Legal

Privacy Policy

Last updated: October 15, 2026

Who we are

Chatterbox is operated by Dört Yazılım Danışmanlık Ltd. Şti., a company registered in the Republic of Türkiye, which is the data controller for the personal data described here. For privacy questions and data requests, email [email protected].

Business customers that use Chatterbox for their team are covered by our Data Processing Addendum, under which we process their workspace data on their behalf.

What we collect

Email address you provide for sign-in.
Space and room metadata you create.
Chat messages you send (used to render the conversation).
Operational logs (IP address, request trace id, user agent) for security and debugging.
Error reports from your browser (error message, stack trace, page address, browser user agent). The page address drops its query string and fragment unless you accept non-essential cookies.
Daily usage totals (for example, messages sent per space), with no per-person rows.

How we use it

We use your data to provide the Service, authenticate you, prevent abuse, and meet legal obligations. We do not sell personal data.

If you have direct messages or mentions you haven't read 15 minutes after they arrive and you have no Chatterbox tab open, and you have turned email digests on, we email you a short summary of who wrote and where, never the message text. Digests are off by default; you can turn them on under notification settings.

Where your data is hosted

The application, its backend, its database and our self-hosted sign-in service (Keycloak) run on Railway in the europe-west4 region (the Netherlands).

Sub-processors

Railway — application hosting and database (europe-west4).
Resend — transactional email (sign-in links, invitations, notifications). Resend stores email data in the United States.
LiveKit Cloud — real-time audio/video transport for calls. Our LiveKit project is not pinned to a region, so call media may be routed through servers outside the EEA.
Gravatar — when you have no profile picture, our server looks up a Gravatar using a hash of your email address.
Keycloak — our sign-in service at auth.chatterbox.123dort.com, run on Railway (region europe-west4). It holds your sign-in identity, including a password if you set one, and sends sign-in links through Resend.
GitLab (gitlab.com) — only if you link a GitLab account to use the Issues board. We store your GitLab access token encrypted, with read-only API access, and read the issues you can see there.

Error tracking (Sentry), and product analytics and session replay (self-hosted in OpenObserve, described in the Cookies section), are not in use at the moment; if we turn them on, we will list them here first.

International transfers

Using the providers above means some personal data leaves Türkiye and the EEA: Resend stores email data in the United States, and LiveKit Cloud may route call media through servers in other countries. Ask us at [email protected] for details of how a specific transfer is handled.

Data retention

Account data is retained while your account is active. Chat messages in ordinary rooms are deleted 90 days after they are sent, together with their earlier revisions. Messages in rooms marked as audited are kept under that room's retention. You can delete your account at any time from Data and privacy settings; doing so anonymizes your profile (we null your email, name, and avatar). Thirty days after that, the messages, direct messages and uploads you sent are permanently deleted, along with the earlier revisions of those messages. Messages in rooms marked as audited, and their uploads, are kept under that room's retention. We keep an anonymized account record with no personal data attached.

Your rights

Under Turkish Law No. 6698 on the Protection of Personal Data (KVKK), and, if you are in the EEA or the UK, under the GDPR / UK GDPR, you have the right to learn whether your data is processed, to access it, to have it rectified or erased, to object to or restrict processing, to data portability, and to know which third parties receive it.

You can exercise the core rights yourself from Data and privacy settings: download a JSON export of your profile, space memberships, and the chat messages and direct messages you sent (access/portability), and delete your account (erasure). You can edit your profile (rectification) on your profile page. For anything else, email [email protected].

You also have the right to complain to a supervisory authority: the Personal Data Protection Board (KVKK Board) in Türkiye, or your local data protection authority if you are in the EEA or the UK.

Cookies

We set first-party cookies only. None is used for advertising, and we set no third-party tracking cookies.

session-token — strictly necessary: keeps you signed in.
chatterbox_cookie_consent — records the choice you make in the cookie banner (the single word "accepted" or "rejected") so you are not asked again. It lasts one year and is mirrored in your browser's local storage as chatterbox.cookie-consent.v1.
__chatterbox_csrf — strictly necessary: protects form submissions against cross-site request forgery. It lasts four hours.
cb_pending_join — strictly necessary: remembers the space invite you opened while signing in, so you can join it afterwards. It is sent only to the join page and lasts 15 minutes.
cbx_sso_retry — strictly necessary: stops a failed single sign-on from retrying in a loop. It lasts one minute.
cbx_sso_callback — strictly necessary: remembers the page to return you to after single sign-on. It is HTTP-only and lasts ten minutes.
JSESSIONID — strictly necessary: holds the sign-in handshake while you sign in with single sign-on and while you link a GitLab account. It is a session cookie with no fixed expiry.
_oo_s_v2 — set only when product analytics is switched on and you accept. It is not set while analytics is off. It identifies the analytics session and expires after a period of inactivity.

Whatever you choose, when the app hits an uncaught error it sends us the error message, stack trace, page address and browser user agent so we can fix it. Without your consent the page address is cut down to its path, dropping the query string and fragment.

Product analytics and session replay are not running at the moment, so your choice does not switch on any analytics or replay. If we turn them on, the Sub-processors section will list them first.

You can change your mind at any time. The button below clears the stored choice and shows the cookie banner again.