1. What this policy covers
This policy applies to chat.v1stax.com, the V1stax hosted instance. If you run a self-hosted V1stax instance, you are the data controller for your users — this policy does not cover your deployment.
2. What we collect
| Data | Collected | Why |
|---|---|---|
| Username and password (hashed) | Yes | Required to create and authenticate your account |
| Email address | Optional | Only if you provide one — used for password reset only |
| Display name, avatar, bio, status | Yes | Only what you set in your profile |
| Messages and DMs | Yes | Stored to deliver your messages to other users |
| Uploaded files | Yes | Stored on our server to be accessible to recipients |
| IP address | Temporary | Used for rate limiting and abuse prevention only — not logged persistently |
| Browser/device analytics | Never | — |
| Third-party tracking or ad pixels | Never | — |
| Telemetry or crash reporting | Never | — |
| Voice/video call content | Never | Calls are peer-to-peer — audio and video never touch our servers |
3. How we use your data
Your data is used solely to operate the service:
- Delivering your messages and files to the people you send them to
- Keeping your account secure (authentication)
- Sending password reset emails if you've provided an email and request one
- Rate limiting to prevent spam and abuse
We do not use your data for advertising, profiling, recommendations, or AI training. We do not sell, rent, or share your data with third parties.
4. Federation
V1stax supports federation — the ability to interact with users on other V1stax instances. When you send a message to a federated user or join a federated Node, basic profile information (username, display name, avatar) is shared with that remote instance. Remote instances operate independently and have their own privacy policies. You can disable federated interactions in your account settings.
5. Web Push notifications
If you enable push notifications, your browser generates a push subscription endpoint (a URL at your browser vendor — e.g., Mozilla or Google). We store this endpoint to deliver notifications. We do not have access to your device or notification content beyond what you explicitly send. You can revoke push permission at any time in your browser or notification settings.
6. Data retention
Your data is retained as long as your account exists. When you delete your account, your profile, messages, and uploaded files are removed from the database. Backup copies are automatically purged within 7 days.
Individual messages can be deleted at any time from the app. Deleted messages are removed immediately from the database.
7. Your rights
You have the right to:
- Access — request a copy of your account data
- Delete — delete your account and all associated data at any time from the app
- Correct — update your profile information at any time
- Object — contact us with any concerns about how your data is used
To exercise any of these rights, use the in-app account settings or contact us at [email protected].
8. Security
Passwords are hashed with bcrypt and never stored in plaintext. All traffic is encrypted in transit via HTTPS. We take reasonable measures to protect your data, but no system is perfectly secure — if you discover a security issue, please report it privately.
9. Self-hosted instances
V1stax is open source (AGPL-3.0). Anyone can run their own instance. If you use a self-hosted V1stax instance run by someone else, that operator controls your data — not us. Review their privacy policy. We have no visibility into data on instances we do not operate.
10. Children's privacy
V1stax is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact us and we will remove it promptly.
11. Changes to this policy
We may update this policy as the service evolves. Material changes will be announced in the V1stax announcements channel and noted on this page. The effective date at the top will always reflect the latest version.
12. Contact
Privacy questions or data requests: [email protected]