Privacy Policy

Last updated: August 6, 2026

What YoungWave Collects

YoungWave collects and processes information needed to run the current chat application:

• Google OAuth profile information, including email, display name, username, profile picture, and authentication identifiers.
• Guest account information, including a temporary YoungWave email address, generated password credential, display name, and account identifier.
• Room messages, direct messages, message timestamps, edit/delete flags, sender identifiers, display names, profile photo URLs, and role snapshots.
• Uploaded media, including images, videos, filenames, file metadata, and PocketBase file storage paths.
• Reactions stored as reaction types and user identifiers.
• Typing indicators stored as room ID, user ID, display name, and timestamps while the typing record exists.
• Room memberships, join requests, roles, ban status, room names, room rules, and room creator identifiers.
• Moderation information such as kicks, bans, deleted message markers, owner/moderator roles, and join-request decisions.
• Operational request logs created by PocketBase, which may include request URLs, status, user agent, IP address, and error details.

Why This Data Is Collected

The data is used to authenticate users, support guest access, show rooms and messages, deliver direct messages, display uploaded media, show reactions and typing indicators, manage room membership, and support owner/moderator controls.

Authentication

Google OAuth is used for Google sign-in. YoungWave receives basic profile information from Google through PocketBase OAuth. Guest sign-in creates a temporary account using a generated YoungWave email address and password credential.

Storage

Application data is stored in PocketBase with SQLite. Uploaded media is stored in PocketBase file storage. The browser also stores PocketBase authentication state and the local agreement flag used by the current application.

Current Retention Behaviour

Chat content, direct messages, room records, membership records, join requests, reactions, and uploaded media remain until deleted by a user, moderator, room owner, backend administrator, or related room deletion flow. Server request logs may be retained for up to 5 days under the current PocketBase configuration.

Current Deletion Behaviour

Guest accounts are deleted when the guest logs out through the current logout flow. Google account deletion is not currently implemented in the application UI. Message deletion is currently a soft-delete behavior that removes message text and reactions but may retain message metadata and uploaded media unless separately deleted. Room deletion removes room messages, members, join requests, typing records, and the room record through the current client flow.

Third-Party Processors

• Google OAuth processes authentication and profile data for Google sign-in.
• PocketBase processes authentication, database records, realtime subscriptions, files, and request logs.
• Cloudflare Pages hosts the static frontend, and Cloudflare Tunnel exposes the PocketBase backend endpoint described by the repository.
• jsDelivr serves the PocketBase browser SDK imported by the frontend.

Security Overview

The current implementation uses HTTPS endpoints, PocketBase authentication, PocketBase collection rules, and PocketBase request logging. Uploaded files and chat records are stored by PocketBase. Security behavior depends on the deployed PocketBase configuration and collection rules.

Current Limitations

• Account deletion for Google-authenticated users is not currently implemented in the application UI.
• Data export, correction request, consent withdrawal, and grievance workflows are not currently implemented as dedicated application features.
• Message deletion is not a complete erasure of all related metadata or files in the current implementation.
• Privacy contact: mohitchaudhary3523@gmail.com