chideout™Terms of Service

Chideout Privacy Policy

Last Updated: October 31, 2026
Version: 1.2

This Privacy Policy explains how Jellyball LLC (“Company,” “we,” “us,” or “our”), the company that operates Chideout, collects, processes, hashes, stores, and protects your information when you use Chideout. This Policy is designed to comply with applicable US federal and state privacy laws, including the California Consumer Privacy Act (CCPA/CPRA), the Virginia Consumer Data Protection Act (VCDPA), the Maryland Online Data Privacy Act (MODPA), and, where applicable, the General Data Protection Regulation (GDPR).

1. Information We Collect & How We Collect It

A. Account & Authentication Data

  • Email & Password: You create an account with an email address and a password. We confirm the address by emailing you a 6-digit code. We store your email address encrypted (AES-256-GCM) so we can send you account emails (sign-up and password-reset codes, and security notices such as “your password was changed”), plus a keyed hash (HMAC-SHA256) to look it up when you sign in; it is never shown to other users. Your password is never stored—only a salted scrypt hash of it. We don’t send marketing email. Emails are delivered by Amazon Web Services (Amazon SES).
  • Two-Step Sign-In (Optional): If you turn it on, we store an encrypted secret shared with your authenticator app, and hashes of your one-time backup codes. We use them only to check the codes you enter when signing in or changing security settings.
  • Google & Apple Sign-In (OIDC): When you sign in via Google or Apple, we receive and store your immutable provider identifier (sub claim), email address (including Apple Private Relay addresses if you select “Hide My Email”), and basic profile display name.
  • Phone Number Verification (SMS OTP): Accounts created before email sign-in was introduced may sign in with a mobile phone number until they add an email. When you sign in with or link a mobile phone number, we verify ownership via a 6-digit SMS code, normalize the number to E.164 format, and store only a keyed cryptographic hash (HMAC-SHA256) alongside your verified profile record. We currently send codes only to US mobile numbers. To deliver the code, your number is sent to our SMS provider, Twilio, which processes it under its own privacy terms; we do not store the number itself.
  • Age Confirmation: When you create an account, we ask for your date of birth only to confirm that you are 18 or older. We do not store your date of birth—only the fact and time that you confirmed eligibility. If you are not eligible, no account is created; we keep only a keyed hash of the email address, phone number or sign-in account you used, for up to one year, so the same identity can’t immediately retry with a different date, and your browser receives a cookie (ch_age_block) that prevents a retry for 24 hours. Your account also works on our all-ages game Jelly Ball (jellyball.io); accounts created there by people under 18 cannot use Chideout and are covered by the Jelly Ball Privacy Policy.
  • Profile: Your display name, @username and optional profile photo are shown to your friends, in private Fight Chats, and in any public Fight Chat where you choose to reveal yourself.
  • Connected Social Accounts (“Chide It Out”): If you voluntarily link Snapchat (via Snap Kit OAuth), we store your Snapchat external_id, display name, and encrypted access and refresh tokens (access_token_enc). If you link Instagram by sending a one-time code by direct message to our official Instagram account, Meta gives us your Instagram username and an Instagram-scoped ID, which we store; no Instagram access token is stored for your account.

B. Hashed Contact Syncing (inContacts)

If you opt in to sync your contacts to discover friends or rivals:

  • We Never Store Raw Non-User Address Books: Phone numbers from the contacts you choose to sync are normalized to E.164 format and hashed (SHA-256) on your device before they are sent. Our server then applies a second, keyed hash (HMAC-SHA256 with a secret server-side pepper) and stores only that result. Because the number of possible phone numbers is limited, hashing is not the same as anonymization: we do not attempt to reverse these hashes, and we use them only for the matching described below. You can remove your synced contacts at any time in Account Settings.
  • We only store and compare these one-way hashes (user_contact_hashes) against Chideout users who have verified their phone number and explicitly enabled the “Findable by Phone” (findable_by_phone = true) privacy toggle.

C. User Content, Narrative Memory Hashes & Image Scrubbing

  • AI Redactor & Keyed Narrative Memory (keyHash): Before any post, comment, or Fight Chat message is written to our database, the Redactor scans the text to scrub recognizable real names and contact details. To keep pseudonyms consistent within a single story or chat (e.g., always replacing the same person with the same stand-in name), our server stores a cryptographic one-way hash (keyHash) of the scrubbed token scoped strictly to that post or chat—we do not store the underlying plaintext third-party names in our database.
  • Uploaded Images (Metadata Removal & Safety Check): When you upload an image (a photo in a post or chat, a profile photo, or a Fight Chat icon or background), it is re-encoded on your device and we strip all embedded metadata (including EXIF GPS coordinates, camera details, and text comments) again on our server. Before a photo is attached to a post or chat message, including in private chats, it is checked by an AI model (Anthropic’s Claude) for nudity, sexual content involving minors, graphic violence and readable personal information (such as addresses, phone numbers, license plates or ID cards), and, on public surfaces, for screenshots showing private people’s names. For public posts and public-chat messages, the text you post with the photo is sent along as context; private-chat text is not. The check does not identify people from their faces. Photos are visible only to signed-in users (photos in a private chat only to people in that chat). When a post or message with a photo is deleted or removed, the photo stops being shown and a copy is kept for up to ninety (90) days, visible only to our moderators, for the same safety and legal reasons as the audit log described in Section 4; it is then permanently deleted. Reported images are also reviewed by our moderators.

D. Financial & Payout Data (Stripe Connect)

We do not collect or store your raw credit card numbers, bank account numbers, or Social Security Number / Taxpayer Identification Number on Chideout servers. All Reward payments and Creator Share payouts (including KYC identity verification and IRS 1099 tax reporting) are collected and processed directly by Stripe, Inc. pursuant to the Stripe Privacy Policy. We only store your stripe_account_id, payout eligibility boolean (payouts_enabled), and transaction ledger identifiers (stripe_payment_intent_id).

2. How Server-Side Anonymity Works on Chideout

We architected Chideout to enforce a strict cryptographic and serialization boundary between our database and public browsers:

  1. Feed Posts & Comments (Hideout, Graveyard, Burner): Our database records your internal author_id on posts and comments solely so you can receive OP thread badges, collect 50% Creator Share Rewards, and delete your own posts (trulyDeletePost). Our API serializer strips author_id from all public network responses. Other users’ browsers never receive your user ID, email, or handle on anonymous feeds; instead, the server returns computed boolean flags (isAuthor and canReward) specific to the viewing session.
  2. Fight Chats & Voluntary Reveal (handleReveal): In anonymous or public group Fight Chats, your real profile handle and avatar are stripped by the server unless and until you explicitly click “Reveal Identity” (handleReveal), which adds your ID to chat.revealedIds for that specific chat. You can go anonymous again at any time.
  3. Your Anonymous Mask: In public Fight Chats you appear under a mask such as “Cobalt · Agent #4092”. You get a different mask in each public chat, so other people cannot tell that messages in different public chats came from the same person, and revealing yourself in one chat does not reveal you in any other. Feed posts get a new random label (for example “Anon Ranter #902”) each time, and commenters get a different label on each post, so feed activity cannot be linked that way.

3. Cookies, Session Architecture & Advertising

We do not use behavioral (personalized) advertising or sell your data to data brokers. We use these strictly necessary first-party cookies to secure your account:

  • ch_sid (HttpOnly, Secure, SameSite=Lax, 30-day rolling expiration): Stores your opaque 256-bit server session identifier. Because it is HttpOnly, client-side scripts cannot read or steal your session token.
  • ch_oauth_state (HttpOnly, encrypted, 10-minute expiration): Temporarily stores cryptographic state and PKCE code_verifier parameters during Google, Apple, or Snapchat login redirects. It uses SameSite=Lax, except for Sign in with Apple, which returns to us with a cross-site form submission and therefore requires SameSite=None; Secure.
  • ch_signup (HttpOnly, 30-minute expiration): Holds an opaque reference to an unfinished sign-up while you choose your name and username.
  • ch_age_block (24-hour expiration): Set only if you were not eligible to sign up, to prevent an immediate retry.
  • ch_csrf: Used alongside our X-CSRF-Token header to prevent Cross-Site Request Forgery on state-changing actions.
  • ch_appeal (HttpOnly, encrypted, 2 hours): Set only when a ban stops a sign-in or sign-up, so you can appeal the ban from the sign-in page.
  • ch_dev (HttpOnly, up to 400 days): A random identifier for your browser, used only for security: to stop accounts that were banned for breaking our Terms from signing up or signing in again from the same browser, and to help moderators spot one person running several accounts. We store only a keyed hash of it, and it is never used for advertising.

Advertising: Busy feeds may show an occasional ad from Google AdSense between posts, always labeled “Advertisement.” Ads never appear inside chats. We ask Google for non-personalized ads, which are not based on your browsing history or profile, but Google may still use cookies, your IP address and device information to deliver ads, limit how often you see the same ad, measure them and prevent fraud. Google acts under its own privacy terms. We never give Google your name, phone number, account details or what you post. Where the law requires your consent for advertising cookies, we ask for it first.

4. Data Retention, “Forever” Mechanics & Your Right to Delete

Privacy laws grant you the right to access, export, and delete your personal data. Here is how your deletion rights interact with Chideout’s core mechanics:

  1. Self-Deleting Individual Posts (trulyDeletePost): You may delete any post you authored on the Hideout, Burner, or even after it has been buried in the Graveyard (h/graveyard), at any time while logged into your account. Self-deleted posts are removed from our active database immediately; a copy is kept only in our encrypted safety audit log for up to ninety (90) days and then permanently erased.
  2. Full Account Deletion & De-Identification Protocol: When you submit a verified request to delete your Chideout account:
    • Your profile, email, phone number, phone_hash, connected OAuth tokens (connected_accounts), and contact sync hashes (user_contact_hashes) are permanently deleted.
    • Graveyard Posts & Fight Chat Forks (handleFork): You may choose during account deletion to either purge all of your authored posts or leave them anonymized. For shared Fight Chats (including forked chat rooms where other users are participants), your messages remain in the room so other participants’ conversation logs are not broken, but your sender_id is permanently severed (SET NULL) and any revealed profile metadata is replaced with a generic [Deleted User] tombstone so the messages can never be linked back to you.
  3. Security, Chargeback & Law Enforcement Exceptions:
    • 30-to-90-Day Security Audit Log: To prevent ban evasion, payment fraud, chargebacks, and illegal content, we retain an encrypted server-side audit log of deleted/expired content (including expired 24-hour Burner posts and unsent chat messages) for up to ninety (90) days, after which it is automatically and permanently purged.
    • Legal Preservation & CSAM Reporting: We will preserve and disclose account records, IP addresses, and content if required to do so by a valid subpoena, court order, search warrant, or preservation request under 18 U.S.C. § 2703(f), or to fulfill our mandatory legal obligation to report suspected Child Sexual Abuse Material (CSAM) to the National Center for Missing & Exploited Children (NCMEC) under 18 U.S.C. § 2258A, or to prevent an imminent threat of death or serious bodily harm.

5. Service Providers & Technical Data

  • Who receives data to run Chideout: our hosting and database providers (all account and content data), Amazon Web Services (your email address and the content of account emails, to deliver them through Amazon SES), Twilio (your phone number, to send sign-in codes, for accounts that still use phone sign-in), Stripe (payment and payout information, as described above), Anthropic (the text of public posts, comments, public-chat messages and public chat names, which our AI Redactor sends to Anthropic’s Claude model to find names and identifying details before anything is published; private-chat text is never sent; and every photo attached to a post or chat message, for the safety check described in Section 1), and Google, Apple, Snap or Meta only when you choose to sign in with or connect those services. Google AdSense (device and cookie data, only where ads are shown, as described in Section 3). Each processes data under its own terms. We do not sell personal information or share it for cross-context behavioral advertising.
  • Technical data: We record your browser’s user-agent and session times so you can see and sign out your devices in Account Settings.
  • Security & spam prevention: To protect Chideout from spam, bots, fake accounts and abuse, we automatically evaluate account activity, including how old an account is, how often it posts, whether it repeats the same text or posts many links, whether many accounts post from the same network, and past violations of these limits. We use your IP address for this, but we never store it in readable form: we store only a keyed cryptographic hash of your network (for IPv6, of the /64 network), and we delete it after 30 days. We also keep keyed hashes of recently posted text for 2 days to detect copy-paste flooding, and records of spam-filter violations for 30 days. The result may be stricter limits, a temporary pause on posting, or a refused sign-up; it never reveals your identity to other users and is not used for advertising or sold. We do not use browser fingerprinting. We rely on our legitimate interest in keeping the service secure (GDPR Art. 6(1)(f)); if you believe a limit was applied to you by mistake, contact [email protected] and a person will review it.
  • Bans: If an account is banned for serious or repeated violations, we keep keyed hashes (never the readable values) of its phone number, email address, sign-in and connected accounts, and, if a moderator chooses, of the browsers (ch_dev) and networks it used, so they can’t be used to create a new account. Network blocks expire after at most one year; the rest last as long as the ban. If you appeal a ban, we keep your appeal and (if you give one) a contact email, encrypted, to review it and reply. When sign-ups or sign-ins come in, we may check the IP address with a VPN/proxy detection service (proxycheck.io), which receives the IP address only.
  • Suspected child sexual abuse material: If an upload or reported content appears to be child sexual abuse material, we do not publish it. We keep it, the related text, the time and the uploader’s IP address encrypted and accessible only to our safety team for one year, as US law requires of providers that report to NCMEC (18 U.S.C. § 2258A), and the account is suspended pending review. This is the only case in which we keep an IP address in readable (decryptable) form.
  • Reports: If you report content, we store the report, the reported item and your account ID so moderators can review it.

6. Your State & International Privacy Rights (CCPA, VCDPA, MODPA, GDPR)

Depending on your jurisdiction, you have the right to:

  • Know / Access: Request a copy of the personal data we hold about your account.
  • Delete / Erase: Request deletion of your account and personal data (accessible directly via Account Settings -> Delete Account, or by emailing us).
  • Opt-Out of Phone Discovery: Toggle findable_by_phone off at any time in Account Settings → Find friends so your hashed phone number cannot be matched via contact sync.
  • No Sale or Targeted Advertising: We do not “sell” or “share” personal information as defined under the CCPA/CPRA or MODPA.

To exercise any of your privacy rights, use the in-app Account Settings controls (including Download my data).

7. Changes to This Policy

When we change this Policy, we will update the version number and date above and ask you to review and accept the new version before you continue using Chideout.