Privacy, safety & terms

Privacy notice

Your account. A pseudonym is enough. The server keeps your account identifier, password hash, sign-in sessions, profile choices and privacy preferences. Guest chat is available without a password. A private browser cookie restores your guest identity for up to 90 days. Chat history, invitations and safety settings are stored on this server so both participants can return. Clearing site data or closing a private window can remove your access while the server still holds the conversation. Choosing Keep my chats adds sign-in credentials to the same profile. Signing in to an existing account keeps the browser’s guest profile separate. Your chosen name, bio, interests, decorations and any badge can identify you to the people you share them with.

Invitations and messages. A person holding an unused invitation can see its preview and join if eligible. Share it with its intended recipient. A used invitation cannot reopen a conversation. The server keeps messages, timestamps and conversation settings so the participants can return. Your partner can copy what you send. The server can read stored messages. Someone with access to the host computer or its database could also read them.

Relationships and gifts. Mutual participation, saved memories and membership choices belong to the relevant accounts or conversation. Simulated gift records identify the sender, recipient, tier and lifecycle. Gifting involves no payment processor, payment account or card data.

Reply alerts. If you enable browser notifications, we keep an encrypted device subscription linked to your session. Your browser’s push provider delivers a generic alert. Names and message text are excluded. Turn alerts off in Profile settings or mute a conversation in Chat settings.

Safety. Blocking needs a record of which accounts should be kept apart. A report or request for help gives the administrator the account or message concerned and the information needed to review it. Reporting a selected message stores a short excerpt for review. Optional report and support text is visible to the administrator. Share only what is needed. The administrator can see who sent a report.

Where information goes. Vercel serves this website and processes requests, including IP addresses. Supabase stores account records, private conversations, reports and encrypted verification evidence in the Emberhello database in Frankfurt, Germany. The standalone SQLite edition stores its records on the computer running it.

Controller details. The site administrator can be reached at contact@emberhello.com, including if you cannot access your account.

Why information is used

Optional verification uses your evidence solely to assess the checks you select. Participation is voluntary. You can withdraw a pending request or remove an approved badge in Verification settings.

Optional verification

When submissions are open, a signed-in member can request an age check (18+), a photo ID check, or both. The form asks for a passport, photocard driving licence or national identity card and a recent selfie with a handwritten code. Cover addresses, document numbers and machine-readable strips. Keep the portrait and information needed for the selected checks readable.

The sole administrator compares your photos manually. There is no external identity-verification provider, automated face matching or biometric template. The code helps the reviewer assess freshness. A badge cannot establish liveness or guarantee future account ownership or conduct.

You preview both photos on your device before submission. The server validates and re-encodes them, discards embedded metadata and encrypts both with a key unique to your request. On the hosted service, the key is protected by a separate evidence secret outside the database. Viewing requires an authenticated administrator and a short-lived, single-use grant for each image. Only the badge appears to other users.

During review, the administrator should record only the decision and a short reason. For concerns about a decision or suspected account takeover, contact the administrator. See the retention schedule

How long information stays

• Photo ID and selfie. The default review window is 72 hours. An operator can configure a window of 1 to 168 hours. See the deadline on your request. The service removes the active encrypted images, their protected key and outstanding access links when the request is decided, withdrawn or expires. On the hosted site a scheduled database job checks for expiry every minute. A database outage can delay cleanup.
• Verification outcome. The service keeps the category, status and minimal review metadata to support the badge, its removal and later review. Removing a badge stops public display. Closed requests without an active approval are purged after 90 days. Account deletion removes the account-linked verification record. Pseudonymous review audit entries expire separately.
• Review audit and closed safety reports. Review audit entries expire 90 days after the event. Closed safety and support cases have a 90-day retention target from closure. Active reports stay available for investigation. They need a regular review for necessity.
• Profile, messages and connections. These persist between visits. You can edit your profile, delete your messages and delete your account. Closing, muting or archiving a conversation is separate from deleting the underlying records.
• Invitations, sessions and gifts. Invitations stop working after use, rejection, revocation or expiry. Guest access cookies expire 90 days after creation. Member sessions expire after seven days and administrative sessions after 30 minutes, or earlier on invalidation. Test gift history supports decisions about entitlements and renewals. A record can remain in the database after it stops granting access.

Removing active evidence does not prove erasure from operating-system storage, restore points, copied files, recipients' devices or operator backups. There is no verified maximum timeline for those copies across all infrastructure providers. Before live intake, the operator must set and test a maximum retention period for every backup and replica, and demonstrate that restoring a backup does not restore access to deleted evidence.

Your data and your choices

Use account settings to correct your profile, change your password and privacy preferences, export your data or delete your account. Deleting the account removes its conversations for both participants and removes reports involving the deleted account. Export the data you need before deletion and protect the downloaded file. Other people may already have copied messages. An account export is one way to get a copy of your information. You may also ask the operator for access, correction, erasure, restriction, portability or to object where the right applies.

For help, use Contact the administrator and give a brief description of the request. Keep your password and identity documents private. For optional verification, withdraw from the request or ask to remove the badge. You can also email contact@emberhello.com without signing in.

A rights request ordinarily requires a response within one calendar month. You may raise a privacy complaint with the operator and complain to the UK Information Commissioner's Office. Under the UK complaints procedure the controller must acknowledge a complaint within 30 days and investigate, keep you informed and provide an outcome without undue delay. Contact the ICO

Community and safety

Send an invitation once and respect a decline or silence. Check that flirting is welcome and stop when asked. A gift never buys attention, a reply, private information or intimacy. Keep someone else's nickname, profile and messages private unless they agree to sharing.

Harassment, stalking, impersonation, scams, coercion, threats, hate, sexual exploitation, pornography and sexual content involving children are prohibited. Never evade a block or ask someone to prove their age by sending an ID in chat.

Use the safety actions in the conversation to block an account, report a person or report a particular message. Block to stop further contact through that account. Report to ask the administrator to review an incident. You can also revoke an unused invitation. A report is reviewed separately from identity evidence. The administrator should share only the information needed to handle it.

For a moderation complaint or appeal, email contact@emberhello.com or use in-app support. Identify the decision and explain what you would like reviewed. Gift status and badges do not affect decisions. The prototype has no emergency response service or guaranteed review time.

Terms for using the prototype

Use a fictional pseudonym, a unique test password and accounts you control or have permission to use. Only send invitations to willing recipients. Follow the community rules and respect the other participant's choice to leave. Attempts to access another account, bypass a block, collect identity evidence or interfere with the service are prohibited.

Membership prices, purchases, renewals and receipts are simulations. No money changes hands. The sender manages renewal, the recipient chooses whether to accept, and accepting creates no payment obligation. Perks have no cash value and cannot be sold or transferred.

This prototype is available for evaluation at emberhello.com. Contact contact@emberhello.com about the service or these terms.