Privacy & honest limits

Privacy by design means telling you exactly what happens — including the limits of anonymity. Last updated 2026-08-23.

What we never collect

  • Names, emails, phone numbers, or any account identifiers
  • Chat content — rooms are end-to-end encrypted and never persisted
  • Permanent profiles — a session dies when it expires or when the tab closes

What is temporarily held (and for how long)

  • Session id + ephemeral token in memory/Redis (max 24h, default 4h)
  • A COARSE geohash cell of your location only when you enable GPS discovery
  • Block/report counters that expire within 24h; report notes are hashed, not stored as text
  • Match queue entries for the few seconds it takes to pair two ghosts

Location privacy

  • Raw GPS never leaves your device — it is coarsened into a geohash cell client-side
  • Nearby users see cell-center positions at most, never exact coordinates
  • Revoking permission or switching tabs stops all location use immediately

Chat security model

  • Per-room AES-256-GCM keys derived from ephemeral ECDH P-256 key exchange
  • Private keys exist only in your browser session and are destroyed with the tab
  • Compare "safety codes" (public-key fingerprints) in chat for out-of-band verification
  • Limitation: pairing is server-mediated, so a compromised server could substitute keys — safety codes mitigate this

Moderation without surveillance

  • No automated content scanning of encrypted traffic — by design, we cannot read it
  • Reports are rate-limited counters + hashed notes reviewed only when escalated
  • Blocking is immediate, mutual-silent, and expires with the session

⚠️ Anonymity is best-effort

Persona minimizes data, but anonymity is never absolute: your ISP or network admin can see that you use the service, your device can be fingerprinted by the browser, and anything you type in chat is shared with your partner. Never share personal details — and report anyone who asks for money, identities, or intimate content.