Privacy Policy
In short OMG Chat connects two adults by live video at random. We do not record, store or watch your video or audio: the call goes directly between the two devices (or through an encrypted relay when a direct connection isn't possible). We keep the data we need to run your account, match you, keep people safe and process purchases, and we delete short-lived call data automatically within minutes to hours. You can delete your account and data at any time in the app.
- 1. Who we are
- 2. Data we collect
- 3. Live video, audio and your IP address
- 4. How we use data & legal bases
- 5. Who we share data with
- 6. Advertising & consent
- 7. International transfers
- 8. How long we keep data
- 9. Your rights (GDPR)
- 10. Deleting your account
- 11. Adults only (18+)
- 12. Security
- 13. Local storage & cookies
- 14. Changes & contact
1. Who we are
OMG Chat (the Android app com.abigfluffyyak.random_video_chat and the web app at omgvchat.com) is operated by Robert Cochran, Haarlemmerstraat 162, 1058 JZ Amsterdam, the Netherlands (“we”, “us”). We are the data controller for the personal data described here.
Questions or requests: memegrinders@gmail.com.
2. Data we collect
| Category | What exactly | Source |
|---|---|---|
| Account | A unique user ID. If you sign in with Google: your Google account ID, email address, and the name/profile photo Google shares. If you sign in with email: your email address and password (the password is stored hashed by Firebase Authentication; we never see it). Guest mode creates an anonymous ID only. | You / Google |
| Age confirmation | That you confirmed you are 18+ and when. Your date of birth is checked on your device and not stored. | You |
| Profile | Display name, gender, and country. Country is pre-filled from your device/browser language-region setting (an approximate country, not GPS) and you can change it. We do not collect precise location. | You / device setting |
| Matching & call setup | Temporary “match” records containing user IDs, display name, gender, country, your match filters, and WebRTC connection data (session descriptions and network candidates, which include IP addresses). | App |
| Live video & audio | Camera and microphone are used only during a call, after you grant permission. Streamed to the other person; not recorded or stored by us (see section 3). | Your device |
| Interests, streaks & badges | Interest tags you pick (up to 5), voice-only preference for a call, your daily login streak and call streak (days, best streak, your device's time-zone offset so a “day” is your local day), number of calls, and badges calculated from these and from your friends count, gifts sent, Premium status and whether your email is verified. Your display name, country, badges and streak are shown to people you are matched with. | You / App |
| Friend messages | Text messages you send to friends (max 500 characters), with time and sender, plus an unread counter. | You |
| Push notifications | If you allow notifications: a push token for your device/browser and your notification on/off choice. The notification text contains the sender's display name and, for messages, the first part of the message. | Your device |
| App analytics & crash reports | Android app: Google Analytics for Firebase usage events (for example sign-up, login, match started/ended with duration, skip, friend added, message sent, gift sent, purchases) with an app-instance ID, device model, OS and app version, country derived from IP, plus Firebase Crashlytics crash reports (stack trace, device state, user ID). Web app: the same usage events only if you accept analytics cookies. You can turn this off at any time in Settings → Usage analytics. | Google Firebase |
| In-call chat & interactions | Text messages (max 500 characters), reactions, gifts and filter/sticker choices you send during a call. Normally sent directly to the other device; if that isn't possible, temporarily relayed through our database. | You |
| Translation | If auto-translate is on, the text of messages you receive and your device language are sent to Google Cloud Translation. We cache the translated text (keyed by a one-way hash, not linked to your account). | App |
| Friends | Friend requests, your friends list (their user IDs and display names), and a “last seen” timestamp so your friends can see when you're online. Direct-call invites between friends. | You |
| Block list | The people you block (their user ID, the display name and country shown when you blocked them, and the time). Only you can see it; the people you block are not told. We use it to stop them matching with, calling, messaging or friend-requesting you. | You |
| Safety reports | If you report someone (or are reported): reporter ID, reported ID, the match ID and the chosen reason. | Users |
| Purchases & virtual items | Premium status and source, Google Play order ID and purchase token, or Stripe checkout session, customer and subscription IDs, amount, currency and payment status; gem balance, unlocked items, daily-reward claims, gift statistics and a ledger of gem transactions. We never receive your full card or bank details. | Google Play / Stripe / App |
| Device & ad data (Android app) | Advertising ID, device model, OS version, app version, IP address and ad interactions, collected by Google AdMob to show ads, subject to your consent choices (section 6). | Google AdMob |
| Website visit count | Once per browser session, the website records one anonymous visit: the marketing source (the ?ref= tag in the link, or the type of referring site such as Reddit, X or Google), the date, and whether the device is Android. No cookies, no user ID, device ID or IP address are stored with it, and it can't be linked to you. We use it only for aggregate statistics (how many visits came from which source). It doesn't depend on the cookie banner because it contains no personal data. | Website |
| Technical logs | IP address, browser/device type and timestamps processed by Google Firebase/Cloud when the app talks to our servers, plus server logs that may contain your user ID (for security and debugging). | Google Cloud |
We do not collect contacts, photos, precise location, or biometric data. Face filters and stickers are applied on-screen; we do not analyse or store faces.
3. Live video, audio and your IP address
- Calls use WebRTC and are encrypted in transit (DTLS-SRTP). Video and audio flow peer-to-peer between the two devices. When a direct connection is impossible, the encrypted stream is passed through a relay (TURN) server; the relay forwards the data and does not decode or record it.
- We do not record or store video or audio, and no person watches your calls. We cannot provide recordings of calls because none exist on our side.
- Because the connection is peer-to-peer, the other person's device can see your IP address (which can reveal your approximate location and internet provider). This is how direct video calls work. If you prefer to hide your IP address, you can use a trusted VPN.
- The other person can see and hear everything you show and say, and could record it with other tools without our knowledge. Only share what you're comfortable with. Recording others without consent breaks our Community Guidelines.
4. How we use data & legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Create and run your account, sign-in, profile, matching by your filters, calls, chat, friends, direct calls, translation you switched on | Performance of our contract with you (Terms) |
| Process purchases, deliver premium and gems, prevent double-spending and purchase fraud | Contract; legitimate interest in fraud prevention |
| Keep bookkeeping/tax records of purchases | Legal obligation (Dutch fiscal record-keeping, art. 52 AWR) |
| Safety: 18+ confirmation, handling reports, temporary suspensions, banning abusers, cooperating with lawful requests | Legitimate interests (protecting users, including from unwanted sexual content, and the service); legal obligation where applicable |
| Interest-based matching, voice-only matching, streaks, rewards and badges, friend messages | Performance of our contract with you |
| Push notifications | Contract (features you use) and your device/browser permission, which you can withdraw at any time |
| Analytics & crash reports | Web: your consent (cookie banner). Android: legitimate interests in keeping the app working and improving it, with an opt-out in Settings |
| Anonymous website visit counts by marketing source | Legitimate interest in measuring which channels bring visitors (no personal data stored) |
| Security, abuse prevention, debugging | Legitimate interests |
| Personalised ads (Android) | Consent (you can withdraw any time); non-personalised ads rely on legitimate interest in funding the free service |
| Camera & microphone access | Your permission on the device, required for the video chat you request |
We do not sell your personal data. We do not make decisions about you based solely on automated processing, and we do not use your data for profiling with legal effects.
5. Who we share data with
- The people you chat with: your display name, gender, country, video, audio, messages, reactions, gifts, filter choices and IP address (section 3). Friends also see your online status.
- Google (Firebase & Google Cloud): hosting, authentication, database (Cloud Firestore) and Cloud Functions, as our processor. Firebase privacy.
- Google Cloud Translation: text of received messages when auto-translate is on, as our processor.
- Firebase Cloud Messaging (Google): delivers push notifications, as our processor.
- Google Analytics for Firebase & Firebase Crashlytics: usage analytics and crash reports (section 2), as our processor; Google signals and ad personalisation are not enabled.
- Google Play (Android purchases) and Stripe (web purchases): they process your payment as independent controllers under their own policies (Google, Stripe). We receive only order/session details, not card numbers.
- Google AdMob (Android app only): ads and ad measurement, see section 6. How Google uses data from apps.
- Relay (TURN) server provider: hosting for the encrypted call relay, as our processor.
- Authorities: when required by law or to protect someone's safety (for example, reports of child sexual abuse material are passed to the competent authorities).
6. Advertising & consent
The Android app shows ads from Google AdMob to keep OMG Chat free. The web app does not show ads. In the EEA, UK and Switzerland we ask for your consent through Google's consent tool before any personalised ads are shown; if you decline, you may still see non-personalised (contextual) ads. You can change your choice at any time in Settings → Ad privacy choices, and you can reset or delete your advertising ID in your Android settings. Premium users do not see ads.
7. International transfers
Our service providers (Google, Stripe) may process data outside the European Economic Area, including in the United States. Where they do, transfers rely on the EU–US Data Privacy Framework (both companies are certified) and/or the European Commission's Standard Contractual Clauses.
8. How long we keep data
| Data | Retention |
|---|---|
| Video and audio | Never stored by us |
| Match / call-setup records (incl. IP-bearing connection data) and relayed in-call messages | Set to expire 10 minutes after creation and deleted automatically (Firestore TTL deletes expired data, usually within 24 hours). Messages also disappear from the screen when the call ends. |
| Cached translations | 30 days, not linked to any account |
| “Recently met” list | Stored only on your device, 10 minutes |
| Account, profile, interests, streaks, badges, friends, friend requests, block list, wallet, online status | Until you delete your account (or we close it) |
| Friend messages | Until either of you deletes their account |
| Push tokens | Until you sign out, turn notifications off, or the token expires |
| Analytics events / crash reports | Up to 14 months / 90 days (Google defaults) |
| Safety reports | 12 months, then deleted automatically; longer only if needed for an ongoing investigation or legal claim |
| Purchase and gem-transaction records | 7 years, to meet Dutch fiscal record-keeping obligations |
| Server logs | Typically 30 days (Google Cloud Logging default) |
9. Your rights (GDPR)
You have the right to access your data, to correct it, to have it erased, to restrict or object to processing (including processing based on legitimate interests), to data portability, and to withdraw consent at any time without affecting prior processing. Much of this you can do yourself in the app (edit profile in Settings, toggle auto-translate, change ad choices, delete account). For anything else email memegrinders@gmail.com from the address linked to your account, or include your user ID shown in the app; we reply within one month. You also have the right to lodge a complaint with a supervisory authority; in the Netherlands this is the Autoriteit Persoonsgegevens, or the authority in your own EU country.
10. Deleting your account
Open the app (Android or omgvchat.com) → profile icon → Settings → Delete account. This immediately deletes your sign-in account, and our servers then erase your profile (including interests, streaks and badges), friends list (on both sides), friend requests, block list, friend messages, push tokens, gem wallet (remaining gems and unlocks are forfeited) and online status. Purchase records are kept for the statutory period above, and safety reports expire after 12 months. You can also ask us by email; see omgvchat.com/delete-account. Uninstalling the app does not delete your account.
11. Adults only (18+)
OMG Chat is strictly for people aged 18 and over. Every user must confirm their date of birth before using the app. We do not knowingly collect data from anyone under 18. If you believe a minor is using OMG Chat, report them in the call (“Appears under 18”) or email us; we will close the account and delete its data.
12. Security
Calls are encrypted in transit; all app-to-server traffic uses HTTPS/TLS. Access to our database is restricted by server-side security rules: users can only read their own account, wallet and friends data, and purchases, gems and friendships can only be changed by our verified server code. No method is 100% secure, but we work to protect your data and will notify you and the authority of a breach where the law requires.
13. Local storage & cookies
The app stores a few settings on your device (sign-in session, age confirmation, match filters, chosen camera, auto-translate setting, analytics choice, recently-met list). The web app uses strictly necessary browser storage (for example, Firebase's sign-in session in IndexedDB/local storage, and a service worker for push notifications if you enable them), plus a one-session flag in session storage so an anonymous visit is only counted once per session (see section 2; no cookie, no identifier). Google Analytics cookies are set only after you click “Accept” in the cookie banner (Google Consent Mode: denied by default); click “Decline” or turn off Settings → Usage analytics to refuse or withdraw. We use no advertising cookies on the web. Stripe's checkout page, if you use it, sets its own cookies for payment security under Stripe's policy.
14. Changes & contact
We'll update this policy when the app or the law changes, and change the date above. For significant changes we'll notify you in the app. Contact: Robert Cochran, Haarlemmerstraat 162, 1058 JZ Amsterdam, the Netherlands · memegrinders@gmail.com.