Privacy Policy
Last updated: July 10, 2026
This Privacy Policy ("Policy") describes how the operator ("we/us") handles user information on chat.garando.dev (the "Service"). The Service is designed around "no accounts, no logs, no history," and our basic policy is to collect as little personal information as possible.
1. Information We Do Not Collect
By design, the Service does not collect:
- Account information such as names, email addresses, phone numbers, or passwords (there is no account registration at all)
- Communication content such as chat messages, reactions, or nicknames (never stored on our servers)
To understand and improve how the Service is used, we use an analytics tool (Google Analytics). See "6. Analytics, Cookies, and Third-Party Services" below for details.
2. Information Stored Only on Your Device
The following is stored only in your browser's local storage (on your device) and is never sent to our servers:
- An anonymous device identifier (UID), theme setting, language setting, and display name (nickname)
- Recently created rooms (including their room keys)
You can erase all of this at any time with the "wipe" control at the top of the page.
3. Information Processed Transiently to Establish Connections
To establish a WebRTC connection, connection metadata called SDP / ICE (ICE may include IP addresses) passes momentarily through a Cloudflare Durable Object (the signaling broker) on its way to the other device. This information is neither stored nor logged and is discarded after forwarding. The number of connected participants is counted in memory only while connections exist and is not stored.
4. Encrypted Relay When a Direct Connection Fails
When network conditions prevent a direct (P2P) connection between users, chat content may be forwarded to the other device via our server while still encrypted on the device. The encryption key lives after the "#" in the room URL, which browsers never transmit to servers, so we cannot decrypt or read relayed data. It is forwarded only, never stored.
5. IP Address Exposure in P2P Communication
Because the Service uses P2P, participants connected to the same room may see each other's public IP addresses. This is separate from anonymity toward us and is an unavoidable characteristic of P2P communication.
6. Analytics, Cookies, and Third-Party Services
The Service relies on the following third-party services:
- Google Analytics (GA4): analytics provided by Google LLC, used to understand and improve how the Service is used. Using cookies and similar technologies, it collects usage information such as pages viewed, access times, referrers, approximate region, and device/browser type (not information that directly identifies you). Chat content never passes through our servers in the first place, so it cannot be analyzed. Collected information is managed by Google under Google's privacy policy.
- Cloudflare (Workers / Durable Objects): hosting infrastructure. In processing connections, Cloudflare may handle communication metadata (such as IP addresses) under its own policies.
- Google Fonts: fonts are loaded from Google's CDN, which may transmit your IP address and similar data to Google.
- Google Forms: used for contact inquiries. Submitted content is received by Google and by us, and Google's privacy policy applies.
- TURN (optional feature, disabled by default): only if enabled, already-encrypted traffic may pass through Cloudflare's TURN servers to establish direct connections in strict NAT environments (the content is not decrypted).
Cookies used by the Service originate mainly from Google Analytics above. If you prefer not to be included, you can disable cookies in your browser or use Google's Google Analytics opt-out add-on. For how Google handles information, see Google's privacy policy.
7. Information Received via the Contact Form
We receive whatever you choose to write in the contact form (optional; including an email address if you provide one). It is used solely to respond to and handle your inquiry.
8. Disclosure to Third Parties
We do not provide collected information to third parties except where disclosure is required by law (and the personal information we hold is extremely limited to begin with).
9. Children's Information
The Service is not directed at children under 13, and we do not knowingly collect their personal information.
10. Security
Communication is protected by HTTPS, WebRTC encryption (DTLS), and end-to-end encryption of chat content (AES-GCM). In any case, we do not retain communication content in the first place.
11. Your Rights
Information stored on your device can be deleted at any time with the "wipe" control. For inquiries about content submitted through the contact form, please reach us via the contact below.
12. Changes to This Policy
We may revise this Policy as necessary. The revised Policy takes effect when posted on this page.
13. Governing Law
This Policy is interpreted under the laws of Japan.