Privacy Policy
This policy explains how Esmeringle (“we”, “us”) handles personal data when you use esmeringle.xyz or esmeringle.pages.dev. We process personal data in line with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). Esmeringle is built to collect as little as possible: there are no accounts, and conversations are not stored.
1. Who is responsible
Esmeringle is the personal information controller. For privacy questions or to exercise your rights, contact our data protection contact at privacy@esmeringle.xyz.
2. What we handle, why, and for how long
- Profile details you choose (nickname, gender, region, up to three topics). Used to match you, and your nickname and gender are shown to the people you chat with; region and topics are only used for matching. All are optional. Kept only in server memory while you are connected, and not saved afterwards.
- Messages, GIFs and emoji. Relayed live between participants and checked automatically for links and certain words. We do not store or log message text. Short previews (up to 120 characters) of recent messages are kept in memory so replies and reactions work, and are deleted when the conversation ends.
- An anonymous device identifier. A random value kept in your browser (local storage). Our server keeps only a keyed, non-reversible hash of it in memory, to apply blocks and temporary restrictions and to avoid re-matching you with the same person. It is lost when the server restarts, and you reset it by clearing your browser data.
- IP address and connection data. Used briefly in memory to limit connections and prevent abuse. Not written to a database. Our hosting provider, Cloudflare, also processes IP addresses and request data to deliver and protect the site, under its own policies.
- Bot check (Cloudflare Turnstile). Before you start a chat, Cloudflare analyses your browser to tell people from bots. After you pass, a signed pass token valid for 24 hours is stored in your browser so you are not asked again.
- Preferences in your browser. Theme and sound settings (local storage) and your current chat setup (session storage, cleared when you close the tab).
- Advertising. Chat pages show a banner from a third-party advertising network (bicea.org). The ad runs in a sandboxed frame that cannot read our storage or your messages, but the network receives your IP address and browser details, and may use cookies or device fingerprinting to choose and measure ads. If you block ads, the banner is simply not shown.
- GIFs and animated emoji. They load directly from third-party servers (Google for animated emoji; Reddit’s image host for GIFs, listed through meme-api.com; GIPHY if we enable it), which therefore see the IP address of everyone who views them.
We do not use accounts, our own cookies or analytics, and we do not sell personal data. We do not ask for sensitive personal information; please do not share it in chats. The optional gender field is a self-description that is not verified and not stored.
3. Purposes and legal basis
- Providing the chat (matching, delivering messages): your consent when you start a chat, and your agreement to our Terms.
- Safety, security and abuse prevention (rate limits, blocks, restrictions, link and word checks, bot check): our legitimate interests, and legal obligations including Republic Act No. 11930 and Republic Act No. 10175.
- Showing ads that keep the Service free: our legitimate interests, with the ad network acting on its own account.
4. Sharing and transfers outside the Philippines
We share data only as described above: with other people in your conversation (the details you choose), with service providers that run the Service (Cloudflare), and with the third parties that serve ads, GIFs and emoji. These providers operate servers in other countries, so data is processed outside the Philippines. We remain accountable for personal data under our control and we use providers that apply security measures and published privacy commitments. We may disclose data we hold where a valid order or lawful request under Philippine law requires it.
5. Security
Connections use HTTPS/TLS. Device identifiers are hashed with a secret key, third-party ad code is isolated in a sandboxed frame, access is rate-limited, and message content is not stored, which limits what could ever be exposed. No system is perfectly secure. If a personal data breach occurs that requires notification, we will notify the NPC and the affected data subjects within 72 hours of knowledge or reasonable belief of the breach, as required by NPC Circular 16-03.
6. Your rights
Under the Data Privacy Act you have the right to:
- be informed about how your personal data is processed;
- object to processing, and withdraw your consent;
- access the personal data we hold about you;
- correct inaccurate data;
- request erasure or blocking of your data;
- data portability, where applicable;
- be indemnified for damages caused by inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorised use of your data;
- lodge a complaint with the National Privacy Commission (privacy.gov.ph).
Email privacy@esmeringle.xyz to exercise these rights. Because we do not keep accounts or message history, we may have nothing to give you beyond what is in your own browser, and we may ask for enough information to identify the data you mean (for example, your device identifier). You can erase what your browser holds at any time by clearing site data. Please try to resolve a concern with us first.
7. Children
Esmeringle is for people aged 18 and over and is not directed to children. We do not knowingly collect data from minors. If we learn that a minor is using the Service, we will restrict the device. Content depicting or exploiting a child is illegal; we will act on it and cooperate with the authorities as required by law.
8. Changes and contact
We may update this policy; the date above shows the current version. Questions or requests: privacy@esmeringle.xyz.