UmbraChat Privacy Policy
Effective date: March 8, 2026
UmbraChat is a peer-to-peer chat extension/app for ephemeral rooms with text chat, file sharing, audio calls, video calls, and screen sharing. This Privacy Policy explains what data is processed when you use UmbraChat, why it is processed, and what choices you have.
- UmbraChat does not require accounts and does not run a central chat database.
- Messages and media are exchanged directly between peers over WebRTC.
- A small amount of local preference data is stored on your device (for example, nickname and settings).
- Network providers involved in connection setup (relays/TURN) may process network metadata such as IP address.
1) Scope
This policy applies to UmbraChat browser-extension builds and related runtime services used to establish peer connections (for example, signaling relays and TURN configuration endpoints).
2) How UmbraChat works
UmbraChat uses a decentralized signaling layer (Nostr relays) and WebRTC to connect participants in a room. Once connected, chat data and media streams are transmitted peer-to-peer. WebRTC traffic is encrypted in transit (for example, via DTLS/SRTP).
3) Data UmbraChat processes
3.1 Data you enter
- Nickname or display name entered in the app.
- Room name and room password entered by you.
- Chat messages and files you choose to send.
- Audio/video/screen-sharing streams you choose to share.
3.2 Local device data (stored in your browser)
UmbraChat stores limited settings locally to improve usability across sessions, such as:
viewPartyNickname(your saved nickname)umbraChatAppSettings(for example: push-to-talk key, video flip, and volume preferences)
This local data stays in your browser profile unless you clear extension/site storage or uninstall the extension.
3.3 Network and connection metadata
To establish and maintain peer connections, network infrastructure (such as signaling relays and TURN services) may process technical metadata, including IP address, timestamps, and connection diagnostics. In TURN-relayed scenarios, a TURN server can relay encrypted traffic and observe connection metadata required for routing.
4) Data UmbraChat does not intentionally collect as a central service
- No account registration database is required to use UmbraChat.
- No UmbraChat-operated central chat history store is used for room messages by default.
- No advertising profile is built by UmbraChat.
- No sale of personal data by UmbraChat.
5) Browser permissions and why they are used
- storage: saves local preferences (nickname/settings) on your device.
- clipboardWrite / clipboardRead: allows copy/paste support for room info and chat workflows.
- host permissions: allow outbound HTTPS/WSS requests required for relay and TURN connectivity.
6) Legal bases (where applicable)
Depending on your jurisdiction, processing may rely on one or more legal bases, such as your consent, performance of the service you request (real-time communication), and legitimate interests in securing and operating the service.
7) Third parties and service providers
UmbraChat may rely on third-party infrastructure for connectivity (for example, relay operators, Cloudflare-hosted endpoints, and TURN providers). Those providers process data under their own privacy terms. Review their policies before use if this is important for your environment.
8) Data retention
- Local settings remain until you clear browser/extension storage or uninstall UmbraChat.
- Ephemeral room data is designed for live sessions, not long-term central storage by UmbraChat.
- Third-party infrastructure may keep short-lived operational logs under its own retention policies.
9) Security
UmbraChat uses transport-level encryption for peer communications and limits persistent local storage to user preferences. No system is perfectly secure; you are responsible for choosing trusted peers, strong room passwords, and secure devices/networks.
10) International data transfers
Because relay and TURN infrastructure can be globally distributed, technical metadata may be processed in countries outside your own jurisdiction.
11) Children’s privacy
UmbraChat is not directed to children under the age required by applicable local law. If you believe a child has provided personal information through UmbraChat, contact the maintainer to request deletion where feasible.
12) Your choices and controls
- Use a pseudonymous nickname.
- Do not share audio/video/screen unless needed.
- Clear extension/browser storage to remove locally saved settings.
- Uninstall the extension at any time.
13) Your rights
Depending on your location, you may have rights such as access, correction, deletion, restriction, objection, and portability for personal data under applicable privacy laws. Because UmbraChat is designed to avoid central storage, many requests may be fulfilled by local data deletion on your device.
14) Changes to this policy
This policy may be updated to reflect product, legal, or infrastructure changes. The updated version will include a revised effective date.
15) Contact
Privacy questions should be directed to the UmbraChat maintainer through the project support channel or repository listed with your distribution of UmbraChat.