Privacy policy
Last updated: 5 November 2026
Chirpy is a chat app run by Ryan (Htet Lin Zaw), under the name ponypigeon ("we"). This page explains what data Chirpy collects, why, where it is stored, how long it is kept, and what you can do about it. Questions: privacy@ponypigeon.com.
What we collect and why
| Data | Why |
|---|---|
| Account: email address, username, display name, password (stored only as a one-way hash), and your Google account ID if you sign in with Google | To create your account, sign you in, send sign-in and password codes, and let people find you by username |
| Profile (all optional): bio, profile picture, the city or region you pick, interests, whether you're discoverable | To show your profile and, only if you turn on discovery, suggest people with shared interests nearby. We never use GPS or store your exact location |
| Messages and activity: messages you send, edits, reactions, read markers, friends, friend requests, blocks, groups | To deliver your chats, keep your history and let you search it (only your own chats, and groups of up to 50 people, are searchable) |
| Online status: whether the app is connected, and when you were last seen | Shown only to your friends. You can hide it in settings (then you also don't see theirs) |
| Group pictures set by a group leader | To show the group to its members. Resized, metadata removed; deleted with the group |
| Photos, videos, voice messages and files you send (and the file names) | To deliver them. Profile and group pictures are resized and their metadata (such as location) is removed |
| Calls: who called whom, when, whether it was answered and how long it lasted. Not the audio | To connect calls and show your call history. Audio goes directly between the phones, or through Cloudflare's relay, encrypted; we never receive or record it |
| Device: a push-notification token from your phone | To notify you of new messages while the app is closed |
| Technical: IP address, time and type of requests | Security, preventing abuse (rate limits) and fixing problems |
| Reports: when someone reports a user, the reason, their note, and the messages they choose to attach | Keeping Chirpy safe |
We don't show ads, don't sell or share your data for advertising, and don't use your messages to train AI.
Why we're allowed to use it
| Use | Legal basis |
|---|---|
| Your account, delivering chats, calls and media, push notifications, search | Needed to provide the service you signed up for (contract) |
| Security, rate limits, preventing abuse, handling reports, keeping logs | Our legitimate interest in keeping Chirpy safe and working |
| Discovery ("people you may know"), showing your online status | Your choice: you can turn them off at any time in settings |
| Keeping records the law requires | Legal obligation |
Signing in with Google
If you sign in with Google, we receive your Google account ID and email address from Google, and use them only to create your account and sign you in. We don't ask for, see or store anything else from your Google account (no contacts, files or calendar), and we don't share Google data with anyone. You can disconnect Chirpy in your Google account settings at any time.
Who can see what
- Your messages and media are seen by the people in that chat or group.
- In groups of up to 50 people, the sender of a message can see which members have read it.
- Your username, display name, bio and picture can be seen by other users. Your city and interests are shown only to friends, or to everyone if you turn on discovery.
- Our admins can see account information (such as username, email address and activity counts) to run and protect the service. They cannot see your messages or media, except messages another user chose to attach to a report. Every admin action is logged.
- Messages are encrypted while they travel to and from our servers and are stored with our providers' disk encryption, but Chirpy is not end-to-end encrypted: our servers can technically read messages in order to deliver and store them.
Services we use
These providers process data for us, only to run Chirpy:
| Provider | What for | Where |
|---|---|---|
| Render | Runs the Chirpy server | Singapore |
| Neon | Database (accounts, messages) | Singapore |
| Upstash | Short-term data (rate limits, caches, sign-out records) | Singapore |
| Cloudflare | Domain, website, photo/video storage (R2), and relaying call audio when phones can't connect directly (encrypted; Cloudflare can't listen) | Asia-Pacific |
| Resend | Sending email codes | United States |
| Google sign-in, and delivering push notifications (Firebase Cloud Messaging). Notifications contain the sender's name and a preview of the message | Global | |
| Grafana Labs | Service health statistics (counts only, no personal data) | Singapore |
Some of these companies are outside your country, so your data may be transferred abroad. We only use providers that protect it.
How long we keep it
- Photos, videos, voice messages and files: up to 16 MB, deleted from our storage 24 hours after everyone in the chat has received them, and after 7 days at most; larger ones 24 hours after they were sent. Copies stay on the phones that downloaded them.
- Messages: until you delete them (delete for everyone) or the account is deleted.
- Sign-in sessions: up to 30 days of inactivity.
- Email codes: 2 minutes.
- Server logs: a short time, as kept by our hosting provider.
- Reports: until handled, then 180 days.
- Call history: 180 days.
How we protect it
- Everything travels encrypted (HTTPS/TLS), and our providers encrypt the stored data on their disks.
- Passwords are stored only as a one-way hash (Argon2id), and email codes only as a keyed hash. Sign-in tokens expire after 15 minutes, and signing out everywhere ends every session at once.
- Calls go directly between the phones (or through an encrypted relay); we never receive the audio.
- Photos, videos and files can only be downloaded by the people in that chat, through links that expire after 5 minutes.
- Admin access needs a password and a code sent by email, can't show message contents, and every admin action is logged.
No system is perfectly secure. If a breach puts your data at risk, we'll tell you and, where the law requires it, the data protection authority, without undue delay.
Cookies and tracking
This website uses no cookies, no analytics and no trackers. The app keeps your sign-in on your phone and doesn't track you across other apps or websites. We count totals (such as how many messages were sent in an hour) to keep the service healthy, without personal data.
Automated decisions
We don't profile you or make automated decisions with legal or similar effects on you. Automatic limits, such as how many messages can be sent per minute, apply to everyone equally to prevent spam.
Deleting your account
Delete your account in the app under your profile settings. This removes your profile, picture, friends, push tokens and sessions immediately, and your photos and videos within the next cleanup (about an hour). Messages you sent stay in the other person's or the group's history, shown as coming from a deleted account. You can also email us to ask for deletion.
Your rights
You can see and correct your profile in the app, delete messages and your account, and turn off discovery and individual notification types. Depending on where you live (for example under Thailand's Personal Data Protection Act or the EU's GDPR) you may also have the right to get a copy of your data, object to or restrict processing, withdraw a consent you gave, or complain to a data protection authority. To use these rights, email privacy@ponypigeon.com from your account's email address. We answer within 30 days.
Children
Chirpy is not for children under 13 (or the minimum age for this kind of service where you live). If you believe a child has an account, tell us and we will delete it.
Changes
If we change this policy, we'll update the date above and, for important changes, tell you in the app.