What this stores, and what it does not.

Who this is about

ChatEasily is operated by Happy Life. Under India's Digital Personal Data Protection Act 2023 that makes them the data fiduciary for everything described below — the person responsible for it and the person to complain to.

There is no company, no sales team and no data-broker relationship behind this. It is a free product on free infrastructure, and the sections below are meant to be read as a description of how it works rather than as a disclaimer.

What is stored, and why

An identity. Everyone who joins gets an account, including people who never sign up: a guest account holds a display name you choose and nothing else — no email, no phone number, no contacts. If you later add an email address and a password, those are held by Supabase Auth, and the password is stored as a hash rather than as the password.

What you write. Messages, edits, replies, reactions, mentions and pins, kept so a room still says what was said in it when you come back. Photos and files you upload are stored as objects and are readable only by people who can read the room they were sent to. A GIF sent from the picker is stored as a link to Giphy rather than as an image.

Where you are a member. Which rooms you have joined, your role in each, who has muted or banned whom, and any words a room's admins have chosen to block. Room admins can see this for their own rooms; nobody can see it for rooms they are not in.

Who you follow and who you have blocked, so that both keep working across sessions.

A push subscription, only if you turn notifications on. That is an address your browser vendor issues along with the keys needed to encrypt a message to it. It is deleted when you turn notifications off, and it is the one piece of this that necessarily involves your browser vendor's servers.

Reports and feedback you send, including what you wrote and which room or message it was about. Reports are visible to moderators, which is the point of them.

Failed sign-in attempts, briefly, so somebody cannot guess a password by trying repeatedly. These rows are deleted after a day.

Rooms that publish themselves

A room can be set to publish its conversation, which puts it in the public directory and makes what is said in it readable by anyone, including search engines. This is off by default, it applies only from the moment it is switched on, and it can be withdrawn.

It is worth reading that sentence twice before switching it on, because withdrawing a room from the directory does not retrieve what a search engine already copied.

There is no end-to-end encryption

Traffic to and from this site is encrypted in transit, and messages are protected in the database by row-level security so that only members of a room can read them. But they are not end-to-end encrypted: they exist in a readable form on the server, which means the operator, and the database host, are technically able to read them.

This is stated plainly rather than buried because it is the one thing that should decide whether a conversation belongs here. If it needs end-to-end encryption, use a tool that offers it.

Who else handles it

Supabase hosts the database, the file storage and the authentication. Vercel hosts and serves the site, and provides Vercel Web Analytics, which counts page views without a cross-site identifier.

Google Analytics is used, where it is configured, to count visits and how many rooms get created. It sets its own cookies and receives your IP address; the property is configured for measurement rather than advertising.

Resend delivers email, which today means the daily digest and account emails such as a password reset. Giphy receives your search terms when you use the GIF picker, and nothing else. Your browser vendor's push service receives an encrypted notification payload when one is sent to you.

The database and uploaded files are held in India. Several of the services named above are operated from outside India and process data there in the course of delivering the site to you.

How long it is kept

Messages and uploads stay for as long as the room does. When a room is deleted it is removed from view immediately and purged, with its attachments, by a job that runs the following day. An upload that never became a message is swept away daily. Sign-in throttling rows are deleted after a day.

A room that empties out removes itself. Everything else persists until you ask for it to be removed.

Your rights, and how to use them

Under the DPDP Act 2023 you can ask what is held about you, ask for it to be corrected, ask for it to be erased, and complain about how any of it was handled. All four go through the contact form, and there is no account setting that does any of them today — a request to a person is currently the whole mechanism, which is stated here rather than implied.

Erasure has one limit worth knowing before you ask. Messages you sent to a room were also read by the other people in it, and removing your account does not un-say them; what can be removed is your account, your identity on those messages, your uploads, your subscriptions and your social graph.

Cookies

A session cookie from Supabase Auth keeps you signed in; without it the site cannot tell one person from another and nothing works. A cookie lasting one minute is set when you create a room, purely so that the creation can be counted once, and it is deleted as soon as it is read.

Vercel Web Analytics sets no cross-site identifier. Google Analytics, where configured, sets its own cookies.

Children

This service is not directed at children, and it is not built to obtain the verifiable parental consent the DPDP Act 2023 requires before processing a child's personal data. If you believe a child's data is held here, say so through the contact form and it will be removed.

Changes

This page carries the date it last changed, and that date is also published in the site's sitemap. Material changes will be described here rather than made quietly.

Getting in touch

Every request or complaint described above goes through the contact form. It reaches the same person either way, and it is the only channel published for this purpose.