Privacy Policy
Last updated: 27 September 2026
This policy explains which personal data ChatLink processes, why we do that, how long we keep it and what your rights are. We keep it as short and clear as we can.
In short: ChatLink is Dutch, and your data stays in the Netherlands. We built ChatLink so that your conversations don’t end up with big international tech companies or in other countries.
Who is responsible
ChatLink is responsible (the “controller”) for your personal data as described here. For questions or requests about your data, use the contact form on our support page.
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Account: email address, username and tag, password (stored only as a secure hash), date of birth | To create and secure your account, and to check you are 16 or older | Contract; legal obligation (age) |
| Profile: profile picture, bio, custom status | To show your profile to others | Contract |
| Content: messages, files and pictures, reactions, pinned messages, servers, channels, roles you create | To deliver them to the people you share them with | Contract |
| Online status: whether you’re online, on Do not disturb or offline (Invisible shows you as offline) | To show friends and people in your servers whether you’re reachable | Contract |
| Moderation in servers: bans (with the reason given), time-outs, and the log of what moderators do in a server | So server owners and moderators can keep their servers safe | Legitimate interest |
| Relationships and memberships: friends, blocks, servers you’re in | To make friends, DMs and servers work | Contract |
| Settings: notification settings, what you’ve read, muted servers | To make the app work the way you set it up | Contract |
| Push notifications (only if you turn them on): the push address of your device | To send you notifications when the app is closed | Consent |
| Technical data: IP address, browser or app version, login sessions, server logs | To keep you logged in, to protect the service against abuse and to fix problems | Legitimate interest (security) |
| Support requests and reports: what you send us through our forms, including your name and email if you give them. When you report something in the app: what you reported (a message, person or server), a copy of it as it was at that moment, and your account | To help you and to handle reports of illegal content and rule breaking | Legitimate interest; legal obligation (EU Digital Services Act) |
| Live chat: your messages to our support chat, and your name and email if you give them | To answer your question | Legitimate interest |
Voice and video calls are sent live through our own media server and are not recorded or stored. While you’re in a call, others in it can see that you’re there and whether your microphone or camera is on.
Push notifications are optional and can be switched off at any time. When they’re on, we send them through the push service of your browser or phone (Google, Apple, Mozilla or Microsoft, depending on your device). The content is end-to-end encrypted, so the push service can’t read it; it only sees that a notification goes to your device, and when.
We don’t sell your data, don’t show ads and don’t use tracking or analytics cookies.
Who can see what
- Other users see your username, tag, profile picture, status and bio, and the messages you send in servers and DMs you share with them. Your email address and date of birth are never shown to others.
- Friends and people in your servers see whether you’re online, unless you choose Invisible.
- Someone you block sees that you blocked them, and can’t send you messages, friend requests or calls.
- Server owners and moderators can manage the servers they run: remove, ban or time out members and delete messages there. What they do is kept in the server’s log, which moderators with that permission can see, including the reasons they gave.
- Our team sees what is reported to us. When someone reports your message, profile or server, a copy of it is saved with the report so we can review it, even if it’s deleted afterwards. The person who is reported never sees who reported them.
- Push services (only if you turn on push notifications) pass encrypted notifications on to your device, without being able to read them.
- Our hosting provider DualHosting, a Dutch company, stores the data on our behalf, on servers in the Netherlands that we rent from them. Nobody else gets your data, unless the law requires us to share it (for example an order from a court or the police).
Where your data is stored
All data is stored and processed on servers in the Netherlands that we rent from DualHosting, a Dutch hosting company. That’s a deliberate choice, and one of the reasons ChatLink exists:
- We don’t use the cloud services of big tech companies (such as Amazon, Google or Microsoft), and no analytics, advertising or tracking services.
- Voice and video calls go through our own media server, in the Netherlands too.
- Our website and apps load nothing from other companies: no external fonts, scripts or trackers.
- If we ever need another supplier, we choose one based in the Netherlands or the European Union, and we list it in this policy.
Only in two situations does something leave our servers, both because of how phones and browsers work, and both only when you choose it:
- Push notifications, if you turn them on, are delivered by the push service of your phone or browser (Apple, Google, Mozilla or Microsoft). They’re end-to-end encrypted, so those companies can’t read them; they only see that a notification goes to your device, and when. These services may be outside the EU.
- The Android app shows ChatLink through the browser on your phone (usually Chrome), just like opening ChatLink in a browser yourself. That browser follows its maker’s own privacy policy.
Cookies and local storage
We use one cookie: a login cookie that keeps you signed in. It is strictly necessary, so we don’t ask for consent. The app also saves a few preferences in your browser (like your voice settings), which never leave your device. If you use the live chat on our website, your browser remembers that conversation so you can pick it up again. No third-party cookies are used.
How long we keep it
- Your account is kept until you delete it, which you can do yourself in the app under Settings → My account → Delete account. When it’s deleted, we remove your email address, password, profile picture, bio and status, and delete the servers you own. Messages you sent in other servers and DMs stay, but are shown as “Deleted User” — delete them yourself first if you want them gone.
- Messages and files are kept until you or a moderator deletes them, or the server is deleted. Files you uploaded but never sent are deleted after one hour.
- Login sessions end after 30 days without use, or when you log out.
- Your online status is only kept while you’re connected.
- Bans and time-outs last until a moderator lifts them (a time-out also ends by itself), or until the server is deleted. A server’s moderation log is kept for 90 days.
- Server logs, which contain IP addresses, are kept for at most 14 days.
- Push addresses are deleted when you turn push notifications off, log out, or your login session ends.
- Support requests and reports are kept as long as needed to handle them and to meet our legal obligations, and then deleted.
- Live chats are deleted 90 days after the last message.
Security
All connections use encryption (HTTPS). Passwords are stored with a strong one-way hash, so nobody — not even we — can read them. Shared files are behind links that can’t be guessed. Access to our systems is limited and protected.
Your rights
You have the right to see your data, correct it, have it deleted, get a copy of it, limit how we use it and object to our use of it. Much of it you can do yourself in the app: change your username, profile, status and bio, download a copy of your data (Settings → My account → Download your data) and delete your account (Settings → My account → Delete account). For everything else, contact us through the support page — we reply within one month.
If you think we handle your data wrongly, please tell us first. You can also file a complaint with your data protection authority; in the Netherlands that’s the Autoriteit Persoonsgegevens.
Children
ChatLink is only for people aged 16 and up. If we learn that someone younger has an account, we delete it.
Changes
If we change this policy in a way that matters, we tell you in the app or by email before it applies. The date at the top shows the latest version.