Privacy policy

business 1. Data controller

The data controller for the processing of your personal data in connection with ChatGuard is the legal entity that operates the service ("we", "ChatGuard").

• Contact for privacy questions: privacy@chatguard.io
• General legal questions: legal@chatguard.io

This policy describes how we process personal data when you use our website, web app (PWA) and related services. It complements our terms of use.

forum 2. Chat, history and media

ChatGuard processes chat content, attachments and chat metadata for the service to work. Messages, replies, reactions, read receipts, file tabs, conversation search, unread counters, archived conversations and moderation features require certain information to be stored for as long as it's needed according to this policy.

What it means in practice

• messages and metadata may be shown in conversation history and search for participants with access;
• attachments are stored technically so they can be downloaded, previewed, deleted or managed according to storage quotas;
• admins or moderators may get access to reported or relevant content when needed for security, support, operations or compliance with the terms;
• recipients can save content locally themselves (e.g. a screenshot) — that's beyond our control;
• view-once images (snaps) and similar temporary content are deleted after viewing or when the timer expires.

Temporary and live features

Snaps, voice channels and voice calls have special limitations. Snaps can be time- or view-limited in the service. Voice calls and voice channels are not recorded by ChatGuard, but call metadata, participant status and signaling data may be processed temporarily to connect participants and troubleshoot the feature.

Accounts, groups and security

Account-related information, profile, settings, group and channel metadata, memberships, friend relationships, notifications, reports, uploads, AI data and technical security logs are processed according to section 3 below.

inventory_2 3. What personal data we process

We process personal data that is necessary to provide, customize, troubleshoot and secure the service:

Account details

• username, display name and profile information;
• e-postadress;
• password (stored in encrypted/hashed form — we never store plain-text passwords);
• time-limited tokens for email verification, password reset and email codes at sign-in;
• profile picture and profile settings (e.g. visibility, theme, layout);
• security questions/answers where the feature is used, remembered devices and session data;
• VIP status, role, permissions and related quotas.

Chat and communication

• message text, replies, edits, deletion status, reactions and read receipts;
• which conversations, groups, text channels and voice channels you belong to;
• last read, unread status, archiving, pinning, mute, mentions-only and notification preferences;
• attachments, file names, file types, sizes, storage references and download/view metadata;
• snaps, timers, view receipts and deletion status;
• voice-call-related metadata (e.g. that a call was initiated) — audio content is not recorded;
• information you voluntarily attach to a report about abuse (see moderation below).

Don't share sensitive personal data, passwords, tokens, private keys, card details or security answers in chats, attachments or the AI chat.

Social and group-related data

• friend requests and friend lists;
• group memberships, group roles, channel permissions, invite links and group information;
• profile comments, reactions and activity you choose to publish;
• blocks and restrictions between users.

ChatGuard AI

• AI questions, AI answers and conversation metadata in the AI DM;
• daily AI usage, role-based quotas and operating policy;
• safe account context such as role, status or remaining AI quota when the feature is enabled and relevant;
• voluntary AI memory or local AI settings if you use such features.

Moderation and security

• reports about content or users;
• moderation actions, warnings and suspensions;
• admin notes, role and permission changes where used;
• logs of suspected abuse, rate limits or security incidents.

Technical and usage data

• IP address and approximate geographic location (derived from the IP);
• browser type, device type and operating system;
• session tokens and sign-in history;
• push notification subscriptions (when enabled);
• storage and bandwidth usage for pages, attachments, images, music and other media;
• music library, playlists, favorites and recent plays if the music feature is used;
• error reports and performance data to troubleshoot the service.

input 4. Where the data comes from

Personal data is collected from the following sources:

• from you — at registration, profile editing and in settings;
• automatiskt — technical logs, cookies and similar when using the service;
• from other users — e.g. friend requests, group invitations and reports;
• in chat and media — messages, attachments, metadata, read status, reactions and similar are created when you use the service;
• from third parties — only if you explicitly connect or use such functionality, e.g. the browser's push service, email delivery or AI features.

track_changes 5. Purposes and legal basis (GDPR Art. 6)

We process personal data for the purposes below. The legal basis is given in parentheses.

Providing the service

Create and administer accounts, enable chat, conversation history, groups, channels, files, profiles, friends, notifications, voice features, snaps, music and PWA features. (Contract — Art. 6.1 b)

Security and abuse prevention

Authentication, session handling, detection of unauthorized access, spam and fraud. (Legitimate interest — Art. 6.1 f; in some cases legal obligation — Art. 6.1 c)

Moderation and legal compliance

Review reports, enforce the terms of use, respond to requests from authorities. (Legitimate interest / legal obligation)

Communication with you

Service messages, security warnings, support replies and significant updates to the terms or policy. (Contract / legitimate interest)

Push notifications

Send notifications about new chat activity (e.g. that you've received a message) without including message content, when you've actively enabled the feature. (Consent — Art. 6.1 a)

ChatGuard AI

Provide the AI DM, reply suggestions, ChatGuard knowledge, safe account context, quotas, stats and voluntary AI memory where the feature is enabled. (Contract / legitimate interest; consent where memory or voluntary extra context requires it)

Improvement and development

Analysis of usage in aggregated or pseudonymized form to improve performance and features. (Legitimate interest)

VIP and payment-related services

Manage VIP status and any payments. (Contract / legal obligation for bookkeeping)

You can withdraw the consent the processing is based on at any time, without affecting the lawfulness of processing before the withdrawal.

schedule 6. How long we keep data

We keep personal data only as long as needed for the purposes above, or as long as the law requires:

• Chat messages and conversation metadata — as long as the account, conversation or group is active and the data is needed for history, search, notifications, security or moderation.
• Attachments and media — as long as they're needed for the service, until they're deleted, or as long as storage/moderation rules require.
• Snaps — according to the timer, viewing rules and technical deletion routines for the feature, with limited metadata for view receipts and security.
• AI-data — according to settings, quotas and operating policy; voluntary AI memory is kept until it's removed or disabled.
• Account details — as long as the account is active; deleted or anonymized within a reasonable time after account deletion, unless the law requires longer storage.
• Moderation and security logs — normally up to 24 months, longer during an ongoing investigation or legal claim.
• Technical logs — normally up to 12 months.
• Accounting records — according to the Swedish Bookkeeping Act (normally 7 years) if payments occur.

When the retention period has expired, the data is deleted or anonymized securely.

share 7. Recipients, sharing and transfer

Other users

Profile information you choose to show is visible according to your settings. Chat messages, attachments, reactions, read receipts and other conversation information are shared with the relevant recipients and participants according to permissions, group membership and conversation settings.

Suppliers (data processors)

We may use trusted suppliers for hosting, storage, email, push notifications, AI features, security monitoring, error reporting and similar. They process data only according to our instructions and under data processing agreements where the GDPR requires it.

Authorities

We may disclose data when we're obliged to by law, a court decision or to protect rights, safety and property.

Transfers outside the EU/EEA

We strive to process data within the EU/EEA. If data is transferred to a third country, we use appropriate safeguards under GDPR Chapter V, e.g. the European Commission's standard contractual clauses or adequacy decisions.

We don't sell your personal data to third parties for marketing.

smart_toy 8. Automated decision-making and profiling

We use automated systems to a limited extent for spam filters, security detection, AI answers, reply suggestions and moderation support. These systems don't alone make binding decisions with legal effect or similarly significant effect on you without human review for significant actions (e.g. permanent suspension).

ChatGuard AI generates answers based on your question, available context and the system's settings. We don't perform profiling for marketing purposes based on your chats.

cookie 9. Cookies and similar technology

ChatGuard uses cookies and local storage (e.g. localStorage, IndexedDB) for the service to work:

• Necessary — session handling, sign-in, security (CSRF protection), PWA cache. These are required for the core functionality.
• Functional — e.g. theme, language, layout, PWA status, chat drafts, filters or other preferences you save.
• Analytical — only if enabled; helps us understand usage in aggregated form.

You can block cookies in the browser, but some features may then stop working correctly. Session cookies are normally deleted when you sign out or when the session expires.

notifications 10. Push notifications and PWA

If you install ChatGuard as a PWA and enable push notifications, we process a subscription token provided by your browser or device. The token is stored so we can notify you about new activity. Notifications may be limited, muted or hide previews depending on your conversation and privacy settings.

You can turn off notifications at any time in the device's or browser's settings, or in ChatGuard if the feature exists there. Email notifications can be controlled separately when the feature is enabled. Withdrawing consent stops future push notifications.

lock 11. Security

We take technical and organizational measures to protect personal data, including:

• encryption in transit (HTTPS/TLS);
• secure hashing of passwords;
• access control and the principle of least privilege for staff;
• regular security updates and monitoring;
• storage quotas, rate limits and checks against abuse;
• backups and recovery routines.

No method is 100% secure. If we discover a personal data breach that poses a risk to your rights, we'll inform you and the Swedish Authority for Privacy Protection (IMY) when required under GDPR Art. 33–34.

You play an important role: use a strong unique password, sign out on shared devices and report suspicious activity.

gavel 12. Your rights under the GDPR

You have the following rights to the extent they apply to our processing:

• Right to information — this policy and supplementary information at collection.
• Right of access — request a copy of the personal data we process about you (Art. 15).
• Right to rectification — correct inaccurate or incomplete data (Art. 16).
• Right to erasure — "the right to be forgotten" under certain conditions (Art. 17).
• Right to restriction — restrict processing under certain circumstances (Art. 18).
• Right to data portability — get data in a structured format where processing is based on contract or consent (Art. 20).
• Right to object — to processing based on legitimate interest (Art. 21).
• Right to withdraw consent — when processing is based on consent, without affecting earlier lawful processing.

To exercise your rights, contact privacy@chatguard.io. We may need to verify your identity before we disclose data. We normally respond within one month.

You can request deletion of your account, profile, chat data and other information we process. Some data may need to be kept for a limited time for security, moderation, backup, legal requirements or so that other users' conversations and reports remain understandable.

report 13. Complaints to the supervisory authority

If you believe we process your personal data in violation of the GDPR, you have the right to file a complaint with:

• Swedish Authority for Privacy Protection (IMY)
  Box 8114, 104 20 Stockholm, Sweden
  www.imy.se

We appreciate it if you contact us first so we can try to resolve the issue, but you always have the right to turn directly to IMY.

child_care 14. Children and young people

ChatGuard is not intended for children under 13. We don't knowingly collect personal data from children under this age. If you're a parent or guardian and believe your child has registered, contact us and we'll help delete the account.

Users between 13 and 18 should use the service with a guardian's knowledge where required by national law.

edit_note 15. Changes to the policy

We may update this privacy policy when our processing or the law changes. Significant changes are announced via the service or email. The date of the latest version is shown at the top of the page.

We recommend that you read the policy regularly.

mail 16. Contact

Questions about privacy and personal data:

• Email: privacy@chatguard.io
• Terms of service: chatguard.io/terms

We handle requests promptly and within the time limits set by the GDPR.