Legal
Privacy Policy
Version 2.0 · Effective September 22, 2026 · Governing language: English
OmeChat is a random video-chat service for adults. Live video means we handle sensitive moments, so we have written this Policy to be complete and readable. It explains exactly what we collect, why, who sees it, how long we keep it, and what you can do about it.
Short version: we never record your calls; moderators can see short-lived camera snapshots to keep the Service safe; chat is anonymous and an account is needed only for money; PayPal handles payments; we do not sell your data.
1. Who we are and how to reach us
The Service is operated by OmeChat (“we”, “us”, “OmeChat”). We are the “controller” of the personal data described in this Policy (or the “business” for the purposes of California law).
Privacy questions, requests to exercise your rights, and complaints can be sent via our contact form. We answer within 30 days (or sooner where the law requires it).
This document is written in English. The Hebrew page at /privacy is a convenience summary. If the two ever differ, this English version governs.
2. What this Policy covers
This Policy applies to the OmeChat website and web application at https://omechat.hatuly.app (the “Service”): random one-to-one video and text chat, virtual gifts, the coin wallet, purchases and withdrawals, and our moderation and safety tools.
It does not cover third-party sites or services you reach through links, or the practices of PayPal or Google when you interact with them directly. Their own privacy policies apply to those interactions.
The Service is for adults only. You must be at least 18 years old. We do not knowingly collect personal data from anyone under 18. If we learn that a minor has used the Service, we terminate the account, delete the data we are not legally required to keep, and permanently ban the person (see Section 8).
3. Personal data we collect
We keep data collection to what the Service needs to work, to stay safe, and to handle money correctly. Here is the complete list.
A. Data you give us
| Account details (registered users only) | Email address, password (stored only as a salted hash), optional display name. Chat itself does not require an account; an account is required only when real money is involved (buying coins, cashing out). |
|---|---|
| Google sign-in | If you choose “Continue with Google”: your Google account ID, name, email address and profile picture, as shared by Google. |
| Profile choices | Optional gender declaration, optional interests used to match you with other users. |
| Payout details | The PayPal email address you enter when requesting a withdrawal. |
| Messages to us | Name, email, subject and message when you use the contact form; the content of reports you file about other users. |
| Age confirmation | Your confirmation that you are 18 or older before starting a chat. |
B. Data created while you use the Service
| Video and audio | Your camera and microphone streams are sent directly to the person you are matched with (peer-to-peer WebRTC). We do not record, store or archive calls. When a direct connection is impossible, the encrypted stream is relayed through our TURN server without being stored. |
|---|---|
| Moderation snapshots | While you are in a chat, your browser sends a small still image (about 320 px wide) of your camera roughly every 2.5 seconds to our moderation system. Each snapshot is kept in memory for 30 seconds and then overwritten. Snapshots are visible only to our moderators, are not shown to other users, and are not written to permanent storage unless a moderator saves one as evidence for a report or ban. |
| Live moderation view | A moderator may open a live view of your camera for the duration of a chat to review a report or a suspicious snapshot. This view is a real-time stream, is not recorded, and is available only to authenticated staff. |
| Text chat | Text messages exchanged during a call are relayed through our server and stored for up to 30 days so we can act on reports of abuse, after which they are deleted. |
| Call and session logs | Who was matched with whom (by internal user ID), start and end time, duration, end reason, the country derived from IP, and the browser/device type, kept for up to 90 days. |
| Gifts and wallet | Coin balance, gifts sent and received, coin purchases (PayPal order and capture IDs, package, amount), withdrawal requests and their status. We never see or store card numbers; PayPal processes payment. |
| Reports and bans | Reports you file or that are filed about you, moderator decisions, ban reason, duration, and any paid release of a ban. |
| Contact form messages | Stored in our admin inbox until handled, then deleted or archived. |
C. Data collected automatically
| IP address | Used to derive your country (shown to your chat partner as a flag), to enforce bans, to rate-limit abuse, and in security logs. |
|---|---|
| Device and browser data | User-agent string, screen size, language, and a device identifier generated in your browser (stored under the local-storage key omechat_fp) that helps us recognise banned devices that try to return. |
| Cookies | Strictly necessary session cookies (see Section 6). |
| Usage analytics | Anonymous, aggregated counters of key steps (page viewed, chat started, match made, gift sent, purchase completed). These are day-level totals with no user identifier. If we enable Google Analytics in the future, it loads only after you consent in the cookie banner. |
D. Data we do not collect
We do not collect precise geolocation, contacts, biometric templates, payment card numbers, government IDs, or data about your health, religion, politics or sexual orientation. The gender you declare is optional and is used only for matching preferences and for handling mismatch reports. A gender-verification feature exists in the code but is currently disabled; if we ever enable automated face analysis we will update this Policy first and ask for your explicit consent where the law requires it.
4. Why we use your data and on what legal basis
Where the GDPR or UK GDPR applies, we rely on the legal bases listed below. Other laws do not require a named basis but the purposes are identical.
| Providing the Service | Matching you with another user, relaying video/audio/text, showing your partner's country flag, keeping your session alive. Basis: performance of a contract (our Terms). |
|---|---|
| Safety and moderation | Reviewing snapshots and live views, handling reports, banning abusers, recognising banned devices and IPs, protecting minors. Basis: legitimate interests in a safe service and in protecting users, and compliance with legal obligations (e.g. child-protection and anti-abuse laws). |
| Payments and payouts | Selling coins, crediting purchases, paying withdrawals through PayPal, preventing fraud and chargebacks. Basis: performance of a contract; legal obligations (tax, bookkeeping, anti-money-laundering). |
| Accounts | Creating and securing your account, letting you log in, merging a guest wallet into a registered account. Basis: performance of a contract. |
| Communication | Answering your messages and requests. Basis: legitimate interests; performance of a contract. |
| Analytics and improvement | Understanding at an aggregate level which steps users complete, fixing bugs, measuring performance. Basis: legitimate interests (anonymous counters); consent (Google Analytics, if enabled). |
| Legal protection | Establishing, exercising or defending legal claims, responding to lawful requests from authorities. Basis: legitimate interests; legal obligations. |
We do not use your data for automated decisions that produce legal or similarly significant effects without human involvement. Bans are decided by a person.
7. How long we keep data
| Video and audio | Never stored. |
|---|---|
| Moderation snapshots | 30 seconds, unless saved as evidence for a report or ban (then kept with that record). |
| Text messages | Up to 30 days. |
| Call and session logs, IP, device data | Up to 90 days, longer only for accounts under investigation or banned. |
| Reports | 365 days after closure. |
| Bans and paid releases | Up to 3 years, or for the life of the ban if longer. Permanent bans and the device/IP data needed to enforce them are kept as long as the ban is in force. |
| Purchases, withdrawals, wallet ledger | 7 years, as required by tax and bookkeeping law. |
| Account data | Until you delete your account or after 24 months of inactivity, then anonymised. |
| Anonymous analytics counters | 400 days. |
| Encrypted backups | Rolling 45 days. |
When a period ends we delete the data or anonymise it so it can no longer be linked to you.
8. Safety, moderation and bans
Random video chat carries real risks. To keep the Service lawful and safe we monitor it. By using the Service you acknowledge that:
- Moderators can see still snapshots of your camera during a chat and may watch a live view of your camera when reviewing a report.
- Nudity, sexual content, violence, harassment, hate, spam, recording other users without consent, and any involvement of minors lead to immediate removal and a ban of your account, device and network.
- Evidence of illegal content involving minors is preserved and reported to the competent authorities (including through the relevant national hotlines) as the law requires.
- Some bans can be lifted early against a fee via PayPal. Bans for suspected under-age use can never be lifted by payment. Paid releases are recorded and such accounts are subject to closer review.
- You may report any user at any time with the report button; every report is reviewed by a person.
9. How we protect data
- All traffic is encrypted in transit (HTTPS/TLS, WSS, DTLS-SRTP for WebRTC media).
- Passwords are stored only as salted hashes. Session tokens are short-lived and HttpOnly.
- Access to admin tools requires separate staff credentials and is logged.
- Payment card data never touches our servers; PayPal handles it.
- Database backups are encrypted (AES-256) before leaving the server and are stored off-site.
- Request signing, CSRF protection, rate limiting and webhook signature verification are in place.
No system is perfectly secure. If we discover a breach that affects you, we will notify you and the relevant authority within the time the law requires (72 hours under the GDPR).
10. International transfers
Our servers are located in the European Union and the United States, and we and our providers may process data from other countries. When personal data protected by the GDPR, UK GDPR or Israeli law leaves those jurisdictions we rely on an adequacy decision where one exists (the EU has recognised Israel as adequate; Israel recognises the EU/EEA) and otherwise on the European Commission's Standard Contractual Clauses (and the UK Addendum) with the recipient, together with additional technical safeguards such as encryption.
11. Your rights
Depending on where you live you have some or all of the following rights. We honour them for everyone, regardless of location, unless a law prevents it.
- Access: a copy of the personal data we hold about you and the information in this Policy.
- Rectification: correction of inaccurate data.
- Erasure: deletion of your data. Use the “Delete my account” button in your wallet page, or contact us. We keep only what the law requires (financial records, ban records needed to keep a banned person out).
- Restriction and objection: you can ask us to pause processing or object to processing based on legitimate interests.
- Portability: your account data in a machine-readable format.
- Withdraw consent: at any time, for any processing based on consent (for example analytics cookies), without affecting past processing.
- Complain: to your data-protection authority. In the EU you can find yours at edpb.europa.eu; in the UK it is the ICO (ico.org.uk); in Israel it is the Privacy Protection Authority (gov.il/privacy).
To make a request, contact us via our contact form. We may ask you to prove you control the account concerned. Requests are free unless they are manifestly excessive.
Israel (Privacy Protection Law, 5741-1981, as amended)
You are not legally obliged to provide any personal data; providing it is voluntary, but without the data described as necessary the Service (or a paid feature) cannot be provided. Data is held in our database as described above and is used only for the purposes in Section 4. You have the right to inspect data about you and to request correction or deletion of data that is inaccurate, incomplete or outdated, in accordance with Sections 13 and 14 of the Law. Our database is registered or exempt from registration as the Law requires.
California (CCPA/CPRA)
In the past 12 months we collected the categories described in Section 3: identifiers, commercial information, internet activity, geolocation at country level, audio/visual information (live only; snapshots for 30 seconds), and inferences limited to optional interests. We do not sell personal information and do not share it for cross-context behavioural advertising, and we have not done so in the past 12 months. We do not use or disclose sensitive personal information other than to provide the Service. You have the right to know, delete, correct, and to non-discrimination for exercising your rights. You may use an authorised agent. We honour Global Privacy Control signals as an opt-out of analytics cookies.
European Economic Area and United Kingdom
Our legal bases are in Section 4. Where we rely on legitimate interests we have balanced them against your rights; you can ask for a copy of that assessment. If we are required to appoint an EU or UK representative we will publish their details here.
12. Children
The Service is strictly for people aged 18 and over. We use an age confirmation before every first chat, moderator review of snapshots, user reports and device/IP bans to keep minors out. We do not knowingly collect data from anyone under 18 and we do not target the Service at them. If you believe a minor has used the Service, contact us immediately via our contact form; we will remove the account and delete the data, keeping only what we must preserve for law enforcement.
13. Changes to this Policy
We may update this Policy when the Service or the law changes. The effective date and version at the top will change, and for material changes we will show a notice in the Service before they take effect. Continued use after the effective date means the updated Policy applies to you.