Privacy Policy

Who we are

ChatBridge (chatbridge.chat) is run independently by two people, a current student and a graduate of the University of Cambridge, who together act as the data controller for the personal data described in this policy. For anything about your data, including requests, email team@chatbridge.chat. ChatBridge is not affiliated with or endorsed by the University of Cambridge.

What we collect

• Account and profile. Your CRSid, first name, college, course, degree, matriculation year, and any interests you pick. Raven login also creates an internal account email in the form crsid@cam.ac.uk; it is a login identifier only and we never send mail to it.
• Waitlist. If you join the waitlist: your email address, any profile details you choose to add, your referral code, and which referral link (if any) you signed up through. We email you a confirmation when you join, and we will email you when we open.
• Private events. If you join a private event using an invite link: your first name and last name, and a record that you joined that event. That is all. We do not ask for your email address, we do not verify who you are, and there is no Raven login on this route, so people at a private event are not checked as Cambridge students. Your full name is shown on screen to the people you are matched with during the event.
• Calls and matchmaking. A record of each call: who you were matched with, when it started and ended, how long you waited, and whether it failed to connect. We also record each time you join the queue.
• CRSid exchange. Your choice after each call and the outcome. If you both opt in, your CRSid and first name are shown to the other person and kept in both call histories.
• Safety and moderation. Reports you file or that are filed about you (category and any written detail), records from the explicit content check (only that a detection happened and a confidence score, never an image), witness confirmations, moderation decisions, appeals you write, and pairs of users who must not be matched again.
• Feedback. Bug reports and feature requests you send, with the page you were on and your browser's user agent string.
• Security logs. Our owner login page keeps a log of visits and attempts (the email typed, whether it matched, IP address, and browser user agent). Raven sign-ins keep a short-lived token that blocks replayed logins, deleted after about an hour.

What we never collect

Calls are live only. We never record or store video, audio, or in-call chat messages. The explicit content check runs entirely in your browser: no image or video frame ever leaves your device, and we keep only the fact that a detection happened. We run no advertising, no cross-site tracking, and we never sell data.

Cookies and device storage

• Login cookies. Essential cookies from Supabase, our login provider, that keep you signed in
• Referral cookie (cb_ref). Remembers for one hour which referral link brought you to the waitlist, so your friend gets the credit
• Session flag. A browser flag that shows a short notice after a call fails to connect, gone when the tab closes
• Analytics. Vercel Analytics and Speed Insights collect aggregate, cookieless page statistics; they set no cookies and do not identify you

None of this is advertising or cross-site tracking, which is why you do not see a cookie banner.

What other people see

During a call the other person sees your live video and audio and your first name. If you share a college, course, or interest, ChatBridge may show you both a small hint about it, and only ever something you both share. Your CRSid is shown only if you both opt in after a call. We see reports, moderation records, and call metadata when reviewing safety issues.

At a private event this works differently. The people you are matched with see your full name, during the call and on the screen straight after it. There is no CRSid exchange at a private event, so no contact details are shared either way.

Why we can use this data

Under UK data protection law, our lawful bases are:

• Providing the service you signed up for. Your account, profile, matchmaking, calls, CRSid exchange, and call history
• Legitimate interests. Keeping the platform safe (reports, moderation records, pair blocks), securing logins and preventing abuse (security logs, rate limiting), understanding aggregate usage (cookieless analytics), and crediting waitlist referrals
• Consent. Joining the waitlist and receiving launch emails, and sharing your CRSid with another user
• Legal obligation. Where we must respond to a lawful request

Who handles data for us, and where

Four providers process data on our behalf: Supabase (database and login), Daily.co (carries the live video and audio during a call, receives your first name as your display name, and keeps technical meeting records such as who joined and for how long), Vercel (hosting, server logs, and analytics), and Resend (sends the emails we send you, so it receives your email address and the message). We do not sell data or share it for advertising.

Some of these providers process data outside the UK. Where that happens, transfers rely on the providers' UK-recognised safeguards, such as adequacy decisions or standard contractual clauses, under their data processing agreements.

How long we keep data

• Login replay tokens: about one hour, deleted automatically
• Your account and profile: until you delete your account, from the Edit profile page or by emailing us. Your profile details are removed at that point
• Private event attendees: your name and the record that you joined are kept until you ask us to remove them. There is no Edit profile page on this route, because a private event does not create a full account, so email team@chatbridge.chat and we will delete them
• Call, queue attendance, and exchange records: kept so other people's call histories stay intact. Once you delete your account they no longer show your CRSid or name to anyone
• After account deletion we keep a minimal record (your CRSid and any moderation or ban state), so past safety decisions, such as bans and never-rematch blocks, stay enforced if you return
• Safety and moderation records: for as long as they are needed to enforce a decision. Records behind a permanent ban are kept while the ban stands. Everything else is reviewed at least every 12 months and removed when no longer needed
• Feedback and bug reports: until resolved, then removed in our periodic review
• The owner login security log: pruned in our periodic review, kept no more than 12 months
• Waitlist entries: until our launch communications are done, removed within about six months of launch, and removed earlier at your request
• Provider infrastructure logs (Vercel, Supabase, Daily.co, Resend): short windows controlled by those providers, per their own policies

Apart from login tokens, nothing deletes itself on a schedule: deletion is a manual process we run through these reviews and your requests.

Your rights

You have the right to access your data, correct it, delete it, restrict or object to how it is used, and receive a copy in a portable form. If you signed in with Raven you can delete your account yourself from the Edit profile page. If you joined a private event by invite link there is no such page, so email us instead and we will delete your details. For anything else, email team@chatbridge.chat and we will respond within one month. We may keep some safety records where we have an overriding legitimate interest, for example the record behind a permanent ban, and we will tell you if that applies to your request.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk. We would welcome the chance to sort things out first, so please consider contacting us before them.

Security

All traffic is encrypted in transit. The database is accessible only to the people who run ChatBridge. Video calls run in private rooms that require a server-issued token to join. We hold no payment details.

Age

ChatBridge is for adults. You must be 18 or over to create a profile, and we ask you to confirm this when you set one up.

Changes and contact

We may update this policy as ChatBridge evolves. The version date at the top identifies the current policy, and material changes will be flagged in the app. Anything unclear, or any request about your data: team@chatbridge.chat.