OneChat Privacy Policy

Effective August 11, 2026

This policy explains how OneChat handles information when you use the OneChat website and the OneChat iOS and Android applications.

Information we process

Account and profile information: email address, display name, optional verified phone number, profile photo, profile description, verification status, account role and account status.

Messages and user content: message text, reactions, story text, photos, videos, documents and other files you choose to send or upload. OneChat stores message content on its servers so it can synchronize conversations across your signed-in devices. OneChat does not currently claim end-to-end encryption.

Calls: OneChat stores call metadata needed for call history and reliability, such as participants, call type, timestamps and call state. Live voice and video media is transported with WebRTC and may use the OneChat TURN relay when direct peer-to-peer connectivity is unavailable. OneChat does not intentionally record or store live call audio or video.

Security and device information: login IP address, session/security records, encrypted mobile push-notification tokens, an app installation identifier, basic app version/locale information, and technical information required to operate anti-abuse and notification services.

Safety and moderation: block relationships, user/content reports, report reasons, optional report details, moderation status and administrator resolution notes used to enforce the Community Standards.

How we use information

We use information to provide messaging, stories, file sharing, notifications, voice/video calls, account synchronization, abuse prevention, content and account moderation, security, customer support and service reliability. OneChat does not use user content for advertising and does not sell personal information to advertisers.

Service providers

OneChat may send limited technical information to service providers strictly to operate app functionality, including Apple Push Notification service for Apple devices, Firebase Cloud Messaging for Android notification delivery, Google reCAPTCHA for abuse prevention, configured email-delivery providers for verification messages, and infrastructure providers that host OneChat services.

Retention and deletion

Account information and conversation data are retained while your account remains active and as needed to provide the service. Stories expire from normal visibility after their configured lifetime. Security records and backups may be retained for limited periods when reasonably necessary for security, fraud prevention, disaster recovery or legal obligations.

You can initiate permanent account deletion from Profile → Delete account in the mobile app or Settings → Privacy & security → Delete account on OneChat Web. See the account deletion page for an external deletion path.

Security

OneChat uses HTTPS/TLS, access controls, short-lived access tokens, refresh-session rotation, protected credentials, encrypted-at-rest mobile push tokens, rate limiting and server-side validation. No security system can guarantee absolute protection.

Your choices

You can update your profile, remove your profile photo, control operating-system notification permissions, log out, revoke sessions, and delete your account. Device permissions such as camera, microphone and photo access are requested only for features that need them.

Contact

Privacy and support questions: admin@chat.torfy.com.

Store submission note: App Store Connect privacy answers and Google Play Data Safety answers must match the actual production configuration and this policy.