PolyChat
Privacy
Effective 26 September 2026. This notice describes what the current PolyChat service stores and why.
Account information
- Username, email address, preferences, status, and an optional profile photo. Your username, profile photo, status, and current online/offline presence are visible to other signed-in PolyChat users through profile cards and profile pages; your email and account preferences are not included there.
- Passwords are stored as one-way password hashes, not readable passwords.
- If you use Google sign-in, PolyChat receives the account identifier, email, name, and profile photo that Google authorizes. PolyChat never receives your Google password.
- Password-reset tokens are randomly generated, stored as hashes, and expire after 30 minutes.
Conversations and files
- Messages, reactions, rooms, DMs, groups, servers, channels, invitations, and membership records are stored so the service can operate.
- Uploaded files and voice messages are stored on PolyChat’s server. Downloads require a signed-in account that can still access the associated conversation.
- Language translation is performed by a server-side translation provider. Message text may be sent to that provider to produce the translation.
- Optional message dictation uses the browser’s speech-recognition feature and remains editable until you choose Send. Optional live call captions send short microphone segments to PolyChat’s server-side transcription provider, then may send recognized text to the translation provider so current participants can read it in their selected call language. Caption audio is processed for transcription and is not stored by PolyChat.
Presence, notifications, and calls
- Short-lived presence and typing records are used for online and typing indicators.
- Browser notification preferences and some read/mute settings are stored in your browser.
- Conversation calls, Voice, and Meet store temporary room, participant, chat, and WebRTC signaling data. Rooms expire automatically. Audio and video are transmitted between participants using WebRTC and are not recorded by PolyChat.
- Calls may use PolyChat’s encrypted TURN relay when a direct WebRTC connection is blocked by a restrictive network. Relay access uses short-lived credentials.
Security and retention
PolyChat uses authorization checks, CSRF protection, rate limits, protected data directories, and restricted file delivery. No internet service can guarantee perfect security or permanent availability. Operational records and content are retained as needed to run, protect, and troubleshoot the service.
Account deletion
You can request deletion of your PolyChat account and associated data at polychat.swift7.net/delete-account.php. The deletion page explains the process, the data removed, and limited security or legal retention.
What PolyChat does not do
- No advertisements or sale of private chats.
- No collection of Google passwords.
- No built-in recording of Meet or conversation calls.
Questions can be directed to the people who run Swift7.