Account and profile information
We process your sign-in email or linked sign-in provider identifier, account ID, iChat number, nickname, username, profile image, settings and the contacts or accounts you choose to follow or block. Where phone sign-in is available, the number you enter and its verification status are processed for SMS authentication and account protection. A verified number can also support phone-number discovery only when you enable that separate setting. Firebase/Google processes the number and verification request for authentication and abuse prevention; your mobile carrier may process the SMS. iChat does not receive your Apple or Google password, and we do not ask you to send us an SMS code through support.
Linking a number while signed in keeps the same account and its existing messages and iPoints. Signing in with a number that has not been linked to an existing account may create a separate account; iChat does not automatically merge accounts based only on a matching phone number. Phone-number sign-in is optional and may be unavailable in some regions or clients.
Some clients let you optionally provide age, gender, interests, a biography and a coarse profile region. These fields are not required for basic account creation. We record the minimum-age confirmation and terms acceptance used for ordinary registration. The current registration form does not ask for a date of birth or birth year. A self-reported age is not an independently verified age check.
Messages, content and calls
We process and store text messages, voice messages, selected photos and videos, files saved in the private File Transfer conversation, contact cards, group activity, iShare posts and comments to deliver them to the audience you select. We also process delivery and read state, reactions and call signaling records. Public iShare content can be visible beyond your contacts; personal iShare visibility follows the permissions you select.
Voice and video call media is transmitted in real time through the configured call service. The iChat call implementation does not record calls. Participants may separately capture content with their own devices. Messages and calls use encryption in transit; iChat does not claim end-to-end encryption for the current service.
If you report a received message, the safety service receives a bounded snapshot of the selected message, its identifiers and media type, your reason and any note you add. The report does not include the surrounding conversation. Post and account reports include the information needed to identify the reported content or account. Report and appeal records are restricted to authorized safety access.
Public iShare location and device attribution
On supported clients, public iShare posts and comments can include an automatic coarse location label, such as a city or region and country. This label is not copied from your manually entered profile region. The current Android client attempts a one-time foreground location lookup when publishing a public post if precise-location permission is already granted. Public comments can reuse a recent location fix under an existing location permission; the comment lookup does not request permission or start new GPS updates. The operating system's geocoding service processes coordinates to produce the place label.
The coarse label and location-source status are sent with the content and may be displayed publicly. Location-fix time and accuracy can also be sent to the service for validation. Raw latitude and longitude are not included in this public-attribution payload; sending a precise chat location is a separate feature. Location permission is optional: publishing and commenting remain available when it is denied or a suitable location cannot be obtained. An unavailable or proxy-network indicator may appear instead of a place label. The current Android proxy-network indicator uses a VPN transport reported by the operating system; it does not establish your physical location or reliably identify every VPN.
The publishing device's hardware manufacturer and model are automatically included with public posts and can appear beside the post and on the author's public profile. Device-model attribution is required for public posting in the current implementation, with no per-post hide control; posting may fail if a valid model cannot be obtained. It uses the publishing hardware model, not a custom device nickname or a private connected-device record. Denying location permission does not remove device-model attribution.
You can manage Location Services and iChat's location permission, including precise or approximate access where offered, in your device's system settings. These controls govern new permission-dependent location reads; they do not remove attribution already attached to a prepared or published submission. Your optional profile region and its one-time lookup are separate from automatic public attribution.
Permissions and optional features
- Microphone, camera and media: used when you record, call, scan a code, or select content to share. Selected content is uploaded only as needed for the sharing action you take.
- Chat location: when you choose to send a location, we process its coordinates, accuracy and optional label. A live-location session can share updates for up to one hour. On iPhone and iPad, an explicitly started or joined live-location session can continue in the background with the granted location permission and a visible system location indicator. The app does not request Always location permission. You can stop sharing or change the permission in system settings. Android location sharing uses its foreground permission flow.
- Profile region: you can enter a coarse region manually or request a one-time location-assisted region lookup. This is separate from automatic public iShare attribution and sharing a precise chat location.
- Contacts and phone lookup: iChat does not bulk-upload your device address book. On supported Apple clients, the system contact picker lets you choose a phone number for an exact lookup; a lookup sends that number to the service. Your verified number is private by default and is not displayed on public profiles or iShare.
- Face ID and Touch ID: the operating system performs biometric authentication. iChat receives the authentication result, not your facial scan or fingerprint template.
- Notifications and devices: we process notification tokens, installation and device identifiers, device name, platform, app version, authorization status and app-integrity signals to deliver notifications, manage connected devices and protect accounts.
Optional translation, speech and AI tools
The current Apple-client development line no longer offers generative writing, suggested replies, recent-message summaries or image generation through Apple Intelligence or Image Playground. AI tools used to develop the app do not themselves receive user messages or media from the production service.
Where supported, translation and speech tools process the selected text or voice needed for the task using the available platform implementation. Availability depends on the client, device, language, installed models and permissions. Model downloads and content loading can still require a network connection. Unavailable optional tools should not prevent ordinary messaging.
The proposed Google Cloud translation, speech processing and public-media AI analysis integrations are not enabled for production user content. Any future production activation requires updated data-use disclosures and applicable choices or consent before processing starts. The public-content rule against AI-generated posts is not a claim that automated authenticity detection is deployed. Automated results may be inaccurate; do not rely on them as professional advice.
Purchases and iPoints
Where in-app purchases are available, Apple processes App Store payments and Google processes Google Play payments under their respective terms. iChat receives product and transaction identifiers, signed transaction or purchase-token information, account association, purchase verification results and refund or revocation events. These records are used to credit the correct iPoint balance, prevent duplicate credits, reconcile refunds and maintain transaction history. iChat does not receive your store payment-card details.
Your production iPoint balance and activity belong to your iChat account and are maintained by the service across supported signed-in clients. Test-store transactions are handled separately from production purchases.
Why information is used and who processes it
We use information to provide authentication, communication and sharing; verify purchases and rewards; prevent abuse; process reports and appeals; provide support; and meet applicable legal obligations. Supported feed selection and ordering use followed authors, post topics, coarse regions and reaction counts. Local topic-preference feedback in the current release remains on your device.
The app and its service providers also process usage, diagnostic and service-performance information to maintain reliability, investigate failures and improve service operation. This includes sign-in usage, installation identifiers, IP addresses, device and app metadata, request latency and errors. Some records can be linked to an account or device; they are not all anonymous. We do not sell personal information, share it with data brokers, or use it to track you across other companies' apps or websites for targeted advertising or advertising measurement.
Relevant service providers include Google Firebase and Google Cloud for authentication, database, storage, notifications, app integrity and backend operations; LiveKit for call transport; Apple and Google for their sign-in, operating-system and store services; and hosting and support providers. Providers process information under the terms applicable to their services. We may disclose limited information when required by law or reasonably necessary to address serious harm, fraud or abuse. Processing may occur outside your country; contact us for information about the providers and safeguards applicable to your request.
Website and support
The website does not require an account. Hosting services may process IP address, requested page, browser information, request time and security signals. A website deletion request stores the email and optional username, region and note you submit so ownership can be checked and the request processed. Submitting that form does not itself sign you out or immediately schedule deletion in the app service. If you email support, we process your email address and message to respond and keep necessary support or safety records. Never send a password or verification code.
Website source-license orders and payments
Source-license purchases are separate from voluntary developer support and in-app iPoints. Where a source-kit checkout is enabled, we collect the email, selected package, immutable price and scope, order details and terms acknowledgement needed to identify the purchase and arrange the agreed delivery. The order email is an order reference and delivery contact; entering it does not subscribe you to marketing.
For PayPal checkout, PayPal processes your payment account and payment method under its own terms. We send PayPal an internal order reference, package, amount, currency and merchant identifier; the delivery email is not placed in the payment URL. We retain the PayPal order and capture identifiers, verification result, and applicable refund or reversal notifications to reconcile the purchase and prevent duplicate claims. We do not receive your PayPal password or card number. Returning from PayPal is not itself proof of payment.
For cryptocurrency checkout, we additionally collect the payer wallet address and submitted transaction hash. Wallet addresses and transaction histories are public on the relevant blockchain; linking them to an email creates additional personal information.
For supported self-custody Ethereum wallets, a signed, order-specific message proves control of the payer address. It does not approve tokens or transfer funds. We never request a seed phrase or private key. The server checks the configured Ethereum node for network, official token, sender, recipient, amount, transaction success and finality. A public transaction hash alone does not establish ownership. Only salted, time-bucketed hashes of request IP addresses are stored for checkout rate limiting.
Order access keys remain in the purchasing browser session and are hashed on the server. For PayPal orders you can explicitly save a local recovery file containing only its schema, provider, package and access key—not your email. This file is a sensitive order and download credential; keep it private. Importing it validates the file locally and submits the recovery key only to the normal order-status endpoint. It does not create or pay another order. Website hosting, database and configured blockchain-node providers process the relevant request or order data. Node providers receive blockchain queries, not the submitted email or wallet-proof signature. Verified payments remain subject to scope-specific delivery checks; they do not grant access to a source master repository. Bitcoin is displayed as wallet information only and is not an automated purchase method in this release.
Customer source archives are held in private file storage. Where a purchased archive is available, the service checks the order recovery key, verified payment, package, file checksum, terms version and refund or reversal status before returning it. We retain a minimal download-authorization record linked to the order and file; it does not prove the browser saved or opened the file. Archives have no public storage link. A refund can prevent later downloads but cannot erase a copy already downloaded.
We retain necessary order and audit records for delivery, support, accounting, fraud prevention and disputes, with access restricted to the authorized owner. You can request access or deletion through the privacy contact; ownership checks and applicable record-retention obligations may limit deletion. An on-chain transaction cannot be erased by deleting a website record. Checkout remains unavailable until its configuration and delivery gates are satisfied.
Retention, access and deletion
We retain account and shared-content data while needed to operate the account and features you use. An authenticated in-app deletion request starts a seven-day recovery period and restricts ordinary account access. After that period, eligible data is scheduled for deletion or de-identification; completion depends on the cleanup process and any necessary exception. The permanent iChat number is retired. Copies already received or saved by other participants may remain on their devices.
Limited payment, refund, iPoint, safety, dispute, deletion and referral evidence may be retained for accounting, fraud prevention, legal obligations or the establishment or defense of claims. These purposes may require different retention periods; they do not mean all account content is retained indefinitely. Contact us for the status or applicable retention details of a particular request.
Service providers maintain operational and security retention schedules separately from account-content storage. Routine logs, incident records and backups can have different deletion schedules; an incident hold or a necessary legal exception can extend retention. We do not apply a single universal deletion deadline to every category of record.
Use the app's Download my data control, where available, to export supported account, contact, post and accessible chat records as JSON. Export does not recreate removed content or include every local cache or media file. You can also request access, correction, export or deletion through account deletion support or ichat999@126.com. We verify ownership before acting.
Age, security and policy changes
iChat is not intended for children under 13. Higher minimum ages, guardian-permission requirements or other restrictions may apply in your region. Contact support if you believe an ineligible child has provided account information. Read the Teen & Guardian Safety Guide and Child Safety Standards for safe-sharing guidance, the report process and the designated safety contact.
We use transport encryption, access controls, app-integrity checks and server-side purchase verification. No service can guarantee perfect security. We update this policy when practices change and provide additional notice when required. Privacy and consumer rights that cannot legally be waived remain unaffected.