Your privacy.

Who is responsible

Fiston operates StrangerHop and is responsible for the application’s use of your personal information. Contact the operator for privacy questions or to exercise your rights.

We use session, preference, and account records to provide the service you request under our terms. Safety checks, reports, restrictions, and limited reliability records serve our legitimate interests in protecting participants and keeping the service secure. Where a provider requests consent for an age-check method, its notice explains that choice. Entry checks are required to participate; an optional account is not.

Your visit

StrangerHop uses a secure session cookie to remember your visit, language, acknowledged guidelines, and age-check status. A guest visit expires after 24 hours, or after two hours without activity. Clearing cookies can end your guest progress.

An optional account

If you choose an account, Clerk handles sign-in and your email address. An account helps you return to the same entry progress. Your email and profile aren’t shown to conversation partners. Clerk processes data on US infrastructure; the platform’s EU storage choices do not make every provider EU-only.

Account entry preferences and account links remain while the account is active. Signing out does not delete them. Verification and acknowledgment records have their own expiry and cleanup periods. You can request account and data deletion. A minimal deleted-account marker remains to reject delayed sign-in attempts, without profile, preferences, verification records, or chat messages.

Your age check

The entry page names the provider that hosts your age check: Didit or Yoti. StrangerHop does not store identity documents, selfies, or your date of birth. We retain the age decision, provider, verification method and policy, timestamps, expiry, and the references needed to confirm the result.

An approved account check can be reused until the expiry shown on your entry page, including after signing out or signing in to the same account on another device. A revoked result or a change to our verification requirements can end that validity earlier. A guest check lasts only for its guest visit and does not transfer to an account. Sign in before starting a check if you want to save it with your account.

Didit processes your document and camera check directly. Our production application is configured for one-month verification-record retention and deletion of face templates with the session. Our organization has opted out of Didit model training. Provider records are separate from StrangerHop’s limited eligibility records. We request earlier erasure for cancelled or expired checks and accepted erasure requests. Provider backup lifecycles and legally required restricted retention can differ; this is not a guarantee that every provider copy disappears immediately. Read Didit’s notice before proceeding.

Yoti has its own processing and retention policies.

Finding a stranger

Matching uses your chosen language, current eligibility, and connection status. Your partner sees that you are connected, without seeing your email, account details, or verification information. You can cancel a search or leave a match at any time.

We keep limited connection records to prevent duplicate matches and recover interrupted requests. Only the current conversation can be recovered while it remains active.

Your conversation

Before a message reaches your partner, we check it against our guidelines and send its text to Microsoft Azure AI Content Safety. We do not send your account details or age verification information with it. If safety checks are unavailable, the message is not delivered. Automated checks can make mistakes.

Messages are kept temporarily to handle delivery and reconnects. They expire within 24 hours of first being accepted and are removed earlier when the conversation ends. A report creates a separate evidence copy with the retention described below. Reconnecting or retrying does not restart that clock. Leaving clears your transcript; there is no conversation history to return to. Your partner can still copy or screenshot anything they receive, so keep personal details private.

Reports, blocks, and review

Report and leave lets you select up to 20 delivered messages from your partner. The server saves those messages and up to ten nearby delivered messages for context, including your messages, before ending the conversation. We do not accept an uploaded transcript or a freeform report note. Reporting does not automatically block your partner or restrict their participation.

Report evidence and review decisions are kept for 30 days from the original capture. Authorized moderators can read this evidence; participant access does not grant review access. The review page does not show account details, age-check data, or internal identity identifiers. The evidence is held separately from ordinary delivery records, whose original expiry does not change. Leaving clears your visible chat, but does not erase a report that was already saved.

Block and leave records the pair of internal identities for 30 days, with up to 100 active blocks per initiating identity. A block follows an account, or applies to a guest visit, and does not retain message evidence. It cannot identify someone returning with a new identity. Retrying a saved block does not extend its original expiry.

Moderators can dismiss a report or restrict participation for up to 24 hours or seven days, bounded by the report’s expiry. An existing longer restriction remains in place. A restriction prevents entry into matching and conversations without changing the age decision. Compact action identifiers and timing records are retained for up to 45 days to prevent repeated or older moderation actions from being applied again. Those compact records do not contain report messages.

Keeping entry reliable

Cloudflare Turnstile helps distinguish people from automated visitors. Cloudflare hosts the application and identity state; Neon stores limited supporting records and private report evidence in Europe. We use limited operational records to investigate failures and abuse, without recording verification documents, authentication tokens, or the contents of your requests.

Sentry receives sanitized error information to help diagnose failures. Hosting, security, account, verification, and email providers can process network metadata such as IP addresses and browser information under their own policies. EU storage placement for application records does not mean all processing stays in the EU. Contact us for information about providers and safeguards for transfers outside the EEA.

If you email support, the operator and email providers receive your address and what you send. That correspondence is used to answer your request and document its outcome, and is retained while needed for that purpose or an applicable legal obligation. Do not send verification documents, passwords, sign-in codes, cookies, or chat transcripts.

Your choices

You can cancel an outstanding check or sign out from entry. Signing into an account ends the guest visit; guest eligibility does not transfer.

You can request access, correction, deletion, or other privacy rights, or ask for review of a moderation decision. Rights depend on applicable law and the records we can identify. You may complain to your data-protection authority. Age eligibility and message moderation involve automated checks; a failed check can prevent entry or delivery, and you can contact support about a mistake.