VoxaraHow Voxara handles your information
The short version: Voxara stores what it needs to run a chat service you sign in to, keeps it on our own server, never sells it and never shows you advertising. This page lists exactly what that is, who can see it and how to get it removed.
1. Who is responsible
Voxara ("we", "us") operates the service. Questions and requests about your data go to [email protected]. Voxara is operated from the United Kingdom, and this policy is written for the UK GDPR and the EU GDPR; the rights in section 7 apply to you wherever you are.
2. What we collect
Your account
- Username, display name, email address and date of birth. You must be at least 13 to sign up; the date of birth is used only to check that.
- Password. Stored only as a salted scrypt hash. We cannot read it.
- Recovery codes, and if you turn on two-factor authentication, the authenticator secret and backup codes. Codes are stored hashed; the secret is stored so we can verify your sign-ins.
- Optional profile details: picture, banner, bio, status line, accent colour, display preferences (for example reduced flashing) and privacy settings (who can message you or send friend requests).
What you post
- Messages, edits, replies, reactions, polls, pins, bookmarks and scheduled messages, in spaces and in direct messages.
- Files and images you attach or upload, including space icons, banners and custom emoji.
- Spaces, channels, threads, roles and categories you create, and moderation actions you take in them (which are recorded in that space's audit log).
- Reports you file about other people or messages, including a copy of the reported message so it survives deletion.
- Bots and webhooks you create in the Developer Portal. Their tokens are stored hashed.
Connection and technical data
- IP address. Used to apply rate limits and sign-in lockouts, to stop abuse, and it appears in our proxy's access logs. Our domain is fronted by Cloudflare, which sees the same connection data to protect the service.
- Session tokens (stored hashed) so you stay signed in. A session expires after 30 days without use, or when you sign out.
- Window diagnostics. The desktop app occasionally sends a small report about its window (size, position, screen, app version and a short log of window events) so we can fix display problems. It never contains messages or the content of your screen.
- App version when the desktop app checks for updates. That check is anonymous.
Voice, video and screen sharing
- Calls are peer to peer. Audio, video and screen shares travel directly between the people in the call and are never stored on, or passed through, our server. The server only relays the connection setup.
- Because of that, people in a call with you can technically see your IP address, as with any peer-to-peer call. Only join calls with people you are comfortable with.
- To help connections form, the app contacts a STUN server (by default one run by Google), which sees your IP address and nothing else.
- Who is in a voice channel, whether you are speaking and whether you are sharing a screen is shown to the members of that space.
Steam (only if you link it)
- Linking uses Steam's own sign-in. We never see your Steam password.
- We store your Steam ID, profile name, the date you linked and your store region preference.
- We fetch from Steam, using your public profile and subject to your Steam privacy settings: your profile name and picture, your game library and hours played, your recent playtime, your wishlist and what you are playing now. Your friends on Voxara can see these. You are told this before linking, and you can unlink at any time from Settings; unlinking deletes what we stored.
- Steam store browsing inside the app goes through our server, so Steam sees our server, not you. We keep aggregate counts of which store items are clicked to improve what is shown. These counts are not tied to accounts.
Game activity (optional, Windows only)
If "share game activity" is on, the desktop app checks the names of running programs on your computer against a short list of known games and shows the matching game's name as your status. The list of programs never leaves your computer; only the recognised game's name is sent. You can turn this off in Settings.
Link previews
When a message contains a link, our server (not your device) fetches the page to build a preview card, and re-hosts any preview image itself. The site you linked sees our server, not the people reading the message.
The website's preview video
voxaraspace.com shows a preview video hosted on YouTube. Nothing is requested from YouTube until you press play; from that point YouTube (Google) receives your connection data and its own privacy policy applies. We use YouTube's privacy-enhanced embed, which does not set advertising cookies on this site.
Careers mailing list
If you sign up on the website to hear about openings, we store your email address for that single purpose.
3. How we use it
- To run the service: deliver messages, keep you signed in, show your profile to the people you talk to.
- To keep it safe: enforce rate limits, detect and stop abuse, act on reports, apply suspensions.
- To contact you about your account: a welcome message, and notices about suspensions or appeal decisions. We do not send marketing email.
- To improve Voxara, using counts and totals that do not identify anyone.
Under the GDPR our bases for this are performance of our contract with you (running the service), our legitimate interests (safety, security, improvement), your consent (linking Steam, sharing game activity, the mailing list) and legal obligations.
4. Who can see what
| Who | What they can see |
|---|---|
| Members of a space you are in | Your profile, your messages and files in that space, your presence and status, whether you are in a voice channel. |
| Your friends | The above plus, if linked, your Steam details listed in section 2. |
| Space owners and moderators | Everything members see, plus reports made in their space, moderator notes, the audit log, and the tools to remove content, time people out, kick and ban. |
| The Voxara team | Account and content data where needed to run the service, investigate abuse, handle reports about direct messages, or meet a legal obligation. Direct messages are private to their participants but are not end-to-end encrypted: they are stored on our server, encrypted at rest, and can be read by us in those situations. |
| Bots you add to a space | Messages and events in that space, the same as a member. Read the bot's own privacy notice before adding one; its author, not Voxara, decides what it does with that data. |
Service providers who process data for us: Cloudflare (traffic proxying and protection), our hosting provider (the server the service runs on), Steam (when you link it), and an email delivery provider for the account emails above. We do not sell personal data and we do not show advertising.
5. How long we keep it
- Account data: for as long as your account exists.
- Messages and files: until you or a moderator deletes them, or the space or conversation is deleted. Deleting a message deletes its attachments.
- Sessions: 30 days without use.
- Access logs: a short period, typically no more than two weeks.
- Backups: we keep a rolling set of recent server backups (up to 14). Deleted data can remain in a backup until it rotates out.
- Reports and moderation records: for as long as they are needed to handle the report or any appeal.
6. Security
Connections use TLS. The server's data file is encrypted at rest; passwords, tokens and codes are stored hashed. Two-factor authentication is available for every account. Sign-ins are rate limited and locked after repeated failures. No system is perfectly secure, so please use a strong password and turn on two-factor authentication.
7. Your rights and choices
- Access and portability: Settings, Advanced, "Export my data" gives you a copy of your account and content.
- Correction: edit your profile in Settings at any time.
- Deletion: Settings, Account, "Delete my account" erases your account immediately: profile, pictures, every message you sent, friendships, bots, and any space where you were the only person. Anything still pointing at you (a reply, a thread you started) shows "Deleted user". Or email [email protected] from your account's email address and we will do it for you. We may keep what we need to handle an open report or to meet a legal obligation.
- Objection and restriction: you can ask us to stop or limit a particular use of your data.
- Withdraw consent: unlink Steam, turn off game activity sharing, or ask to leave the mailing list, at any time.
- Complain: if you are in the UK you can complain to the Information Commissioner's Office (ico.org.uk); in the EU, to your national data protection authority.
We answer requests within one month.
8. Children
Voxara is for people aged 13 and over. We do not knowingly keep accounts for anyone younger; if you believe a child under 13 has an account, email us and we will remove it.
9. Where data is kept
The service runs on a single server operated by us. Cloudflare may route traffic through its network in other countries to reach it; Cloudflare is bound by data-protection agreements for that processing.
10. Changes
If this policy changes in a way that matters to you, we will say so in the app before the change takes effect. The date at the top is the version you are reading.