Google | Delivering push notifications to your device — the sender’s name and an identifier, never the message text | United States, unavoidable for mobile notifications |
| Our content-screening provider | Automatic screening of message text, bios, profile photos, and messages and photos posted in communities, for prohibited content (never voice or video messages) | France (EU) |
| Our app-update provider | Delivering app updates only to people still testing ProxChat through the Expo Go app, or on an early test version of the Android app. When such an app checks for an update, the provider receives your device's IP address and a random code for that installation — never your account, your profile or your messages. Current versions of ProxChat, on Android and iPhone, get their updates from our own servers in the EU instead | United States |
Everything else — your profile, your location, your messages — is stored on servers in the European Union and is not transferred outside it.
If the app closes unexpectedly, it keeps a short technical note about the error on your phone and asks, the next time you open it, whether to email it to us. It holds nothing from your account, messages or location; nothing is sent unless you tap Send, and your mail app shows it to you first.
Installing a test version. On Android, the app downloads from our own server; we do not record who downloads it. On iPhone, test versions come through Apple's TestFlight app, which you use with your own Apple Account under Apple's terms and privacy policy — Apple runs that service itself, not on our behalf. Through it, Apple shows us how many people installed each version and on which iPhone model and iOS version, and anything you choose to send us from TestFlight, such as a crash report or feedback with a screenshot.
| Data | Kept for |
|---|---|
| Approximate location | 30 days after the last update, then deleted automatically |
| Messages, conversations, and photos, voice messages and videos sent in them | Until you delete your account, or until a conversation has had no new message for 24 months — whichever comes first |
| What a message you deleted for everyone said or showed | 30 days, then erased — longer only while a report about it is still open |
| Record of a reported photo or video being viewed, or a reported voice message being listened to, by us | 365 days |
| Achievements | Until you delete your account |
| When you last opened the ProxChat chat, and whether you muted it | Until you delete your account |
| What you post in a community | 30 days, then deleted automatically — longer only while a report about it is still open — or sooner if you delete it |
| Which community you are in | Until you leave it: by moving away, leaving, turning Communities off, or not opening ProxChat for 7 days |
| Your Communities settings | Until you delete your account |
| What Apple or Google last said about your age | Until you delete your account; replaced each time we ask |
| The model of each phone signed in to your account | Until that phone is signed out, or you delete your account |
| Your phone number, after 90 days without using ProxChat | Kept apart from your account until you come back, someone else signs in with it, or your account is deleted |
| Profile, date of birth and blocks | Until you delete your account, or until it is closed for inactivity |
| After you delete your account: your display name, date of birth, whether it was banned and when a report was last upheld, with a keyed hash of your phone number (not the number) | 12 months, then deleted automatically — so that deleting an account cannot be used to change your name or age, or to escape a ban. Not kept when an account is closed only for inactivity. If your number used to be someone else's, write to us and we will release it. |
| Ratings you give | 24 months after you last change them, or until either of you deletes your account |
| Who used an invite you sent | 90 days after they joined; after that we keep only that the code was used |
| An account still waiting in line | 6 months, then deleted. We send a notification two weeks before |
| Moderation decisions about you, and your appeals | 180 days after the case is closed; the record of a suspension for as long as the suspension lasts |
| Reports and moderation records | 180 days after the case is closed |
| Server logs, including the IP address your device connects from | 14 days, then deleted automatically |
| Encrypted backups | 14 days, then deleted automatically |
If a conversation has had no new message for 24 months, we delete it and the messages in it. Storing private messages costs you privacy, not us, and once neither person has said anything for two years there is no longer a reason for us to hold them. The exception is a message someone has reported, or one our filter has flagged and nobody has reviewed yet: we keep that until the case is closed, because deleting it would destroy the evidence the report is about.
If you do not use ProxChat for 12 months, we delete your account and everything in it, including your phone number. Opening the app counts as using it — you do not have to send anything.
We do this for two reasons. Keeping your messages forever after you have walked away is not something we can justify. And because signing in to ProxChat needs only a phone number, an abandoned account is a risk to you: phone numbers get reassigned to new people, and whoever is given your old number next could otherwise sign in and read your conversations.
We will try to warn you first. About a month before, we send a notification saying your account is about to be deleted — and simply opening the app cancels it. We cannot promise the warning reaches you: if you have turned notifications off, changed phone, or removed the app, there is no way for us to tell you. That is why this page says it too.
Deletion is permanent and cannot be undone. If you want to keep your account, open the app.
You can send photos in a chat. They are stored privately, unlike your profile picture: a profile picture is shown to everyone nearby anyway, but a photo you send in a conversation is for one person. It is never publicly addressable, and it is fetched through a link that expires.
Where a photo or video was taken stays on your phone. Phone cameras write the place a photo or video was taken, and details about the camera, into the file. The app removes all of that before a photo, a video or your profile picture leaves your phone, and makes it smaller, so neither we nor the person you send it to can tell where you took it.
We do not screen your photos for taste. What two adults choose to send each other in private is not ours to judge. Every photo is checked automatically for one thing only — whether it appears to show someone under 18 — and nothing else is acted on by software. Anything else, you report and a person looks.
We cannot browse your photos. A photo only becomes viewable to us if it has been reported, or if the automatic check flagged it and nobody has reviewed it yet. Every time one is opened, that is recorded — who looked, and when. That record is kept for a year so that we can answer the question if you ever ask it.
They are deleted when you are. A photo goes with its message, with the conversation, and with your account — including from the other person's copy of the conversation, because it lives on our server rather than on their phone. They will see "Photo removed" where it was. The one exception: if a photo is part of an open report or safety case, we keep it until that case is closed. Otherwise deleting your account takes what you sent with it.
Once the other person has replied to you, you can send them a voice message of up to two minutes. The microphone is on only while you are recording, and nothing is sent until you tap send. Voice messages are stored privately, exactly like photos in a conversation: never publicly addressable, fetched through a link that expires.
Nobody screens your voice messages — no software and no person, and no other company receives them. That is also why you cannot send one to someone who has not answered you yet. If a voice message is abusive, report it: a reported voice message is the only kind we can listen to, and every time we do, that is recorded, as for photos.
The person you send it to sees its shape (how loud it was, moment by moment, measured by your phone while you recorded) and, once they have listened, you see a blue microphone — but only if they share read receipts. Turning read receipts off in Settings turns this off too.
They are deleted when you are, with the message, the conversation and your account, including from the other person's copy of the conversation. The same one exception applies: a voice message that is part of an open report or safety case is kept until that case is closed.
Once the other person has replied to you, you can send them a video of up to three minutes, recorded in the app or chosen from your library. Your phone makes it smaller before it is sent, and takes one still picture from it to show in the conversation, so nothing of the video downloads until someone taps it. Videos are stored privately, exactly like photos in a conversation: never publicly addressable, fetched through a link that expires.
Nobody screens your videos: no software and no person, and no other company receives them. A caption you add is text, and is checked as any message text is. That is also why you cannot send a video to someone who has not answered you yet. If a video is abusive, report it: a reported video is the only kind we can watch, and every time we do, that is recorded, as for photos.
They are deleted when you are, as photos and voice messages are, including from the other person's copy of the conversation, with the same one exception for an open report or safety case.
You can invite someone you're talking to, or someone you'd like to start talking to, to a game: tic-tac-toe, This or that, Four in a row, rock paper scissors, or dots and boxes. We store the board: who played whom, the moves or answers, how it ended, and when. Only the two of you can see it. In This or that and rock paper scissors, what you pick stays hidden from the other player until they have picked too; until then only you can see it. The This or that questions are a fixed set about everyday things like food and travel. A game can keep its own score while you play it, but nothing is counted across games, there are no rankings, and nothing about your games appears on your profile.
We tell the other player when it's their move, and while a game is waiting for someone we remind them once a day. An invite nobody has accepted gets no reminders. A game that nobody moves for three days ends. The notification names the other player, as a message notification does, and which game it is, and nothing else.
Games are deleted with the invite in the conversation, and so with the conversation and with your account.
You can ask ProxChat to notify you when another user is within 1 km of you. This is off unless you turn it on, in Me → settings, and you can turn it off again at any time.
It does not track you in the background. ProxChat only knows where you are when you have the app open — that does not change. When someone else opens the app near your last known position, our server does the comparison and sends the notification. Your phone is not reporting your location while the app is closed.
Because of that, and to keep the feature from becoming a way to watch people:
While ProxChat is opening, anyone can sign up, but a new account may wait in line until it is let in, by a friend's invite, by us in batches, or when ProxChat opens to everyone. While you wait, nobody on ProxChat can see your profile, you cannot see anyone else's, and we do not ask for or store your location.
An invite is a code, not a contact. You share it yourself, however you like; we never ask for your friends' phone numbers or read your contacts. You can see whether each code you sent was used, but not by whom. If a friend's code let you in, you are told who it was (you already know), and nobody else is. "Invited by" never appears on a profile.
Members who let people in. Some members choose to help let people in from the line. While you wait, they can see your photo, name, age, gender and bio (never your location), and let you in or skip you. People who know you may be among them. You can hide your profile from them at any time with "Hide my profile" on the waiting screen; we rely on our legitimate interest in letting you in sooner, and that button is your right to object. Skipping only hides you from that member. If a member lets you in, you are told who it was, and nobody else is. A member's record of whom they skipped is deleted once you are let in, or after 30 days.
Founders. The first 300 people let in carry a Founder badge on their profile, for good. It shows when you joined and nothing else, and it does not come back if you delete your account and join again.
On someone's profile you can write a short private note about them — where you met, what you talked about. This is the one place in ProxChat where you can store something about another person rather than about yourself, so it is worth being precise about it.
Your notes are yours alone. The person you wrote about cannot see the note, cannot see that one exists, and neither can anyone else using ProxChat. They are limited to 500 characters — a reminder, not a file on someone.
Other people can do the same about you. We are telling you this rather than leaving you to discover it: someone you have talked to may be keeping a private note about you, and you will not be shown it. If you ask us for a copy of your data and a note about you exists, we will look at that request individually — we will not hand over someone else's private writing automatically, and we will not pretend the question is simple.
They disappear when either of you does. If you delete your account, the notes you wrote go with it — and so does every note anyone else wrote about you. Deleting a note, or clearing the text, removes it rather than leaving an empty one behind. Your own notes are included when you export your data.
Moderation is mostly automatic, but a human decides the cases a classifier cannot. We run an internal console for that, and it is worth being precise about what it can and cannot reach, because most of it is enforced by the database rather than by our own good intentions.
If you make a subject access request we will tell you whether your account was opened in that console, when, and why.
We do not hand your data to any government on an informal request. Authorities outside the European Union must go through the Estonian authorities, we disclose nothing for conduct that is not a crime in Estonia or where you could be persecuted — for your relationships, sexuality, beliefs or opinions — and we tell you about a request unless the law or a risk to someone's life forbids it. The full rules are at proxchat.chat/law-enforcement.
Under the GDPR you can:
One honest caveat about deletion. Deleting your account removes your data from the live service at once. Encrypted backups taken before you left still contain it until they expire, which is at most 14 days. We do not restore deleted accounts from those backups. Separately, if an account is deleted while the app is offline mid-operation, an orphaned profile photo can briefly remain in storage; a nightly job removes any such file, so the maximum exposure is one day.
You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or to the authority where you live.
ProxChat is for adults only. You must be 18 or older, and you give your date of birth when you create a profile; we do not create an account for anyone it shows to be under 18. If we learn that an account belongs to someone under 18 we delete it. If you believe a minor is using ProxChat, write to support@proxchat.chat and we will act quickly.
Your phone number is how you sign in, and mobile carriers give numbers that stop being used to new customers. So that whoever gets your number next cannot open your account:
Traffic between your phone and our servers is encrypted in transit. Our database enforces per-user access rules so that one account cannot read another's private data, and backups are encrypted before they leave the server. No system is perfect; if a breach affects your rights we will notify the Estonian supervisory authority within 72 hours and tell you where the law requires it.
If we change this policy we will update the date at the top, and for anything significant we will tell you in the app before the change takes effect.