Privacy & Security

Privacy Policy

Last Updated: September 23, 2026 • Effective Immediately

1. Overview & Data Controller

At Firetalk ("Firetalk", "we", "us", or "our"), your privacy and data security are fundamental priorities. This Privacy Policy details our practices regarding the collection, transmission, processing, storage, and erasure of personal information collected through our web portal (https://firetalk.net), desktop applications (Windows & macOS), mobile applications (iOS & Android), WebRTC voice and video streaming network, short-form media ("Reels"), and community messaging systems (collectively, the "Services").

Firetalk operates as the primary data controller responsible for personal information processed through the platform. For financial transactions, purchases of Firetalk Credits, and subscription billings, our certified Merchant of Record partners, including Paddle (Paddle.com Inc. / Paddle Payments Ltd.) and PayPal, act as independent or joint data controllers for payment cardholder data and regional tax filings.

2. Categories of Information We Collect

We collect information in three principal categories:

A. Information You Provide Directly

  • Registration Details: Unique nickname, username, verified email address, hashed authentication credentials, account creation timestamp, and optional telephone number.
  • Profile Attributes: Custom status message, biographical text ("Bio"), uploaded avatar images, banner graphics, country selection, gender indicator, birthday, and custom nickname display colors.
  • User-Generated Content: Text messages sent in public chat rooms and private instant messages (IMs), public posts, uploaded short-form video Reels, cover thumbnails, and story publications.
  • Support Communications: Diagnostic logs, customer support tickets, email inquiries, and dispute records submitted to our help desk.

B. Information Collected Through Interactions & Economy

  • Credits & Gifting Ledger: Records of credits purchased, gift packs selected, timestamps of gifts sent or received in voice/video rooms, sender and receiver identifiers, gift animations triggered, and room host revenue splits.
  • Creator Earnings & Payout Records: Broadcaster earnings accumulated, pending balances, settlement dates, cashout withdrawal requests, and associated withdrawal channels (e.g., PayPal recipient email or banking details).
  • Social Graphs: Added pals list ("Pal List"), blocked user lists, room administrator rosters, room favorites, followers, and following connections.

3. Automatic Technical Logging, IP Monitoring & Session Tracking

To maintain real-time presence indicators, prevent distributed denial-of-service (DDoS) attacks, detect bot networks, and protect broadcasters from payment fraud, our servers automatically record detailed technical metrics upon every client connection:

Recorded Technical Metrics:
  • Internet Protocol (IP) Address: Recorded upon connection, room entry, and payment authorization for geolocation, anti-abuse, and blacklist enforcement.
  • Session Duration & Activity Timestamps: Connection start and disconnect times, exact duration spent in specific chat rooms, microphone speech burst durations, and platform idle periods.
  • Hardware & System Fingerprints: Operating system edition (Windows, macOS, iOS, Android), client software build version, device hardware specifications, GPU rendering profile, display resolution, and network adapter connection type.
  • WebRTC Real-Time Telemetry: Audio packet loss rates, video bitrates, frame rates, jitter buffer latency, and ICE candidate connection routes to optimize server relay paths.

These technical metrics are processed through our administrative security and monitoring console to detect multi-account ban evaders, spammers, and credit card fraudsters in real time.

4. Voice, Video Streaming & Reels Media Processing

Firetalk is built upon high-performance real-time communication architectures:

  • Real-Time Voice and Video Streaming: Voice and camera video streams transmitted in rooms are processed using secure WebRTC protocols (LiveKit infrastructure) encrypted in transit via DTLS-SRTP. Ephemeral live audio/video streams are relayed in real time between participants and are not continuously recorded or archived to platform storage unless specifically initiated as a public broadcast recording by an authorized host.
  • Short-Form Video Reels & Stories: Media uploaded to the Reels feed or user stories is transcoded, compressed, and stored across secure, distributed content delivery networks (CDNs). Public Reels are discoverable and viewable by other Firetalk members worldwide.
  • Moderation Screening: Uploaded media, avatars, and public Reels may be automatically analyzed by automated moderation hashes to detect prohibited child exploitation material (CSAM), severe violence, or copyright violations.

5. Economy, Real-Money Credits & Creator Payout Data

Because Firetalk supports a genuine creator economy where virtual credits hold monetary value and convert into real creator earnings, strict financial recordkeeping is enforced:

  • Payment Processing: When purchasing credit packs or subscription memberships, credit card numbers, CVVs, and full cardholder data are processed directly by our Merchant of Record, Paddle or PayPal, using certified PCI-DSS Level 1 infrastructure. Firetalk never stores or retains your raw credit card numbers on our servers.
  • Payout Identity & AML Verification: When creators request cashout withdrawals for accumulated earnings, we collect and store withdrawal transaction identifiers, recipient account details (e.g., PayPal email address), and, where required by regulatory thresholds, tax classification forms (W-9 / W-8BEN) and proof of identity to satisfy Anti-Money Laundering (AML) and anti-terrorist financing obligations.
  • Audit Ledger: Every credit transfer, purchase, gift transaction, and withdrawal is logged in an immutable database ledger (`wallet_transactions` and `creator_earnings`) with millisecond timestamps and unique transaction UUIDs.

6. How We Use Collected Information

We process your data strictly for legitimate operational purposes:

  1. Service Delivery: Establishing real-time voice, video, text chat, and room broadcasting channels.
  2. Economy Fulfillment: Instantly delivering purchased credits, activating colored nickname subscriptions, upgrading room capacities, and calculating creator revenue shares.
  3. Safety & Abuse Prevention: Enforcing room rating policies (G-Rated vs R-Rated), preventing pornography, blocking multi-account spammers, and maintaining hardware and IP blacklists.
  4. Regional Law Compliance: Restricting access to mature (R-Rated) rooms for connections originating from jurisdictions where local laws prohibit such content (such as Saudi Arabia and the UAE).
  5. Platform Diagnostics: Investigating audio latency issues, resolving client crashes, and optimizing server cluster resources.

7. Third-Party Service Providers & Subprocessors

We do not sell, rent, or trade your personal information to third-party data brokers. We share limited, necessary data with trusted subprocessors strictly to deliver our platform services:

  • Payment Gateways & Merchant of Record: Paddle and PayPal for billing, credit card authorization, global tax handling, and fraud protection.
  • Live Streaming & Real-Time Infrastructure: LiveKit for WebRTC audio/video mesh routing.
  • Cloud Infrastructure & Security: Distributed VPS, Redis memory caching, and Cloudflare for DDoS protection and static asset delivery.
  • Email Delivery: Transactional SMTP mail servers for password resets, email verification, and official payout status notices.
  • Law Enforcement & Regulatory Authorities: We disclose user identifiers, IP connection histories, and transaction ledgers when required under valid judicial subpoenas, court warrants, or to combat child exploitation.

8. Cookies, Local Storage & Session Tokens

We use browser `localStorage`, `sessionStorage`, and essential cookies strictly to maintain user authentication sessions, preserve interface preferences (such as Dark/Light theme), and verify security tokens. We do not use intrusive third-party cross-site advertising trackers that profile your browsing behavior across unrelated websites.

9. Regional Compliance & Geographic Filtering (KSA / GCC)

Firetalk respects the legal frameworks and telecommunications authorities governing digital communications across sovereign jurisdictions:

  • GCC / Middle East Compliance: Pursuant to telecommunications regulations issued by the Communications, Space & Technology Commission (CST) in Saudi Arabia and the Telecommunications and Digital Government Regulatory Authority (TDRA) in the United Arab Emirates, users connecting from these jurisdictions are automatically filtered from accessing R-Rated rooms to comply with local public order statutes.
  • Cross-Border Data Handling: Server records are stored in secure datacenters equipped with physical access controls, multi-factor authentication, and encrypted backups.

10. Global Privacy Rights (GDPR & CCPA / CPRA)

Regardless of your country of residence, Firetalk extends comprehensive privacy protections to all registered members:

  • Right of Access & Portability: You may request a complete copy of the personal information associated with your account in a machine-readable format.
  • Right to Rectification: You may update your profile details, bio, avatar, and linked email address at any time through Account Settings.
  • Right to Restrict Processing: You may object to specific administrative data processing where applicable by contacting our privacy desk.
  • California Privacy Rights (CCPA / CPRA): We do not sell your personal information or share it for cross-context behavioral advertising. You have the right to request deletion of your information and to be free from discrimination for exercising your privacy rights.

11. Account Deletion & Data Erasure Protocol

One-Click Permanent Account Deletion:
You retain the absolute right to terminate your account and erase your personal records at any time:
  1. In-App / Website Deletion: Log into Firetalk, navigate to My Account (https://firetalk.net/account), scroll to the Security section, and select Delete My Account.
  2. Email Deletion Request: Alternatively, send an email to privacy@firetalk.net with the subject line "Account Deletion Request" from your registered email address.
  3. Data Purge Timeline: Upon receiving your deletion confirmation, your account is immediately deactivated. All profile information, avatars, private messages, social connections, and linked OAuth tokens are permanently purged from active production databases within forty-eight (48) hours. Transactional financial records required for statutory tax accounting are archived in offline cold storage for the duration mandated by law.

12. Protection of Children & Age Restrictions

Firetalk does not knowingly solicit or collect personal information from children under the age of thirteen (13). To participate in mature rooms, purchase credits, or receive creator payouts, users must be at least eighteen (18) years old. If a parent or guardian discovers that a minor has created an account without parental consent, please contact us immediately at safety@firetalk.net so that we may verify and permanently remove the account.

13. Security Architecture & Data Protection Measures

Firetalk implements rigorous administrative, physical, and technical safeguards:

  • Encryption in Transit: All data transmitted between client devices, the web portal, and backend APIs is encrypted using Transport Layer Security (TLS 1.3) with modern cipher suites.
  • Cryptographic Password Hashing: User credentials are protected using salted, memory-hard cryptographic hash functions (Argon2 / scrypt) to prevent brute-force recovery.
  • Database Segregation: Financial transaction ledgers, authorization tables, and WebRTC streaming nodes reside in isolated network tiers protected by strict internal firewalls.

14. Contacting Our Data Protection Officer

If you have questions, feedback, or concerns regarding this Privacy Policy or our data protection practices, please contact our Data Protection Officer: