Privacy and data

Account information and visibility

We process the gender and birth year provided at registration, account identifiers, profile preferences, nickname, friendships, friend notes, invitations, block lists, presence and the content you choose to send. Chat partners see gender and an approximate age derived from birth year; the birth year itself is not displayed. Friends can also see your nickname and presence information. Friend notes are visible only to the person who wrote them.

Time Square posts and comments do not display user nicknames. Internal account links still support delivery, moderation and abuse prevention. Sharing a friend invitation link allows its holder to add you and see your nickname; reset the link in your profile to invalidate the old one.

Check-ins and match-card records

To award cards and prevent duplicate claims, account records include the check-in time zone, latest check-in date, consecutive-day count, reward receipt and card balance. A card search also records the gender or age conditions selected for that search.

Operational records contain account associations for deduplicating check-ins, card issuance and consumption counts, search outcomes and preference categories for the most recent 90 UTC dates. They do not copy chat content. Card filters and balances are not shown to chat partners.

Credentials, browser storage and registration protection

The recovery code is stored as a verification value, not as a recoverable plain-text code. Anyone with the full code can sign in as you. Session cookies support signed-in access. Browser storage also remembers interface preferences; message-alert preferences stay in that browser and do not contain message text or room identifiers.

Registration protection uses a browser cookie and server-side validation records. A browser may successfully register up to two accounts within 24 hours; exceeding the limit starts a 24-hour registration cooldown. Concentrated registrations from an IP address are an operator reference, not a cooldown on the entire IP. This protection stores keyed digests of browser identifiers and IP addresses with recent timestamps, then clears expired records. Hosting and network services also process the connection information needed to make the site available.

Messages, encryption and review

Account and message business records are encrypted at rest. Pictures and voice messages are stored as private encrypted files. The server can decrypt data needed to provide the service and handle authorized reports; this is not end-to-end encryption.

Images are compressed and embedded photo metadata is removed before sending. A picture can still reveal faces, names, addresses or text within the image. Authorized moderators can view unexpired reported pictures and listen to unexpired reported voice messages.

AI clients you authorize

Connecting an AI client requires a separate authorization. Within the permissions you select, it may access account information and text from conversations you can access, including the other participant’s messages. That content may be sent to the client’s service provider and handled under its policies.

You can revoke a connection in your profile. Revocation stops further authorized access but cannot retrieve content that the external service already received. These AI tools do not provide access to recovery codes, pictures, voice messages or the administration area.

Content retention in the active service

Random-chat text messages are retained for up to 24 hours after sending; friend text messages for up to 90 days. Pictures and voice files expire 24 hours after sending in both kinds of conversation, including when they have been reported. A remaining message entry does not mean the original media file is still available.

Normal Time Square posts leave public display at their chosen expiry time, which may be extended by new comments. Posts and comments are retained for up to 24 hours from publication or the latest new comment. Administrators can mark a post for long-term display; that post and its comments remain until deletion or removal. Cleanup runs approximately every 30 seconds, so retention boundaries are not a guarantee of deletion at an exact second.

Square interaction notifications are retained for seven days, with at most the latest 200 per account. They do not copy the post or comment text and cannot recover expired content. Account profiles, friendships and other ongoing account information are not automatically deleted when a message expires.

Reports, feedback and operational records

Reporting creates separate text evidence for review. Resolved reports are retained for up to 90 days after resolution; unresolved cases remain until handled. Operational audit records are retained for up to 90 days. Reporting does not extend the lifetime of the original picture or voice file.

Feedback and replies are visible to the submitting account and the operator. Resolved feedback is retained for up to 90 days after resolution; pending feedback remains until handled. Deleting the account removes its feedback. Necessary anonymous account links and report evidence may remain independently of removed messages or a deleted account.

First-party analytics

First-party analytics records page types, device categories, source categories, interface language and counts of feature actions to help improve the service. It excludes conversation content, recovery codes and room identifiers. This collection is disabled when the browser enables Do Not Track or Global Privacy Control. Detailed analytics records are regularly cleared after 62 days and daily aggregates after 13 months.

Matching-quality measurements use the times, counts and results of successful server actions without retaining additional message text. Next-day return measurements depend on foreground activity reports; background polling does not count. Opting out of activity collection or a network interruption can leave those measurements incomplete. Browser privacy signals do not prevent processing necessary to deliver messages, maintain security or handle reports.

Deletion, backups and copies outside the service

Deleting an account removes its profile and sent content and ends friendships. The recovery code stops working. Necessary anonymous account links and report evidence follow their own retention rules above. Without a recovery code or a usable signed-in device, the service cannot establish account ownership.

Deleting live data does not immediately remove older backup copies. Business and database backups do not include the original chat image or voice files; restoring message records cannot restore expired or missing media. Operator-downloaded copies are not automatically removed by server cleanup.

Recipients may save, screenshot, record or forward what they receive. Deleting a message, closing a conversation, revoking AI access or allowing content to expire cannot remove another person’s or service’s copy. For privacy questions, use the channels described on the contact page.