Nearby - Free Random chat (SecureDateNearby) is designed around four principles:
Legal basis codes: C Consent | CP Service performance | LI Legitimate interest / safety / security.
| Category | Exact data | Basis | Purpose | Where stored/processed | Retention |
|---|---|---|---|---|---|
| Pseudonymous account identity | User ID, Ed25519 public key, X25519 public key, signed prekey, signed-prekey signature, ML-KEM-768 public key. | CP | Authentication, lookup, friend requests, session setup, routing. | Server RAM/Redis/Postgres where configured; client secure/local storage. | Active account data until deletion or automatically after 30 days of inactivity. Tombstone may remain long-term after deletion/ban. |
| Google sign-in identity | Google account email address and Google's stable per-app account identifier ("sub"), obtained by verifying a short-lived Google-issued ID token at sign-in time. The token itself is not retained. | CP | Identify your account and authenticate sign-in on any device. | Postgres (google_accounts table); Google's servers during token verification only. | Until account deletion or automatic 30-day inactivity deletion, at which point the link is removed. |
| Encrypted identity-key backup | Your device-generated private key material (signing key, session-setup keys, local database/backup encryption keys), encrypted at rest via Google Cloud KMS. | CP | Recover your account and its keys after signing in with Google on a new or reinstalled device. | Postgres (key_backups table), ciphertext only; decryption performed on-demand via Google Cloud KMS behind a rate-limited, audit-logged endpoint. | Until account deletion or automatic 30-day inactivity deletion. |
| Account-recovery audit log | Timestamp, IP address, and user-agent string for each successful key-backup decryption. | LI | Security auditing of the key-backup recovery path. | Postgres (key_recovery_log table). | Until account deletion or automatic 30-day inactivity deletion. |
| Public dating profile | Name, age, gender, bio text runs, occupation, goal, interests, favorite interests, prompts, anthem, country label, visibility flags (including a last-seen visibility preference). | CP | Discovery cards, profile preview, direct lookup, friend presence (including a "last seen" timestamp shown to connections, unless hidden). | Server presence maps/cache; local profile storage. | Current presence about 35 seconds; recent-offline profile up to 24 hours; lookup cache up to 30 days. |
| Compatibility quiz | Values, lifestyle, personality sliders, and relationship preferences. The match percentage is computed client-side from these values and visible peer data. | CP | Compatibility percentage and profile completion/discoverability. | Signed presence/discovery data on server; local profile storage. | Same as public profile presence/cache. |
| Location | Device-local location fix; server receives rounded 0.01 degree latitude/longitude plus country label and hide-distance preference. | C | Nearby results, distance filters/sorting, hidden-distance behavior, lucky matching. | Server presence maps/cache; not intentionally written as raw GPS. | Current presence about 35 seconds; recent-offline snapshot up to 24 hours. |
| Encrypted friend/block backup | Client-encrypted friend records, blocked records, public keys, display names, timestamps, and preferences. | CP | Restore friends/blocked users after reinstall or device change. | Server blob storage/Postgres/Redis cache; unreadable to us. | Until account deletion or automatically after 30 days of inactivity. |
| Local encrypted database | Contacts, blocked users, messages, pending requests, ratchet sessions, avatar, file chunks, file metadata, and voice-note local copies. | CP | App functionality and offline continuity. | User device only, encrypted with a device-generated key (recoverable via the encrypted key backup in Section 2). | Until user deletion, local wipe, uninstall, or device/browser storage removal. |
| Signals and encrypted messages | Signed signals and encrypted ratchet wires with sender/receiver IDs, signal type, timestamps, message IDs, receipts, deletes, friend request/accept payloads, WebRTC/call setup, and offline-message envelopes. | CP | Messaging, friend requests, delivery/read status, delete-for-everyone, calls, reconnection. | Broker RAM/Redis queues; delivered to clients by WS/SSE/HTTP fallback. | After delivery, removed. Ephemeral call/WebRTC signals about 15 minutes; durable signals and sealed offline messages up to 7 days. |
| WebRTC data and calls | Encrypted data-channel packets, file chunks, audio/video media, ICE candidates, route and quality metadata. | CP | P2P chat transport, file transfer, audio/video calls. | Direct peer path where possible; STUN/TURN infrastructure when needed; local app state. | Media/content is not stored by us. Route/call telemetry may be kept as bounded operational metadata. |
| Voice notes | Encrypted audio object in R2, transfer ID, presigned URL requests, object size confirmation, encrypted decryption key inside ratcheted message. | CP | Reliable voice-note delivery when peers are not simultaneously online. | Cloudflare R2 for ciphertext; key only inside end-to-end encrypted message. | Normally deleted after download or account deletion attempt; lifecycle removes leftovers after up to 14 days. |
| Push notifications | FCM token, peer ID, sender display name, event type, message ID, call type, generic title/body, collapse key, recent push log. | C | Wake device, show call/message notifications, support inline reply, improve reliability. | Server RAM/Redis/fallback file where configured; Google FCM. | Until token replacement, invalidation, deletion, or automatic 30-day inactivity cleanup; recent log capped. |
| Moderation and reports | Reporter/reported IDs, reason, optional details, IP address, timestamp, status, report action, and visible profile metadata. | LI | Safety review, child-safety response, bans, legal compliance. | Server report storage/admin dashboard. | No automatic expiry currently; may be retained for safety and legal records. |
| Operational/security telemetry | IP mappings, request errors, rate-limit buckets, active calls, active chat pairs, call counters, transfer counters, dependency health, admin audit events. | LI | Abuse prevention, debugging, reliability, and service operation. | Mostly bounded RAM; provider logs may also exist. | Bounded by caps, TTLs, process lifetime, or provider policies. |
One narrow exception: your private keys and local encryption keys are also held server-side as an encrypted key backup (Section 2), so you can recover your account after signing in with Google on a new device. Unlike the data listed above, this backup can be decrypted by us — only through a single rate-limited, audit-logged process gated behind a verified Google sign-in. It does not expose message content, which stays protected by a separate, forward-secure encryption layer this key does not unlock.
You sign in with Google. For a new account, the app generates identity key material on your device and uploads an encrypted backup of it to our server, linked to your Google account (see Section 2). For an existing account on a new or reinstalled device, signing in with the same Google account retrieves and decrypts that backup so your device can restore the same identity, friends, and messages. The stored profile and its private keys live on the device, in native secure storage on Android or browser storage on web, the same as before; the server-side backup exists specifically so losing a device does not mean losing the account.
The client posts signed presence containing rounded location, public key bundle, public profile, rich profile fields, compatibility quiz fields, and privacy flags. The server verifies the signature, sanitizes profile fields, and returns matching peers.
Friend requests and accepts carry signed public bundles and X3DH/ML-KEM handshake material. The broker relays them; clients verify the signatures and derive sessions locally.
Messages are encrypted with a Double Ratchet session before broker delivery or data-channel transfer. The broker may queue encrypted envelopes and service signals but cannot read the message body.
Small chat payloads may travel inside encrypted message wires. Large files are split into encrypted chunks and sent over WebRTC with resume/cancel logic. Local file chunks and metadata are encrypted on device.
Recorded voice notes are encrypted locally, uploaded directly to Cloudflare R2 through a short-lived presigned URL, and referenced by an encrypted chat message that contains the decryption key for the recipient only.
Call setup signals pass through the broker. Audio/video media uses WebRTC encryption and direct P2P paths when possible; TURN may relay encrypted traffic when direct connectivity fails.
FCM delivers data-only notifications. The native Android service shows local notifications and inline reply UI when the app is backgrounded or killed. Notification payloads contain generic text, not message plaintext.
| Data | Retention |
|---|---|
| Current presence | About 35 seconds after last heartbeat. |
| Recent-offline discoverability snapshot | Up to 24 hours. |
| Lookup bundle/cache and last-seen account activity | Up to 30 days after activity. |
| Encrypted friend/block backup | Until account deletion or automatically after 30 days of inactivity. |
| Google-account link, encrypted key backup, and account-recovery audit log | Until account deletion or automatically after 30 days of inactivity; all three are removed together, freeing the Google account for reuse. |
| Full account (inactivity-based auto-deletion) | Automatically tombstoned after 30 days of no app activity. |
| Ephemeral call/WebRTC queued signals | About 15 minutes. |
| Durable signals and sealed offline messages | Up to 7 days. |
| Encrypted R2 voice-note objects | Normally deleted after download/account deletion attempt; lifecycle clears leftovers after up to 14 days. |
| Deletion/ban tombstone | Long-term, to prevent reactivation or ban evasion. |
| Reports and safety records | No automatic expiry currently. |
| Local device data | Until user deletion, local wipe, uninstall, or device/browser storage deletion. |
Users can edit public profile and compatibility fields, hide from Nearby, hide distance, hide last seen, change country label, disable notifications/call sounds/read receipts/profile-photo sharing, choose whether to accept large files, block/report users, export non-key local data, wipe this device, or delete the account.
Data and privacy questions: [email protected]
Support: [email protected]