VantaChatWhat this policy covers
This policy covers the VantaChat website and web chat service. The website introduces the product; selecting “Open the web app” takes you to the chat app. The data needed to sign up, sign in and send messages differs from the data generated by browsing the website alone.
VantaChat is the operating brand of the project and website, based in the United States. For privacy requests and questions about the service, contact support@vantachat.org.
Accounts and profiles
To create an account, you need a username and password. VantaChat does not require a phone number or email address. The server stores account identifiers, password verification data and device session information. It does not store sign-in passwords in plain text.
Your display name, avatar, friend connections, group memberships, group names and group announcements are used to display profiles and organize conversations. Avatars, group names, group announcements, greetings in friend requests and contact notes are outside the end-to-end encryption of message bodies; the server can read this data. Contact notes are shown only to you.
Message contents and delivery information
New message bodies are end-to-end encrypted. Photos, files, voice messages and video messages in chats are encrypted before upload. The server stores and relays encrypted data and cannot read the contents of these message bodies or attachments.
To deliver messages to the right people and devices, the service still processes delivery information such as participants, room identifiers, send times and message sizes. Older messages sent before encryption was enabled are not automatically encrypted. End-to-end encryption also cannot prevent people in a conversation from taking screenshots, forwarding or saving content.
Recovery words and encrypted backups
The 12 English recovery words are generated on your device and are never uploaded to the server. The server stores the public key needed for account recovery and an encrypted key backup. It does not store your recovery words or the key that decrypts the backup.
Keep your recovery words offline. Anyone who obtains them can reset your password and read your encrypted history. If you lose both your password and your recovery words, we cannot recover your account for you.
Network data, abuse prevention and third-party services
Accessing and using the service generates data such as IP addresses, request times and device or browser information. The service uses IP addresses and account identifiers to limit unusual sign-in attempts, frequent registrations and other abusive requests. Network and server logs have no single automatic deletion schedule.
VantaChat uses Cloudflare for network proxying, hosting website resources and storing encrypted attachments. Registration uses Cloudflare Turnstile to assess whether requests come from real users. Cloudflare processes connection and verification data under its applicable privacy notices; message bodies and attachments are encrypted before they reach these services.
The project is based in the United States. Cloudflare may process connection, hosting and verification data in other countries or regions, depending on the infrastructure and configuration in use, so we cannot promise that data stays in one country.
What a report records
When you submit a report, the service stores the reporting user, the reported user, the room identifier, the reason for the report and the submission time. Report records have a one-year retention period and are removed by the storage service when they expire.
The reason for a report is stored as a separate record and is outside the end-to-end encryption of message bodies. Avoid including passwords, recovery words or unrelated private information in a report. Successful submission means only that the system has received the record; it does not mean a human review has been completed.
Who has access to this data
The content you send is received by participants in the conversation. Network, hosting and storage services process connection information, account data or stored data needed to provide the service; message bodies and chat attachments pass through these services as encrypted data.
If applicable law requires the disclosure of data, any disclosure is limited to information the service holds. The server does not hold recovery words or message decryption keys, so it cannot disclose them.
Retention and deletion
The server retains encrypted messages, encrypted attachments, account information and encrypted backups. There is no single automatic deletion schedule. Report records have a one-year retention period as described above.
Deleting, clearing or withdrawing messages in the chat mainly changes what you see. Copies on the server or held by other participants, downloads and screenshots may remain.
To request access to, correction of or deletion of data about you, email support@vantachat.org with the relevant account and details of your request. To protect accounts, we need to verify the requester’s identity. The chat interface currently has no self-service account closure or complete data deletion option. What can be processed depends on the type of data, copies held by other participants and applicable law.
Policy updates
This page shows its update date. We will update the information when data uses, third-party services or retention rules change. You can return to this page to check the current version before using the service.
Contact and feedback
VantaChat · 美国