What this stores, and what it does not.

Who this is about

ChatEasily is operated by Happy Life. Under India's Digital Personal Data Protection Act 2023 that makes them the data fiduciary for everything described below — the person responsible for it and the person to complain to.

There is no company, no sales team and no data-broker relationship behind this. It is a free product on free infrastructure, and the sections below are meant to be read as a description of how it works rather than as a disclaimer.

What is stored, and why

An identity. Everyone who joins gets an account, including people who never sign up: a guest account holds a display name you choose and nothing else — no email, no phone number, no contacts. If you later add an email address and a password, those are held by Supabase Auth, and the password is stored as a hash rather than as the password.

What you write. Messages, edits, replies, reactions, mentions and pins, kept so a room still says what was said in it when you come back. Photos and files you upload are stored as objects and are readable only by people who can read the room they were sent to. A GIF sent from the picker is stored as a link to Giphy rather than as an image.

Where you are a member. Which rooms you have joined and your role in each. Room admins can see this for their own rooms; nobody can see it for rooms they are not in.

Who you have blocked, so that it keeps working across sessions.

Feedback you send through the contact form, including what you wrote and which page it concerned.

Failed sign-in attempts, briefly, so somebody cannot guess a password by trying repeatedly. These rows are deleted after a day.

There is no end-to-end encryption

Traffic to and from this site is encrypted in transit, and messages are protected in the database by row-level security so that only members of a room can read them. But they are not end-to-end encrypted: they exist in a readable form on the server, which means the operator, and the database host, are technically able to read them.

This is stated plainly rather than buried because it is the one thing that should decide whether a conversation belongs here. If it needs end-to-end encryption, use a tool that offers it.

Who else handles it

Supabase hosts the database, the file storage and the authentication. Vercel hosts and serves the site, and provides Vercel Web Analytics, which counts page views without a cross-site identifier.

Google Analytics is used, where it is configured, to count visits and how many rooms get created. It sets its own cookies and receives your IP address; the property is configured for measurement rather than advertising.

Resend delivers email, which today means account emails such as a password reset. Giphy receives your search terms when you use the GIF picker, and nothing else.

The database and uploaded files are held in India. Several of the services named above are operated from outside India and process data there in the course of delivering the site to you.

How long it is kept

Messages and uploads stay for as long as the room does. When a room is deleted it is removed from view immediately and purged, with its attachments, by a job that runs the following day. An upload that never became a message is swept away daily. Sign-in throttling rows are deleted after a day.

A room that empties out removes itself. Everything else persists until you ask for it to be removed.

Your rights, and how to use them

Under the DPDP Act 2023 you can ask what is held about you, ask for it to be corrected, ask for it to be erased, and complain about how any of it was handled. Erasure you can do yourself, immediately, from your profile settings — it does not go through us and it is not a request anybody has to grant. The other three go through the contact form and are handled by a person, which is stated here rather than implied.

Erasure has one limit worth knowing before you ask. Messages you sent to a room were also read by the other people in it, and removing your account does not un-say them; what can be removed is your account, your identity on those messages, your uploads, and who you have blocked.

Cookies

A session cookie from Supabase Auth keeps you signed in; without it the site cannot tell one person from another and nothing works. A cookie lasting one minute is set when you create a room, purely so that the creation can be counted once, and it is deleted as soon as it is read.

Vercel Web Analytics sets no cross-site identifier. Google Analytics, where configured, sets its own cookies.

Children

ChatEasily is for people aged 18 and over. The DPDP Act 2023 treats anyone under 18 as a child and requires verifiable parental consent before a child's personal data may be processed; this service is not built to obtain that consent, which is why it is not for under-18s at all rather than for them with a parent's permission.

Every path that creates an account asks you to confirm you are 18 or older, and the date you confirmed is stored against your account. That is the whole of it: no date of birth, no age, no check against any register. It records that the question was asked and answered, and it is what lets an account that answers otherwise be refused.

If you believe a child's data is held here, say so through the contact form and it will be removed.

Changes

This page carries the date it last changed. Material changes will be described here rather than made quietly.

Getting in touch

Every request or complaint described above goes through the contact form. It reaches the same person either way, and it is the only channel published for this purpose.