Privacy Policy

ChatinChat is operated by Soham Tripathy (“we”, “us”) as an individual, at chatinchat.store. It is a small personal project, not a company.

Your conversations are sent to OpenAI so that the AI can reply. Other than that, nothing you write leaves this site — there are no analytics, no advertising, no trackers, and nothing is sold or shared.

Only what the site needs to work:

• —Your account — the username you choose, the name you asked to be called, and your password. The password is stored only as an argon2 hash; we cannot read it, and neither could anyone who obtained the database.
• —What you write — your messages, the AI’s replies, your conversation titles, and the passages you highlight to ask about.
• —Your IP address — recorded briefly when you create an account or fail to sign in, to stop automated abuse. Deleted after two days.
• —Server logs — ordinary web server records of requests, kept on a small rolling buffer and overwritten as new ones arrive.
• —One cookie — it keeps you signed in and nothing else. It cannot be read by JavaScript, is not used for tracking, and expires after 30 days.

The AI replies are generated by OpenAI, so your messages have to be sent there. Specifically, when you ask something we send your question, the earlier messages in that conversation, and — for a note anchored to highlighted text — the passage you highlighted and the reply it came from.

We do not send your username, your name, your email or your IP address. OpenAI’s handling of that data is governed by their own privacy policy and API terms.

• —No analytics or tracking of any kind.
• —No advertising, and no advertising networks.
• —No selling, renting or sharing your data.
• —No third-party scripts. Even the fonts are served from this site rather than fetched from Google.
• —No reading of your conversations, except where you specifically ask for help with a problem.

• —Your account and conversations: until you delete them, or ask us to delete your account.
• —IP records used for abuse prevention: two days.
• —Server logs: a rolling buffer, typically a few days.
• —Backups: up to 180 days. This matters, so it is worth being plain about — when you delete something it disappears from the site immediately, but encrypted backups taken before that may still contain it for up to six months. Those backups are only ever opened to recover from a disaster.

• —Everything travels over HTTPS.
• —Passwords are hashed with argon2, never stored in a readable form.
• —The database is not reachable from the internet at all — only the application can talk to it.
• —Backups are encrypted on our server before they are uploaded, so the storage provider only ever holds unreadable data.

No system is perfectly secure, and this one is run by one person. If you would not want something to be exposed in the worst case, please don’t type it here.

You can, at any time:

• —Delete any conversation or note — it is removed from the live site straight away.
• —Ask us to delete your account and everything in it, by emailing the address below. We will do it within 30 days, and confirm when it is done.
• —Ask for a copy of what we hold about you.

ChatinChat is not intended for anyone under 18, and accounts should not be created by under-18s. If we learn that an account belongs to a child, we will delete it.

If this policy changes in a way that affects you, the date at the top will change and the change will be noted on the sign-in page. Carrying on using the site after that means accepting the updated policy.