Last updated: October 11, 2026
This policy describes rooms, optional AI conversations, and safety tools. The updated app uses Sign in with Apple for human rooms and requires a private invitation. Eve is an AI companion: each device includes 5 free minutes without an account, and optional ChatRoom Plus and ChatRoom Pro subscriptions add monthly time. Free rooms include the host and one guest for 15 minutes. A subscriber can host four people total for up to one hour, and unlocks chess for the room. These changes take effect with the next app update.
The updated app uses Sign in with Apple and requests your name, without requesting your email. When Apple provides your name, the app saves only your first name and last initial on this device for the profile button. This name is not sent to our services or other participants. You can edit it in Account. Apple authenticates you and provides an app-specific identifier and authorization code. Our Google Apps Script service exchanges the code directly with Apple, validates the response and stores the identifier and a refresh token to keep you signed in and detect revoked access. Tokens are never shared with room members. The app stores its session credential in the device-only Keychain. Sessions last up to 90 days of inactivity and are renewed during use; Apple access is checked at most once per day and the app checks Apple's credential state on return. Members see a stable member label. Installation identifiers link to the account to enforce blocks and bans across devices. Existing email accounts can migrate on an authenticated device; their stored email is removed when migration succeeds. Earlier app releases retain their expiring email-code sign-in for compatibility.
Private invitations are unguessable codes shared by the host, expire when their room ends (15 minutes free, up to one hour with a subscriber host), and can be revoked. Membership records and connection details expire with the room and are removed during service maintenance; active connection details are discarded after inactivity. Room records include the host account, creation and expiration times, participant limit and the host’s plan tier. Hosts retain their role if they revoke an invitation. Free rooms admit two signed-in devices for 15 minutes; subscriber-hosted rooms admit up to four for one hour. The same Apple account may join from two devices; each uses one room slot and signing out affects only that device. There is no public room directory.
Use Account → Delete Account in the lobby to revoke Apple sign-in access and delete your profile and sign-in sessions and close rooms you host. We retain minimal pseudonymous identifier links needed to resolve safety reports and enforce bans. Recreating a banned account does not remove its ban. Contact us for privacy requests or an appeal.
You can share a private friend link and send a friend request. The recipient must accept before you become friends; there is no public directory or automatic addition of people from your rooms. We do not access or upload your phone's contacts. The Google-hosted service stores the two account identifiers, an opaque relationship identifier and its creation time so accepted friendships are available on your signed-in devices. Other users see neutral Member labels, not your Apple account identifier, email, local profile name or photo.
A nickname you choose for a friend is stored against your account and that friendship, synced to your devices, and visible only to you. Friend links expire after seven days and replacing a link invalidates the previous one. Pending friend requests expire after 14 days. In-app room invitations between accepted friends expire when the room ends; joining still requires an explicit action and room participant approval before media is shared.
Accepted friendships stay until either person removes the friendship or deletes their account. Removal, blocking and account deletion remove related requests and room invitations; minimal safety identifiers may remain as described above. These records provide Friends and room invitations only and are not used for advertising or tracking. You can cancel outgoing requests, decline incoming requests, rename or remove friends, and replace a shared friend link from the Friends screen.
With your consent and camera permission, 3D Chat Room uses ARKit face tracking and the front camera, including the TrueDepth camera on supported devices. It processes camera images of your face, a three-dimensional face mesh, facial-expression blend-shape coefficients, head position and rotation, and eye positions and rotations. It derives a face texture, face-shape corrections and an average skin color for the avatar. The app does not access Face ID authentication templates or use your face to identify or authenticate you.
Face data is used only to draw and animate your live 3D avatar, including its appearance, expressions, eyes and head movement, and to adjust the viewpoint of the 3D scene. You can see your own avatar in the mirror view. There are no other planned uses. We do not use face data for advertising, analytics, profiling, identification, or training AI or machine-learning models.
In rooms, expression coefficients, head and eye poses, and view parameters are sent to participants you allow to animate built-in avatar artwork. Camera imagery, captured face textures, custom face-shape corrections and face meshes are not transmitted to other human participants. Face imagery can be used locally in your own mirror view.
If you explicitly connect an iPhone to the Mac companion, face data is sent to that Mac for rendering. The current companion applies the same room restrictions. Face data is not sent to the developer's account/moderation service, Google, xAI, advertising services or analytics services. Face data is not included in safety reports. In Eve's room, your face data is rendered locally.
Room packets use encryption with pair-specific keys provided by the membership service. Other participants can separately capture what their devices display or play; the app cannot control their screenshots or recordings.
The iOS app does not save captured face data to files, databases, backups, or cloud storage. It processes face data in volatile CPU and GPU memory on your device and receiving participants' devices. Leaving a room stops camera capture and transmission; working buffers, including your most recent face texture, can remain in the running app's memory until replaced or the app process ends. Closing the app process releases that memory. There is no developer-held face-data record to delete. You can stop further capture by leaving the room or revoking camera access in iOS Settings.
In rooms with friends, live microphone audio is encrypted and sent directly between the participants who allow each other. Friend audio is not uploaded to Google or xAI, transcribed, classified by an AI service, or saved as recordings by the app or developer. Devices temporarily buffer audio in memory for live playback. Use the microphone button to mute yourself; Hide, Report, Block or leaving the room stops that participant's audio and further sharing.
The Google-hosted service handles sign-in, invitations, membership, connection information and safety-report metadata; it does not relay friend audio. Automatic voice transcription and content classification are not used in friend rooms. New participants remain hidden and muted until both people allow each other.
If you choose an AI room and accept the separate AI voice disclosure, your microphone audio, conversation text and game context (such as chess moves and game results) are sent to xAI to generate the AI companion's replies. Eve does not require an account or collect an email address. A random, device-only Keychain identifier identifies the device's Eve time. The Google-hosted service stores a hash of this identifier, the free time used and an active-session identifier to enforce the five free minutes across reconnects and reinstalls. While Eve is connected the app reports usage every minute. The service issues short-lived xAI connection tokens; the provider's master key stays on the service. Subscription records are described under ChatRoom subscriptions. Face data is not sent to xAI. The app holds audio and conversation text in memory and does not save a conversation history to disk. Eve keeps a short memory on your device: what she calls you, brief notes she saved from your conversations, how many times and when you last talked, and a favorite world theme. These notes are stored only on your device and are sent to xAI as part of Eve's instructions each time you talk to her. Erase them with Account → Eve's memory → Forget Everything; deleting the app also removes them. xAI's Voice API documentation states that voice audio is handled in real time without storage or training use. Conversation text and other API inputs and outputs are subject to xAI's default 30-day audit retention. Its business-data policy allows longer retention when legally required, including data flagged for possible policy violations. xAI says it does not train on API inputs or outputs without explicit permission; we do not authorize training on your conversations. See xAI API data practices, xAI's business-data FAQ and xAI's privacy policy. Declining AI companion sharing leaves rooms with friends available without sending their audio to xAI. You can withdraw AI voice consent at any time with Stop Sharing AI Voice with xAI in Account; no further audio or conversation text is sent to xAI unless you agree again.
ChatRoom Plus and ChatRoom Pro are purchased through Apple. Apple processes payment; we do not receive your payment details, Apple Account email or name from a purchase. To verify a subscription and meter its time, the app sends the service the signed StoreKit transaction for your active ChatRoom subscription when checking plan status, using Eve, or creating or upgrading a friend room. It contains Apple's transaction identifiers, the product, price and currency, purchase and expiration dates, the app's bundle identifier, storefront and environment. The service verifies Apple's signature and queries Apple's current subscription status to check renewals, refunds, revocations and billing grace periods. When Eve is used, it stores a hash of the original transaction identifier, the plan and product identifier, the current billing period's start and end, any billing-grace access end, the last verification time, the seconds of Eve used in that period, and the active session identifier with its last heartbeat time. It does not store the signed transaction. While a session is active it is linked to the hashed device identifier above, so one device talks to Eve per subscription at a time. Subscription usage records are deleted one day after billing or grace-period access ends; a renewal starts a new record. Free-time records for a device identifier are kept to prevent repeat free minutes. For friend rooms, the service verifies the host’s plan without storing the signed transaction; the room retains its granted tier and limits until its deadline. This information is used only to provide subscription benefits, including Eve time, friend-room limits and chess, and is not used for advertising or tracking. Manage or cancel subscriptions in your Apple Account settings; Apple's privacy policy covers its payment processing.
The Google-hosted membership service receives room membership, installation identifiers, network addresses, port numbers and connection information so invited members can connect. Active clients refresh membership every three seconds and stop exchanging media when membership cannot be refreshed for 20 seconds. The service does not relay friend audio or avatar animation. Cloudflare's STUN service receives your network address and port to help establish direct connections; it does not receive room media. There is no paid media relay in this release, so some restrictive networks may prevent a connection.
The installation identifier is random, not derived from your face and not an advertising identifier. It accompanies reports and is linked to your verified account for safety enforcement. Google and Cloudflare may maintain operational request logs under their own policies.
Reporting content or blocking a participant sends the action, reported participant's and reporting installation's identifiers, room, time, app version, selected reason, and any description you enter to the developer. No face imagery, face-tracking measurements, automatically generated transcript or audio recording is attached. Please do not include private information in the description.
Reports are sent over HTTPS to a Google Apps Script operated by the developer and emailed to brkuprel@gmail.com for review. Google processes report metadata to host the receiver and deliver email. Unsent notification payloads are stored in the script's private storage for up to 30 days and removed after successful notification. A separate private review record contains the report ID, reported installation ID, room, reason, receipt time, 24-hour deadline, decision and review note. Open review records remain until resolved; resolved records are deleted within 30 days, or sooner when storage space is needed. Limited report identifiers, content hashes and delivery timestamps are retained for up to 30 days to prevent duplicate notifications. Delivery may be delayed by service outages or email limits. Notification emails are retained until the safety review and any related follow-up are complete, then deleted, unless retention is required by law. Pending reports are stored on your device and retried until delivery is confirmed; the local pending copy is then removed. Deleting the app removes unsent reports. Contact the developer to request deletion of a submitted report. See Google's privacy policy for its service data practices.
The app fetches current moderation policy over HTTPS on entering a human room and every minute while there. The policy exposes only banned installation identifiers and whether rooms are enabled; it does not expose reports, reporter identifiers, allegations or review notes. Google receives the network request, but the app does not include your installation ID in this policy request. Banned account and installation identifiers are kept for as long as the ban is in force so clients can remove content and reject further contact, including after reinstall or account recreation.
Participant approvals and temporary hides last for the current room visit. New participants' content is withheld until you explicitly allow it. Human rooms use built-in avatar artwork instead of transmitting captured images and direct encrypted voice chat without cloud transcription. Reports include the description you provide and do not upload audio or face media.
Your device stores terms and privacy consent, AI voice consent, the random installation identifier, blocked identifiers, appearance settings, and unsent safety reports. Your shortened Apple sign-in name, any name you edit in Account and an optional photo you choose are stored on this device for your Apple account. They are not sent to our services or other participants; deleting your account removes them from this device. Its device-only Keychain stores sign-in credentials and the random Eve device identifier. The device also keeps Eve's memory notes and the last Eve plan and time reported by the service. These are separate from face data. You can undo blocks, withdraw AI voice consent, erase Eve's memory, restore or manage subscriptions, sign out, or delete your account from Account in the lobby. Deleting the app removes its local app settings; Keychain items may remain on the device, so reinstalling does not grant more free Eve minutes; restoring a device backup may restore local settings. To request deletion of developer-held report data, contact the address below. No advertising or cross-app tracking is used.
Earlier invitation-room builds uploaded short voice messages through Google to xAI for transcription and safety checking. That upload route is disabled with this update, so those builds must update to use friend voice chat. Audio previously sent to a provider remains subject to that provider's retention policy; disabling this route does not erase previously submitted data.
Builds before 148 used public rooms and could send face textures and custom face geometry directly to other participants. Those builds did not have verified accounts, private invitations or pre-delivery voice checks. The September 25 privacy policy remains available for those builds. The older face-data handling and safety-report retention apply to activity that occurred in them.
3D Chat Room is intended for people aged 18 and older.
Privacy questions, safety concerns, or deletion requests: brkuprel@gmail.com.