Account details. When you create an account we store your email address and display name. If you sign up with a password, authentication is handled by Google Firebase Authentication and we never see or store the password itself. If you sign in with Google or GitHub, we receive your basic profile — your name, email address and profile picture. For Google sign-in we request only the openid, email and profile scopes; we do not request access to your Gmail, Contacts, Calendar or Drive files.

Content you create. Messages, replies, reactions, polls, saved items, task boards, calendar events, workspace and channel names, and any files you attach.

Profile information. Any optional details you add, such as a profile photo, job title, pronouns, time zone or status message.

Presence and activity. Whether you are online, away, busy or in a call, and when you last read a conversation. This is what makes presence indicators and unread markers work.

Technical data. Basic connection information needed to deliver the service, including IP address and device or browser type. Calls additionally exchange network candidate information between participants in order to establish a direct connection.

Notification tokens. If you enable push notifications, a device token issued by Firebase Cloud Messaging so we can deliver them.

We do not use third-party advertising or analytics trackers, and we do not sell personal information.

We use a small number of strictly necessary cookies to keep you signed in and to remember interface preferences such as light or dark mode. We do not use advertising or cross-site tracking cookies.

To operate the service — delivering messages, connecting calls, syncing tasks and calendars, and showing who is available. To keep accounts secure and investigate abuse. To send service email such as workspace invitations and password resets. To provide support when you contact us.

Audio and video in EptaChats calls is peer-to-peer (WebRTC): media flows directly between participants and does not pass through our servers. When a direct connection cannot be established — common on restrictive corporate or mobile networks — media is relayed through a TURN server (Cloudflare or a self-hosted relay) purely to pass packets between participants. Call media is not recorded unless someone in the meeting explicitly starts a recording, in which case the recording is stored in the connected Google Drive account and everyone in the meeting is told it is being recorded.

We share information only with providers that operate parts of the service on our behalf, and only to the extent needed:

• Google Firebase — authentication, database, file storage and push notifications. Most application data is stored here.
• Google Drive — file attachments and call recordings are uploaded to a connected Drive account belonging to the workspace operator.
• Cloudflare — TURN relay for calls that cannot connect directly.
• Email delivery — Resend or an SMTP provider, used to send invitations and account email.
• Anthropic— if AI writing assistance is enabled for your workspace, the message you are drafting (and, for suggested replies, recent messages from that conversation) is sent to Anthropic's API to generate the suggestion. This happens only when you press the AI button; it is not automatic or continuous.
• PhonePe — if your workspace is on a paid plan, payment and subscription processing. We do not receive or store your card or UPI credentials.

We may also disclose information if required by law, or to protect the rights and safety of our users.

EptaChats is a workspace product. If you join a workspace created by an organisation, administrators of that workspace can see the members of the workspace, manage roles and remove members, and — for conversations they administer — moderate or delete messages. Content you post in a shared workspace is visible to the people that workspace gives access to.

We keep your information for as long as your account is active. Messages you delete are removed from view immediately. You can request deletion of your account and associated personal data by contacting us at the address below, and we will action it within a reasonable period, subject to any records we are legally required to keep.

Data is transmitted over encrypted connections (HTTPS/TLS, and DTLS for call media). Access to production systems is limited to people who need it. Sign-in from the desktop apps uses your system browser with PKCE rather than an embedded browser window, so your Google or GitHub credentials are never entered inside our application.

No system is perfectly secure. If we become aware of a breach affecting your personal data we will notify affected users and any regulator as required by law.

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to withdraw consent. You can edit most profile information directly in the app; for anything else, contact us and we will help.

Our providers may process data in countries other than your own, including the United States. Where required, transfers rely on appropriate safeguards such as standard contractual clauses.

EptaChats is intended for use by organisations and people aged 16 or over. We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us and we will delete it.

We may update this policy as the product changes. Material changes will be reflected in the "last updated" date above, and where appropriate we will notify you in the app.

Questions about this policy, or requests concerning your data: privacy@eptachats.com.