Skip to main content
SayGo

Privacy Policy

Last updated: October 2026

We collect the minimum needed to run a safe service.

What we collect

  • If you have an account: your email and a salted password hash.
  • Display name, interests, language preferences.
  • If you chat as a guest (no account): the interests you type, and a hashed IP address and device fingerprint kept with each chat so a report can lead to a ban. The camera preview on the homepage stays on your device.
  • From the ID check (Didit), if you verify: the country that issued your ID, your date of birth and a one-way hash of the document number, so one ID can't verify several accounts. We do not store ID images.
  • Chat sessions (timestamps, mode, partners) — no content.
  • Report and skip evidence: while you are in a session, your own browser keeps the last 5 to 10 seconds of the other person's video only (never audio). None of it leaves your device unless you report them, or skip them in a moderated chat; then that clip and a still frame go to a private storage bucket so moderators can review them, and our AI filter checks the frame. Clips from skips are deleted after 7 days unless something was wrong in them. The other participant's browser does the same with your video. Moderators view evidence through time-limited links; it is not publicly accessible.
  • Hashed IP addresses and a hashed browser device fingerprint for ban enforcement.
  • Biometric data (duplicate-account prevention): during ID verification your selfie is compared against previously verified faces by face-recognition software that runs on our own servers (it is not sent to a third party for this) so that one person cannot hold two accounts. A mathematical face template (128 numbers, not the image) is kept with your verification record for as long as your account exists and is deleted when you delete your account. We do not store the selfie image. The same template is used for the identity check described next.
  • Face presence and identity check: a face detector runs in your browser during chat to confirm a face is visible on your camera (and on the other participant's video); no images from that detector leave your device, only whether a face was seen is sent to our matching server. At the start of each session, one still frame of your camera is sent to our server; for verified accounts, our face-recognition software checks that it matches the face template stored at verification. The frame is not stored. A mismatch is recorded against the session.
  • Automated content detection (Moderated Mode): in Moderated Mode a classifier in your browser samples the other participant's video every few seconds. When it suspects explicit content, a single still frame of the other participant's video is sent to our server and on to AWS Rekognition for an automated verdict. Frames are not stored — only the verdict (the detected labels), which participant it concerned, the session it relates to and a hashed IP address are kept for review. The other participant's browser does the same with your video.
  • Live moderation review: moderators may view your video (no audio, ever) while you are in an active chat session for safety purposes. Every moderator view is written to an audit log you can request a copy of, and a view cannot start if that log entry fails to write. Moderation streams are not recorded — they pass through our signaling server only while a moderator is actively watching that session, and are then dropped.
  • Rings (only if you turn them on): the push address your browser gives us, your time zone so we only ring in the daytime where you are, and when we last rang you. The ring itself travels through your browser's push service (Google, Mozilla or Apple) and says only that someone is looking for a chat. Turn rings off in Settings at any time.

What we do NOT collect

  • The audio of your sessions — never captured, never transmitted to our servers, never included in evidence clips or moderation streams.
  • Video when a moderator is not actively watching your session and no report has been filed. Moderation streams are on-demand and ephemeral.
  • Chat message content beyond the active session.
  • Your ID image or selfie image.

Third parties

Didit (ID verification), Stripe (payments and payouts), AWS Rekognition (automated content detection on the individual video frames our in-browser classifier flags in Moderated Mode; never face recognition), Cloudflare (private storage of report evidence, the TURN relay for WebRTC and the sign-up bot check), Resend (email), Sentry (error reports) and our hosting providers (Vercel, Fly.io, Neon and Upstash). Each sees only what they need.

Your rights

Delete your account from Settings at any time. Deletion removes your profile, interests, verification record and face template; bans are retained to prevent re-signup.

Contact

privacy@saygo.app