Privacy Policy

Audio, video, screen shares, chat messages, and reactions are sent directly between participants over WebRTC, encrypted in transit with DTLS-SRTP and, when enabled, with an additional per-frame end-to-end encryption layer whose keys only the participants hold.

Call media never passes through our servers. We operate no media server, no relay (TURN), and no cloud recording pipeline. We cannot see or store the contents of your calls, and we could not produce them if asked. If you record a call, the file is written locally to your own device.

To let two devices find each other, we run a lightweight signaling service (hosted on Supabase). It briefly exchanges connection-setup information only:

• the room code for the call
• session descriptions and ICE candidates (technical connection details, which include IP addresses of the devices connecting)
• ephemeral, randomly generated peer IDs and an optional display name you type
• whether a room has its waiting room enabled, and host approval messages

Signaling rooms and their messages expire and are deleted automatically on a rolling window after a call ends. They are not used to build a history of who called whom.

If you create an account, we store your email address (used to sign you in, typically via a magic link) and your subscription status and plan. That's it — no phone number, no address book, no profile building.

We also keep basic operational logs (for example, connection error events and server error logs) to keep the service working. These are minimal, short-lived, and not used to profile you.

Payments are processed by Apple, Google, or Stripe depending on where you subscribed. We never see or store your card number. We receive only the outcome — that a subscription is active, its tier, and its renewal state — so we can unlock features.

• No advertising, ever.
• No third-party tracking SDKs, ad pixels, or cross-site profiling.
• No selling or renting of personal data to anyone.
• No analytics beyond basic operational logging needed to run the service.
• No AI training on your calls — we have no access to them.

If you choose to enable an AI insights integration, video frames are captured on your own device and sent to the destination you configure. That destination's own privacy terms apply. This is off by default and never routes through us.

4K Chat is not directed at children under 13, and we do not knowingly collect their personal data.

You can request a copy of the account data we hold, or delete your account entirely. Deleting your account removes your stored account data, including your email address and subscription record. Signaling data is already deleted automatically.

To make a request, email joe@resoa.com from the address on your account. We aim to respond within 30 days.

If we change this policy we'll update the effective date above, and we'll notify account holders by email for material changes. Questions? Email joe@resoa.com.