Privacy notice

Last updated 27 September 2026

Who we are

RC Tuners chat is run by [Company name], [Registered address]. For anything about your data, write to [privacy@example.com].

What we keep

Your account: your name, email address, password (only as a one-way hash we can't read back), "About" and profile photo.
What you send: messages, photos, videos, captions, reactions, stars and status updates, and who they were sent to.
Your devices: for each signed-in device, its type (for example "Safari on iPhone"), IP address and when it was last active.
Presence: when you were last online, and when you are typing.
A security log of sign-ins, sign-outs, password resets, blocks, group admin actions and account deletion, with IP address and device.
If you turn on notifications: the address your browser gives for sending them to that device.

We don't read your phone's contacts or location, and there are no ads or tracking.

Notifications

Notifications are off until you turn them on in Settings, for each device.
A notification travels through your browser's push service (Apple, Google or Mozilla), encrypted so that only your device can read it.
With "Show message preview" on, it shows who wrote and what; off, only who wrote. Either way it can appear on your lock screen.
Muted chats don't notify you, and a blocked person's messages never do.

How it's protected

Everything between your device and our server travels over HTTPS.
Messages, captions, status updates, photos and videos are stored encrypted (AES-256), with keys kept apart from the database.
Only the people in a chat can open it. Your online status and status updates are shown only to people who know you: people you share a group with, or whose chat you've accepted.

Messages are not end-to-end encrypted: we hold the keys, so the service could access them if it had to, for example when required by law.

What this looks like

Real examples, made by the app's own code, for the password "Tr4ck-day-2026" and the message "See you at the track at 9!":

Your password, as stored: a one-way hash that can't be turned back into the password

scrypt$Jl1azTXBehSLfdX22zgQmQ==$A7NxM/fnsWKxhiDzQrPvBagUXp1EaJtDDdy7ay/dorqiVeS8xtT9hFx6el2CS0dbIDydjlDBMHCBNDONsLV+Vg==

Your message, as stored: encrypted; only the app's key can read it

enc:v1:k1:AaOqLxwOVTQpIaGt:u4ntWGcBPSXM+OmiQ1iMuQ==:hvv7Md2M8Ms2VzoeAixFWgz0KKRGf/ug83Y=

Your message on its way to us: readable only to our server at the other end

POST /api/sendMessage
content-type: application/json
cookie: rct_session=HRZVgCD88Mw_…

[{"chatId":7,"text":"See you at the track at 9!"}]

The same, as anyone else on the network sees it (over HTTPS)

17 03 03 00 9c 4f e1 0b 7a 22 c9 51 d3 8e 04 6a b2 f7 91 3c 5e … (TLS 1.3 application data; illustrative bytes)

Who can see what

The people in a chat see its messages, and its members see each other's name, photo and "About". Nobody else sees your email address: people find you by your name, or by typing your whole address.
Someone you've blocked can't message you, and doesn't see your online status, last seen, photo, "About" or status updates.
Password-reset emails go through our email provider, Resend, which sees your email address and the reset code, and nothing else about you. We send no other email.
Our staff don't look at your messages, except when the law requires it or to investigate a security incident.

How long we keep it

What	How long
Your account (name, email address, about, profile photo)	Until you delete your account
Messages, photos and videos you send	Until you delete them for everyone. Deleting your account leaves what you sent in the other people's chats, from "Deleted account"
"Delete for me" and "Clear chat"	Hidden from you only; the others keep their copies
Status updates	24 hours
Photos and videos that were never sent, or whose message was deleted	About a day, then removed
Signed-in devices (device type, IP address, last active)	Until you sign out, or 14 days unused, and at most 30 days
Password-reset codes	15 minutes, one use
A sign-up not yet confirmed (name, email, password hash, code)	15 minutes; removed a day later
Notification settings for each device you turned notifications on (the address its browser gave for them)	Until you turn them off, sign in as someone else on that device, or its browser drops them
Security log (sign-ins, sign-outs, blocks, group admin actions, account deletion), with IP address and device	365 days

Your choices

Download everything we hold about you: Settings → Your data → Download my data.
Delete your account: Settings → Your data → Delete my account.
Delete a message for everyone (within 60 hours of sending), or clear a chat for yourself.
See and sign out your devices: Settings → Devices.
Block anyone: from their chat, their contact info, or a message request.
For anything else (a correction, an objection, or a question), write to [privacy@example.com].

Cookies and storage

We use one cookie, to keep you signed in. It can't be read by scripts or sent to other sites. The app also keeps a few small notes in your browser for the page itself (where you are in the app); none of them identify or track you.

Changes

When this notice changes, we'll update the date at the top, and tell you in the app if the change matters.