Your data rights, in simple words
India's Digital Personal Data Protection Act, 2023 (DPDP Act) gives you control over your personal data. This page explains, in plain words, what Stranger Talk keeps, why, for how long, and what you can do about it.
1. The short version
- We never ask for your email, phone number or real name.
- We only keep what we need to run chats and keep people safe.
- One-to-one messages are encrypted only when both devices have registered keys and setup succeeds; fallback messages may be stored as regular text. Reported chats may include up to 20 recent messages shared from the reporter's device. Random Chat messages are deleted when the chat ends unless retained for a report.
- We never sell your personal data. There are no ads today. If we add ads or promotions later, we will tell you first and ask before showing ads based on you.
- Your data stays until you delete it. When you delete your account yourself, your data is deleted. Only guest accounts (no PIN) that are not used for 2 years are deleted automatically.
- You can download your data, fix it or delete your account yourself, any time.
- Stranger Talk is for adults 18+ only. We do not knowingly keep any child's data.
In the law's words, you are the Data Principal (the person the data is about) and Stranger Talk is the Data Fiduciary (the service that decides how it is used). The full details are in our Privacy Policy. If this page and the Privacy Policy ever differ, the Privacy Policy applies.
2. What we keep, why, and for how long
| What | Why | How long |
|---|---|---|
| ST code, PIN (only a scrambled hash), recovery code (only a hash) | So you can log in without email or phone | Until you delete your account. Guest accounts with no PIN: deleted after 2 years with no use |
| Age and gender | To keep the site 18+ and to match you in Random Chat | Until you delete your account |
| Display name, bio, interests, Instagram (all optional) | To show your profile the way you choose | Until you remove them or delete your account |
| Country, state, city (only if you use Area Chat) | To find people near you. We never use GPS | Until you change them or delete your account |
| Random Chat messages | To deliver the chat | Deleted when either person taps Next or Leave, or within about 1 to 2 hours |
| Other chats, group messages and posts | To deliver and show them. One-to-one chats are stored only as scrambled (encrypted) text | Until you or the group deletes them, or you delete your account |
| One-time photos | To deliver the photo once | Deleted once opened, and always within 24 hours |
| Login sessions and device labels (like "Android · Chrome") | To keep you logged in and let you sign out other devices | Sessions end after 30 days |
| Hashed (scrambled) IP address for failed logins, sign-ups and abuse limits | Security log to stop password guessing and look into break-ins | 1 year (the DPDP Rules ask for this), then deleted |
| Reports and blocks | To keep people safe and act on rule-breaking | Messages attached to a report: deleted 90 days after the review ends. The report itself is kept as a safety record, and your ST code is removed from it when you delete your account. Blocks: until you unblock or delete your account |
| Refer & Earn records and device hashes | To check invites are real and pay rewards | Device hashes 90 days. Payout records as long as tax law requires |
| Push notification address (only if you allow alerts) | To send you alerts like new messages | Until you turn alerts off or delete your account |
| Feedback and problem reports | To fix bugs and reply to you | Until you delete your account |
We also use Google Analytics on our public pages (not inside the app once you are signed in) to count visits, only if you tap "Allow" when we ask. You can change this any time on the Cookie Policy page.
3. Your consent, and how to take it back
When you start, you tick a box to confirm you are 18+ and agree to our Terms and Privacy Policy. That is your consent for the basic service: your ST code, age, gender, chats and safety checks.
Some extras are off until you turn them on: push alerts (your phone asks you), fingerprint or face login, Area Chat location, your Instagram on your profile, Refer & Earn and Google Analytics (we ask "Allow" or "No thanks"). Others are on by default and you can switch them off any time in Settings: Common ground and English corrections. Joining the English practice group means your messages there are grammar-checked automatically. If we add personalised ads or partner promotions in future, they will also ask you first and can be switched off.
Taking back (withdrawing) consent is as easy as giving it:
- Turn a feature off in Settings, or remove the detail from your profile.
- Turn off alerts in your browser or phone settings.
- Delete your account to withdraw consent for everything (Profile → Account and devices → Delete my account).
When you withdraw consent, we stop using that data and delete it, unless the law makes us keep something (for example a payout record for tax, or a report that is still being reviewed). Anything already done before you withdrew stays valid. Without the basic data, you cannot use the chat service.
4. Your rights
5. How to make a request
- Most things you can do yourself in the app, instantly (download, edit, delete).
- For anything else, email strangertalk.in@gmail.com with the subject Data request. Tell us your ST code and what you want.
- Because there is no email login, we may ask you to prove the account is yours, for example by sending us a short word we give you through Feedback inside the app while logged in. Never send your PIN or recovery code.
- Can't log in? First try Recover account with your recovery code. Because we never collect your email or phone, if you have lost both your PIN and recovery code we may not be able to prove the account is yours, and then we can't hand over or change its data. We can still delete it if you show it is yours another way (for example, details only the owner would know).
Nominee. To name a nominee, email us from the address you will keep using, with your ST code and the nominee's name and how to contact them. You can change or cancel it the same way. If you die or can't act, the nominee can ask us to delete your account or give them a copy of your data, after showing reasonable proof.
How fast we reply. We confirm your request within 24 hours and aim to finish within 15 days. The law allows a maximum of 90 days. If we can't do something (for example a law makes us keep a record), we tell you why.
Your language. If you'd like this notice in Hindi or another language listed in the Eighth Schedule of the Constitution of India, email us and we will send it.
6. Grievance Officer and complaints
Amit Kumar, Founder & CEO, is our Grievance Officer and the contact person for all data protection questions.
Email: strangertalk.in@gmail.com (subject: Complaint)
If you are not happy with our answer, or we don't reply in time, you can complain to the Data Protection Board of India, set up by the Government of India under the DPDP Act. The law asks you to try our grievance process first. See Complaints & Redressal.
7. If there is a data breach
A breach means someone gets at personal data without permission. If that ever happens and affects you, we will:
- Tell you without delay, in plain words, inside the app and on our website (we don't have your email or phone): what happened, when, what data was involved, what it could mean for you, what we are doing about it, and what you can do to stay safe.
- Report it to the Data Protection Board of India straight away, with a full report within 72 hours, and to CERT-In as Indian law requires.
- Fix the cause and keep a record of what happened.
How we protect data today: scrambled (hashed) PINs, recovery codes and session tokens, end-to-end encryption for one-to-one chats, secure HTTP-only login cookies, access checks before any message is shown, rate limits, and access for only a small team.
8. 18+ only, no children's data
Under the DPDP Act, a child is anyone under 18. Stranger Talk is only for adults, so we don't ask for parental consent and we don't allow children to sign up. Our server rejects any age under 18. If someone says in a chat that they are under 18, the account is flagged for urgent review, and if we find a child has an account we delete it. We never track, profile or target ads at children.
9. Your duties too
The DPDP Act also asks you to: give true information (especially your age), not pretend to be someone else, not hide important facts when you ask us to correct data, and not file false or frivolous complaints.
10. Where your data is stored
Our hosting provider may keep data on servers outside India. The DPDP Act allows this, except to countries the Government of India restricts. We follow any such restriction.
11. Changes
When we change how we handle data in an important way, the app shows a short summary and asks you to agree again. The date at the top of this page shows the latest version.