Privacy Policy

1. Who is responsible for your data

The data controller is TalkKiwi (“we”, “us”). You can reach us about privacy at [email protected].

This policy explains how we handle personal data when you use TalkKiwi at talkkiwi.com and its web app (the “Service”). The Service is only for adults aged 18 or older. We do not knowingly collect data from anyone under 18.

2. What we collect

From everyone, including guests

• Technical data: IP address, approximate country derived from it, browser and device type, and the time of your visits.
• Guest ID: a random identifier stored in a cookie so we can apply limits and bans to your browser.
• Device identifier: a hashed fingerprint of your browser used only to stop banned users from coming back.
• Chat preferences: chat mode, interests, language, country and gender filters and similar settings you choose.
• Chat content: the text messages, GIFs and reactions you send. Video and audio are not stored (see section 3).
• Safety data: reports you make or that others make about you, trust and abuse signals, human-check results and moderation decisions.
• Your 18+ confirmation, and any review of your account if someone reports you as possibly under 18.

If you create an account

• From your sign-in provider: email address, name and profile picture from Google or Discord. Your email and provider name are never shown to other users.
• Profile: username, display name, birth year, gender, country, languages, interests, bio and photo. Your birth year is used to confirm you are 18+ and is never shown; your age may be shown only if you choose.
• Social data: friends, friend requests, blocks, messages between friends, call history signals, notifications and badges.
• Notifications: if you turn on push notifications, a push subscription address provided by your browser.

Contact and appeals

If you email us or submit an appeal, we keep your message, email address and any details you provide.

3. Video and voice calls

Video and voice calls are never recorded by us. They connect directly between your device and your partner’s device (peer to peer) using WebRTC. This means your partner’s browser can technically see your IP address, which can reveal your approximate location. If a direct connection fails, the encrypted stream is relayed through a TURN relay server operated for us by Cloudflare, which forwards it without storing it.

For safety, the following may happen during video chats:

• An on-device check in your own browser may blur a stranger’s video if it looks like nudity. These images never leave your device.
• Where enabled, a small number of low-resolution still frames from your camera may be sent to our moderation provider for automated checks and then discarded, unless they show a likely violation.
• If someone reports you during a video chat, a few recent frames from that chat are attached to the report.

Processing that stays on your device

Some features run entirely in your browser and send nothing to us: the nudity blur, face masks and filters (which find points on your face to place a mask), noise and echo reduction, and the list of cameras and microphones you can choose from. We do not use facial recognition, we do not create face templates or other biometric identifiers, and we do not store any face geometry.

Sensitive information

We do not ask for sensitive information such as health, religion, sexual orientation, political opinions or ethnicity. However, your camera, voice, messages and profile may reveal such details. Please think carefully before sharing them. If you do, we process them only to provide and moderate the Service.

4. Why we use your data, and our legal bases

We use automated tools to detect abuse. Automated systems may disconnect a chat or temporarily restrict an account. Serious or permanent decisions are reviewed by a person, and you can always appeal.

5. Who we share data with

• Other users see only what you choose to show: your messages, camera and microphone during a chat, and your public profile (display name, username, photo, country, languages, badges and bio). Guests appear as “Stranger”.
• Service providers who process data for us under contract (listed below).
• Authorities: we report apparent child sexual abuse material to NCMEC, and we share data with law enforcement when the law requires it or when we believe someone’s life or safety is at risk. See our law enforcement guidelines.
• Advisers and successors: our lawyers and auditors, or a buyer of our business, under confidentiality.

We do not sell your personal data and we do not share it for cross-context behavioural advertising without your consent.

Our service providers

6. International transfers

Some of our providers are located outside your country, including in the United States. Where data leaves the EU, EEA or UK, we rely on adequacy decisions (such as the EU-US Data Privacy Framework for certified providers) or Standard Contractual Clauses with extra safeguards where needed.

7. How long we keep data

When a period ends, the data is deleted automatically or made anonymous.

8. Your rights

Depending on where you live, you have the right to:

• access your data and get a copy in a portable format;
• correct inaccurate data;
• delete your data;
• restrict or object to processing based on legitimate interests;
• withdraw consent at any time, without affecting earlier processing;
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects, and to ask for human review;
• complain to your data protection authority (for example, in your EU country, the UK Information Commissioner’s Office, or your state attorney general in the US).

Signed-in users can download and delete their data in Settings. For anything else, email [email protected]. We reply within one month. We may need to confirm your identity first. Guests should include their ban ID or the approximate date and time of the chat, as we cannot otherwise link guest data to a person.

Some data may be kept after a deletion request where we must keep it, such as ban records needed to stop ban evasion, data in an open report or appeal, or data preserved for law enforcement.

US state privacy rights

If you live in California or another US state with a consumer privacy law, you have the rights to know, access, correct and delete your data, and to opt out of “sale” or “sharing” for targeted advertising. We do not sell personal data. You can opt out of ad personalisation in our cookie settings, and we honour Global Privacy Control signals. We will not discriminate against you for using these rights.

Notice at collection (California)

In the last 12 months we have collected these categories of personal information, for the purposes described in section 4:

• Identifiers: IP address, guest ID, device identifier, account ID, email and username.
• Personal characteristics: birth year, gender, country and languages you provide.
• Internet activity: how you use the Service, chats you start, reports and moderation history.
• Approximate geolocation: country derived from your IP address. We do not collect precise location.
• Audio and visual information: video and audio are streamed live and not recorded; a few frames may be kept in reports.
• Inferences: trust and abuse signals used for safety.

We do not use sensitive personal information to infer characteristics about you, and we do not knowingly sell or share the personal information of anyone under 18. Retention periods are listed in section 7.

9. Security

We use encryption in transit (HTTPS and encrypted WebRTC), access controls, signed cookies, hashing of device identifiers and limited staff access. No service is completely secure. If a breach affects your data, we will notify you and the authorities as the law requires. To report a security vulnerability, email [email protected] with the subject “Security”. Please give us reasonable time to fix it before telling anyone else.

10. Children

The Service is not for anyone under 18. If we learn that a user is under 18, we close their access and delete their data, except where we must keep it to protect the child or report to authorities. Parents or guardians can ask us to delete a child’s data. If you believe a minor is using the Service, contact [email protected]. See our Child Safety Policy.

11. Cookies

We use essential cookies and local storage to run the Service, and advertising cookies only with consent where required. Details are in our Cookie Policy.

12. Changes

We will update this policy when our practices change. For material changes, we will notify you on the Service before they take effect. The date at the top shows the latest version.