Privacy Policy

1. Who we are

This Privacy Policy explains how (“Gibbur”, “we”, “us”) collects, uses and shares personal information when you use gibbur.com and our chat service (the “Service”). For the purposes of the EU and UK General Data Protection Regulation (GDPR), is the controller of your personal data.

You can contact us about privacy at any time at privacy@gibbur.com.

2. Data we collect

Account data (optional)

You don’t need an account to chat. If you create one, we store your email address, a password hash (using Argon2id — we never store your actual password), and, if you choose to add them, a display name, birthday, gender and interests. We also store timestamps such as when the account was created, when you last logged in and when you accepted the Terms.

Chat data

Messages you send are relayed through our chat server to your current chat partner. Chats are encrypted in transit but are not end-to-end encrypted, because our server must relay plain text so that we can moderate it. A copy of message text is kept only in the chat server’s memory for up to 2 hours for moderation and spam fighting, and is then discarded (it is also lost whenever the server restarts). Message text is never written to our database or to disk. Moderators can view live conversations and recent messages to enforce our rules. We also process the interest tags you enter so we can match you.

Games and drawings

If you play tic-tac-toe or use the shared drawing board, the game moves and drawing strokes are relayed only to your current chat partner. The game state and the drawing are held in the chat server’s memory only while that chat lasts, and are discarded when it ends — they are never written to our database or disk. If you have an account, we store your lifetime tic-tac-toe totals (wins, losses and draws) with your account. Guests’ totals and recently used emoji are kept only in your own browser’s local storage.

Technical data

• IP address — used for rate limiting, abuse prevention and ban enforcement, and recorded in server logs.
• Browser ID — a random identifier stored in your session, used to tell browsers apart, prevent you being matched with your own other tabs, and enforce bans.
• User agent and request data — browser type and version, pages requested and timestamps, which appear in server logs.
• Rate-limit records — short-lived counters tied to your IP, browser ID or account, used to stop spam and flooding.

Reports

When you report someone (or someone reports you), we store the report metadata: the reason, time, chat ID, and the IP addresses and account IDs (if any) of the people involved. We do not store the message text with the report. If you email us, we keep your email and its contents to handle your request.

Cookies and session data

We use only strictly necessary cookies: a session cookie for security (CSRF protection), remembering that you accepted the Terms, and holding your random browser ID, plus — only if you log in — a signed login cookie. Guest session data is kept in temporary files on our server, never in our database. See our Cookie Policy.

Email delivery data

If you have an account, we send transactional emails (such as verification and password reset messages) through our email provider, Resend. This involves processing your email address, the message content and delivery data (such as whether the email was delivered). We also create single-use tokens for these links.

Aggregate statistics

We keep anonymous daily counts — for example, the number of chats started and messages sent. These contain no personal data.

3. How we use your data and our legal bases

Under the GDPR we must have a legal basis for each use of your personal data. Here is what we do and why:

We do not use your data for advertising, and we do not build advertising profiles.

4. What your chat partner sees

Your chat partner sees only:

• the label “Stranger”;
• any interests you both share (if you added interests); and
• the messages you send, plus a typing indicator.

They never see your name, display name, email address, IP address or account. Remember, though, that anything you type can be read — and potentially copied — by the other person, so never share personal details.

5. How we share data

We share personal data only as described here:

• Service providers (sub-processors). We use Northflank for cloud hosting and Resend for transactional email. They process data only on our instructions and under contracts that require them to protect it.
• Law enforcement and legal obligations. We may disclose information when we believe in good faith it is required by law, court order or valid legal process, or necessary to prevent imminent harm. Where we become aware of apparent child sexual exploitation, we report it to the National Center for Missing & Exploited Children (NCMEC), as U.S. law requires, and NCMEC may share reports with law enforcement worldwide.
• Protecting rights and safety. To enforce our Terms, investigate abuse or protect the rights, property and safety of Gibbur, our users or the public.
• Business transfers. If Gibbur is involved in a merger, acquisition or sale of assets, personal data may be transferred as part of that transaction, subject to this policy.

We do not sell or share your personal information, as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA), and we do not use or disclose it for targeted or cross-context behavioral advertising.

6. How long we keep data

We may keep specific information longer where we are legally required to, or where it is needed to establish, exercise or defend legal claims (for example, data preserved in response to a valid law enforcement request).

7. Security

We use technical and organizational measures to protect your data, including:

• encryption of all traffic in transit (HTTPS and secure WebSockets over TLS);
• passwords hashed with Argon2id — we never store your actual password;
• short-lived (60-second), single-use, cryptographically signed tickets to join the chat service;
• server-side pairing, so messages can only be delivered to your current matched partner and are tagged with a per-chat ID so they can never leak into another conversation;
• keeping chat text in memory only, never in our database;
• a secure, HTTP-only session cookie and CSRF protection; and
• access to moderation tools limited to authorized staff.

No system is perfectly secure, and chats are not end-to-end encrypted. If you learn of a security issue, please email support@gibbur.com.

8. International transfers

We and our service providers may process your data in countries other than the one where you live, including the United States, which may not offer the same level of data protection. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum or equivalent), or an adequacy decision where available. You can ask for more information at privacy@gibbur.com.

9. Your rights

If you are in the EEA or UK

You have the right to:

• Access the personal data we hold about you and get a copy of it;
• Rectification — have inaccurate data corrected;
• Erasure — have your data deleted;
• Portability — receive data you provided in a structured, machine-readable format;
• Restriction — ask us to limit how we use your data;
• Objection — object to processing based on our legitimate interests;
• Withdraw consent at any time, where we rely on consent; and
• Complain to your local data protection authority (in the UK, the Information Commissioner’s Office). We’d appreciate the chance to address your concern first.

If you are in the United States

Depending on your state (including California, Colorado, Connecticut, Virginia and others with consumer privacy laws), you may have the right to know what personal information we collect, use and disclose; to access and receive a copy of it; to correct it; to delete it; and to opt out of the sale or sharing of personal information, targeted advertising and certain profiling. We don’t sell or share personal information or use it for targeted advertising. We don’t use or disclose sensitive personal information for purposes that would give California residents a right to limit it. We will not discriminate against you for exercising any of these rights. You may use an authorized agent to make a request on your behalf, and you can appeal our decision on a request by replying to our response.

California notice at collection. In the past 12 months we have collected the categories of information described in section 2: identifiers (email, IP address, browser ID, account ID), customer records (account data), characteristics you choose to provide (birthday, gender), internet activity (server logs and in-memory chat data), and inferences limited to safety signals (such as spam detection). We collect them from you and your device for the purposes in section 3, disclose them only as described in section 5, and keep them as described in section 6.

How to exercise your rights

• Self-service: you can view and edit your profile, and delete your account, in Account settings.
• By email: send your request to privacy@gibbur.com.

We will respond within the time required by law (generally within one month under the GDPR and 45 days under U.S. state laws). We may need to verify your identity, for example by confirming control of your account email. Because we don’t link chat text to identities and don’t keep it beyond 2 hours, we usually cannot retrieve past conversations.

10. Children

Gibbur is for adults 18 and older only. We do not knowingly collect personal data from anyone under 18. If we learn that a user is under 18, we will ban them and delete their account data, except where we must keep information to report child safety concerns or comply with the law. If you believe a minor is using Gibbur, please report it in the chat or email abuse@gibbur.com.

11. Automated decision-making

To fight spam and abuse quickly, we use automated measures. For example, users who receive repeated reports, or who trip spam signals (such as flooding, rate-limit violations or duplicate messages), may be temporarily banned automatically. These temporary bans are based on reports and technical signals, not on profiling for other purposes. If you believe an automatic ban was wrong, you have the right to contest it, express your point of view and ask for human review by emailing abuse@gibbur.com.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will change the “last updated” date at the top of this page and, if the changes are significant, let you know in advance by a notice on the site or by email if you have an account.

13. Contact us

For privacy questions or requests, email privacy@gibbur.com. For other questions, see our contact page.