Privacy policy
Last updated: [FILL IN date of publishing]
Chirpy is a chat app run by [FILL IN: your name or organisation] ("we"). This page explains what data Chirpy collects, why, where it is stored, how long it is kept, and what you can do about it. Questions: privacy@ponypigeon.com.
What we collect and why
| Data | Why |
|---|---|
| Account: email address, username, display name, password (stored only as a one-way hash), and your Google account ID if you sign in with Google | To create your account, sign you in, send sign-in and password codes, and let people find you by username |
| Profile (all optional): bio, profile picture, the city or region you pick, interests, whether you're discoverable | To show your profile and, only if you turn on discovery, suggest people with shared interests nearby. We never use GPS or store your exact location |
| Messages and activity: messages you send, edits, reactions, read markers, friends, friend requests, blocks, groups | To deliver your chats and keep your history |
| Online status: whether the app is connected, and when you were last seen | Shown only to your friends. You can hide it in settings (then you also don't see theirs) |
| Group pictures set by a group leader | To show the group to its members. Resized, metadata removed; deleted with the group |
| Photos, videos and files you send (and the file names) | To deliver them. Profile and group pictures are resized and their metadata (such as location) is removed |
| Calls: who called whom, when, whether it was answered and how long it lasted. Not the audio | To connect calls and show your call history. Audio goes directly between the phones, or through Cloudflare's relay, encrypted; we never receive or record it |
| Device: a push-notification token from your phone | To notify you of new messages while the app is closed |
| Technical: IP address, time and type of requests | Security, preventing abuse (rate limits) and fixing problems |
| Reports: when someone reports a user, the reason, their note, and the messages they choose to attach | Keeping Chirpy safe |
We don't show ads, don't sell or share your data for advertising, and don't use your messages to train AI.
Who can see what
- Your messages and media are seen by the people in that chat or group.
- In groups of up to 50 people, the sender of a message can see which members have read it.
- Your username, display name, bio and picture can be seen by other users. Your city and interests are shown only to friends, or to everyone if you turn on discovery.
- Our admins can see account information (such as username, email address and activity counts) to run and protect the service. They cannot see your messages or media, except messages another user chose to attach to a report. Every admin action is logged.
- Messages are encrypted while they travel to and from our servers and are stored with our providers' disk encryption, but Chirpy is not end-to-end encrypted: our servers can technically read messages in order to deliver and store them.
Services we use
These providers process data for us, only to run Chirpy:
| Provider | What for | Where |
|---|---|---|
| Render | Runs the Chirpy server | Singapore |
| Neon | Database (accounts, messages) | Singapore |
| Upstash | Short-term data (rate limits, caches, sign-out records) | Singapore |
| Cloudflare | Domain, website, photo/video storage (R2), and relaying call audio when phones can't connect directly (encrypted; Cloudflare can't listen) | Asia-Pacific |
| Resend | Sending email codes | United States |
| Google sign-in, and delivering push notifications (Firebase Cloud Messaging). Notifications contain the sender's name and a preview of the message | Global | |
| Grafana Labs | Service health statistics (counts only, no personal data) | Singapore |
Some of these companies are outside your country, so your data may be transferred abroad. We only use providers that protect it.
How long we keep it
- Photos, videos and files: up to 16 MB, deleted from our storage 24 hours after everyone in the chat has received them, and after 7 days at most; larger ones 24 hours after they were sent. Copies stay on the phones that downloaded them.
- Messages: until you delete them (delete for everyone) or the account is deleted.
- Sign-in sessions: up to 30 days of inactivity.
- Email codes: 2 minutes.
- Server logs: a short time, as kept by our hosting provider.
- Reports: until handled, then 180 days.
- Call history: 180 days.
Deleting your account
Delete your account in the app under your profile settings. This removes your profile, picture, friends, push tokens and sessions immediately, and your photos and videos within the next cleanup (about an hour). Messages you sent stay in the other person's or the group's history, shown as coming from a deleted account. You can also email us to ask for deletion.
Your rights
You can see and correct your profile in the app, delete messages and your account, and turn off discovery and individual notification types. Depending on where you live (for example under Thailand's Personal Data Protection Act or the EU's GDPR) you may also have the right to get a copy of your data, object to processing, or complain to a data protection authority. To use these rights, email privacy@ponypigeon.com.
Children
Chirpy is not for children under 13 (or the minimum age for this kind of service where you live). If you believe a child has an account, tell us and we will delete it.
Changes
If we change this policy, we'll update the date above and, for important changes, tell you in the app.