Privacy Policy

Who we are

This policy applies to the Hoplo website at gohoplo.com and its chat ("Hoplo", "we", "us"), which decides how and why your personal data is processed.

For any question about this policy or your data, write to the address below.

[email protected]

Data we collect when you use the chat

You do not need to give us your name or e-mail address to chat. When you open the chat, we collect:

• An anonymous identifier: a random token we create on your first visit and keep in a cookie and in your browser's storage. It lets us recognise your browser between visits.
• Your internet (IP) address, and data derived from it: country, the network operator and its autonomous system number (ASN), and whether the address belongs to a VPN, a data centre or the Tor network. The country is looked up in a database stored on our own server; no address is sent to an outside service for this. If your browser's time zone and languages point to another country, we may use that country instead.
• A browser and device fingerprint: characteristics of your browser and device, such as how it draws graphics and processes sound, the graphics card, fonts, screen, operating system, number of processor cores, memory, time zone and languages, and, after you allow camera access, the names and number of your cameras and microphones. We use it to recognise a browser after cookies are cleared, mainly to enforce bans.
• Your browser's user agent string, languages and time zone.
• The external address your browser reports through WebRTC. We receive it when a video connection is set up and, if your address belongs to a VPN or data centre or all video is relayed, from a short WebRTC request to our server when you connect, also in text-only mode. If you use a VPN, this may be your real address. We use it to estimate your country and to detect attempts to get around a ban.
• What you tell us in the chat settings: your gender, your filters, the mode you choose (video or text) and your confirmation that you are 18 or older and accept the rules. Your gender is never shown to your partner; it is used for other users' filters and compared with partners' reports and automatic estimates. If they repeatedly contradict it, your gender is marked as disputed: for 24 hours you are not matched with people who filter by gender, your trust score goes down, and repeated disputes can lead to a ban.
• How you use the chat: when you connect and disconnect, who you were matched with, for how long, in which mode, whether the video went through our relay, and why the chat ended. We also keep a trust score: an internal rating that goes down with reports and violations and up with normal use, and affects checks and moderation thresholds.
• Technical records about errors in your browser and the quality of video connections, with your anonymous identifier and user agent but without IP addresses or message texts.

Video, voice and messages

Video and audio go directly between your browser and your partner's browser whenever possible, or through our relay servers when a direct connection is not possible. Unless we route all video through our relay (a setting we can switch on for everyone), your partner's browser receives your IP address while the connection is set up, even if the video then goes through the relay. When all video is relayed, your partner sees only the address of the relay. WebRTC encrypts audio and video in transit, and we do not record them on our servers.

Text messages pass through our servers. We filter them for spam, links and banned words and keep a log of them, including messages our filter rejected, with their sender, recipient and time (see "Logs for investigations" and "How long we keep data").

We receive images of your video only in the cases described in the next sections: in a report, in an automatic check, and when an administrator requests a frame for review.

Automatic moderation and age estimates

During a video chat, your partner's browser analyses frames of your video with machine-learning models that run inside that browser. The models estimate your age and gender and detect signs that there is no live person (no face, a frozen or looped picture). The images do not leave the browser for this: only the results are sent to our server, for example a summary of the estimates at the end of each chat, or a signal such as "no face" or "possibly under 18".

When these signals or a report raise a suspicion that a user may be under 18, a frame of that user's video is sent to our server and checked again by our own age model. Our server also estimates the age of every video chat user, by default at most once every 24 hours, from a single frame requested from the partner's browser; that frame is not stored unless the model suspects a minor. Frames that support a suspicion of a minor are stored as evidence (see "How long we keep data").

We keep these estimates and signals with your anonymous identifier. They alert our moderators and may lead to measures such as a ban until a moderator review. The estimates can be wrong, and we treat them as estimates of a model, not established facts.

Reports, bans and appeals

When someone reports you, we receive the reason, one frame of your video as their browser received it (for video chats), and the last messages of your text chat, which our server takes from the conversation itself. We also record the identifiers, addresses, network and fingerprint of both users. We strip metadata from frames and store them in private, encrypted file storage that only our staff can open.

A ban record contains the reason, its source (automatic or a moderator), the evidence, the dates and the identifiers it covers: your anonymous identifier, fingerprints, account and, where relevant, internet address or network. Addresses in ban and report records are also stored in encrypted form, so that administrators can see them when reviewing a case.

If you appeal a ban, we keep the text of your appeal and the moderator's decision and reply, which we also send to your e-mail address.

If you create an account

An account is optional. If you create one, we keep your e-mail address, your sign-in sessions and your profile: your gender, default filters and interface language. We send you e-mails only to sign in, to confirm deletion of your account and to tell you the decision on your appeal. Your account takes over the anonymous identifier of your browser, so its history, trust score and any bans carry over to the account.

Logs for investigations and requests from authorities

To answer lawful requests from law enforcement and to protect users from unlawful conduct, we keep the following service logs, each for a limited time:

• Connections: for every visit to the chat, the time you connected and disconnected, your IP address, the country and type of network (provider, VPN, data centre, Tor), the ASN, your browser's user agent, languages and time zone, your anonymous identifier and, if you are signed in, your account.
• Browser traits: for your anonymous identifier, the countries, time zones and the external WebRTC addresses seen with it, with the dates they were first and last seen. The WebRTC addresses are stored in encrypted form and are visible only to administrators.
• Chat partners: who you talked to, when and for how long, in video or text, and why the chat ended. Chats shorter than 10 seconds are not recorded here.
• Messages: the text of chat messages, with sender, recipient and time. Messages attached to a report are kept with the report.
• Age and gender estimates and moderation signals, as described above.
• A review frame: an administrator may receive one frame of the video you are showing to your partner, to check for a violation of our terms or of the law. The frame is taken by your partner's browser, stored on our server in encrypted form for no longer than 10 minutes and then deleted. Neither you nor your partner is notified of such a request.

Who can see your data

IP addresses and message texts in these logs are stored in encrypted form. Only administrators of the service can search the logs, see IP addresses and read the message log, and each such search or export is recorded with its grounds, such as the number and text of the request. Moderators see a summary of a user without IP addresses or the message log; when they review reports and appeals, they see the report frames and attached messages and the account e-mail address in full, and they receive short message excerpts in notifications.

We disclose data to public authorities only in response to a lawful request, or where the law requires us to report something, for example child sexual abuse material. When records are needed to answer a request or for ongoing proceedings, we may keep them beyond the usual period until they are no longer needed.

Why we use your data and on what legal basis

We use your data for these purposes and, where the GDPR or a similar law applies, on these legal bases:

• To provide the chat: connecting you with partners, applying filters, relaying messages and video, keeping your settings and account. Basis: performance of our agreement with you (the Terms of Use).
• To keep users safe and prevent abuse: moderation, reports, automatic checks, age and gender estimates, bans and their enforcement, including fingerprints and WebRTC addresses, captchas and limits. Basis: our legitimate interest, and that of other users, in a safe service free of minors, abuse and illegal content [legal basis for age and gender estimates].
• To answer lawful requests and comply with legal obligations. Basis: legal obligation, and our legitimate interest in cooperating with law enforcement.
• To keep the service running and secure: error reports, connection quality, aggregate statistics. Basis: our legitimate interest.
• To show ads from an advertising network that uses cookies. Basis: your consent, which you can withdraw at any time.

Who we share data with

We do not sell your personal data. We share it only as follows:

• Your chat partner receives your video, voice and messages, the flag of your detected country and, unless all video is relayed, your IP address while the connection is set up.
• Service providers that run the service for us: our hosting, storage and e-mail providers, which host our servers and the relay for video, store report frames and send sign-in links and appeal decisions.
• A messaging app used to notify our moderators, which delivers notifications about suspected minors, automatic bans, new appeals, spikes in reports and regular summaries of automatic decisions. A notification contains the type of event, the reason, ban and report numbers and your anonymous identifier, and may contain an excerpt of a chat message of up to 100 characters, but never images. Copies of these notifications stay in that app and are not covered by the deletion periods of this policy.
• An advertising network, only after you accept its cookies (see below). The ad is shown in an isolated frame that has no access to the rest of the page, your anonymous identifier or our cookies; the network receives what any website receives when it shows you an ad, such as your IP address and browser details, and processes it under its own privacy policy.
• Public authorities, when the law requires it or in response to a lawful request (see above).
• A buyer or successor of the service, if the service is transferred, under this policy.

International transfers

Hoplo is used worldwide, and your data may be processed in countries other than yours, including where our servers and service providers are located. When we transfer personal data from the European Economic Area, the UK or another country with transfer rules, we use the safeguards the law requires, such as standard contractual clauses [transfer mechanism].

How long we keep data

We delete data automatically when its period ends. The periods below are the current defaults; we may shorten them, and if we lengthen them we will update this policy. After data is deleted, copies may remain for a short time in technical records, such as the database's change log (up to 3 days) and server logs that are rotated by size, before they are overwritten.

• Connection log: 90 days.
• Chat partners log: 30 days.
• Chat messages: 7 days.
• Age and gender estimates from partners' browsers for each chat: 7 days; the daily summary of these estimates, our server's estimates and moderation signals: 90 days.
• Anonymous identifier, trust score, browser traits and the links between your identifiers: 90 days after your last visit.
• Review frames requested by an administrator: up to 10 minutes.
• Report frames: 30 days. A frame supporting an automatic ban for a suspected minor or illegal content that is still waiting for a moderator: up to 90 days. A frame kept as evidence of a confirmed serious violation: as long as the ban stands or the law requires.
• Reports: the report itself is kept without a time limit; the attached messages, the addresses of both users and the reporter's network and fingerprint are deleted after 30 days.
• Bans, warnings and moderation cases, including the identifiers and encrypted addresses they cover: without a time limit, so that bans can be enforced and repeated violations recognised.
• Your personal block list (people you reported or blocked are not matched with you again): 400 days.
• Records of automatic moderation actions, including message texts that triggered them: 7 days.
• The audit log of actions by our staff and automatic systems: 365 days.
• Your account: until you delete it. Sign-in sessions end after 30 days without a visit; sign-in links expire after 15 minutes and deletion links after 1 hour. An appeal is deleted with your account.
• Server logs: [period]. Our application does not write IP addresses or message texts to these logs; some error logs of the web server and, if enabled, logs of the video relay may contain IP addresses.

Cookies and browser storage

We use only the cookies and browser storage we need for the service to work: the cookie with your anonymous identifier (HttpOnly, 90 days from your last visit) and its copies in your browser's local storage and IndexedDB, so that it survives if one of them is cleared; your sign-in session cookie if you have an account; local storage entries in the chat for your confirmation of age and rules, your gender, filters, interface language and your choice in the cookie prompt; and, on the information pages, local storage entries for your language and for a language suggestion you dismissed. Our captcha runs in your browser without cookies or third-party services.

If we show ads from an advertising network, the chat asks for your consent before showing them; the prompt names the network (or says "an ad network" for one we do not list by name), declining is as easy as accepting, and you can change your choice at any time from the cookie link in the chat. If you accept, the network may set its own cookies in the ad frame. If you decline or do not answer, you see our own banners, which are served from our site without third-party scripts or cookies.

We do not use analytics or tracking services on the website.

Your rights

Depending on where you live, you may have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable form, and to withdraw consent at any time. You can also lodge a complaint with your data protection authority.

You can delete your account yourself from the account menu. This deletes your account, sessions, profile and appeals, and your browser forgets its anonymous identifier. Bans, reports, the links between identifiers and the investigation logs are not deleted with the account: they are kept for their periods above, because we need them to enforce bans and to answer lawful requests.

For other requests, write to the address below. Because the chat is anonymous, we may need information that lets us find your data, such as your account e-mail address or the time and approximate place you used the chat, and we may refuse a request where the law allows, for example when deleting the data would let someone get around a ban.

[email protected]

Children

Hoplo is only for people aged 18 and over. We do not knowingly collect data from children. When reports or automatic checks suggest that a user is under 18, we may block their access and keep the related evidence for review. If you believe a child is using the service, write to the address below.

[email protected]

Security

We protect your data with technical and organisational measures. Identifiers such as IP addresses and fingerprints are stored as keyed hashes for comparison, so that bans can be checked without the original values. Where we need the original value, as with IP addresses in the logs, addresses in bans and reports, WebRTC addresses and chat messages, it is stored encrypted, and only our server can decrypt it for administrators. Report frames are kept in private, encrypted storage and opened only through short-lived links. Staff access requires two-factor authentication, staff see only what their role allows, and access to the logs is recorded.

No system is perfectly secure. If a breach affects your data, we will notify you and the authorities where the law requires.

Changes to this policy and contact

We will update this policy when the way we process data changes, and publish the new version on this page with a new date. Changes take effect when they are published; the "Last updated" date shows the latest version.

For questions about this policy or your data, write to the address below.

[email protected]