Privacy policy
Exploitant: Limassol, Cyprus
Short version: no account, no recording, no advertising trackers. This policy explains exactly what happens with your data, wherever in the world you are.
Who is responsible for your data
The service is run by the operator named at the top of this page (the "controller" in data protection law). You can reach us at support@spymelive.com for anything about your data. This policy applies to visitors in all countries and is written to meet the main data protection laws, including the EU and UK GDPR, the California CCPA/CPRA and other US state laws, Brazil's LGPD, Canada's PIPEDA, Australia's Privacy Act, India's DPDP Act, Japan's APPI, South Korea's PIPA and South Africa's POPIA. Where a local law gives you more rights than this policy, you have those rights.
Video, audio and text messages
Video, audio and text messages travel directly between your browser and your chat partner's browser (peer to peer) and are encrypted by WebRTC. They do not pass through our servers and we do not record or store them. If a direct connection is not possible, an encrypted relay server (TURN) forwards the encrypted traffic without being able to read it. Our server only relays the short technical messages that two browsers need in order to find each other. These messages can contain the network addresses of the two participants, and they are deleted within minutes.
What we process and why
- A temporary session: a random ID, your chosen language, and connection status. Purpose: to match you with a partner. Basis: providing the service you asked for (contract). Kept only while you are connected, and removed automatically within minutes after you leave.
- Your technical identity: your IP address and the country derived from it (looked up on our own server, never sent to a third party), a random device identifier kept by your browser, and a browser and device fingerprint (browser, operating system, device type and model where the browser reveals it, screen size, language, time zone and similar technical settings). Purpose: to prevent abuse, to enforce bans (including when someone returns after a ban or changes network), to detect minors and fake profiles, and to keep the service safe. Basis: our legitimate interest in keeping the service safe, and legal obligations. This is collected only after you confirm that you are 18+ and accept the terms. Kept for up to 30 days, or up to 60 days if the age check flagged you. Bans are applied using one-way salted hashes of your IP address and device identifier, which are kept while the ban is in force.
- What you choose and do in the service: whether you say you are a girl, a guy or a couple, whom you look for, and a log of your actions with time stamps (opening the site, confirming 18+, allowing the camera, searching, being connected and for how long, pressing Next, leaving, sending or receiving a report). We do not record or read the video, audio or text of your conversations. Purpose: safety, moderation, fair matching and keeping the service running. Basis: legitimate interest and providing the service. Kept for up to 30 days.
- Age check: while your camera is on, software that runs in your browser estimates the apparent age and gender of faces and how many faces are in view, to keep minors out. The pictures stay on your device and are never sent or stored: only numbers (for example the estimated age and the number of faces) reach us. If the estimate suggests a minor, the chat is stopped, your device may be blocked for a period, and the case is flagged for review by a person. It is an estimate with a margin of error of several years, and you can ask a person to review any decision (see Automated decisions). Basis: our legitimate interest in protecting children, and legal obligations. Kept as described above.
- Reports that users send about other users: the reason, the time and the pseudonymous identifiers of both people. Purpose: moderation and safety. Basis: legitimate interests and legal obligations. Kept up to 90 days.
- The list of pairs you should not be matched with again. Kept up to 90 days.
- Moderation actions, such as a ban, and who applied it. Kept for up to 12 months. Active bans are kept while they are in force.
- Messages you send to us by email, and our replies. Purpose: support, appeals and privacy requests. Kept as long as needed to handle the request and up to 24 months afterwards.
- Standard server logs kept by our hosting provider (such as IP address, time and requested page), used for security and reliability. Kept according to the provider's retention period.
When the law requires it, or to protect children and other people from serious harm, we may preserve and disclose relevant data for longer than the periods above, for example to comply with a valid legal request or with child-safety reporting duties.
Cookies and browser storage
We use no advertising cookies and load no third-party fonts or trackers. The chat page (/chat/) loads no analytics at all. On our information pages, and only if you press Accept in the cookie banner, we load Google Analytics 4 (Google) to count visits: it sets analytics cookies, IP addresses are anonymised, and you can press Decline or clear your browser storage to change your choice. We store only a few small things in your browser: your chosen language and, if you picked one, regional variant (a cookie and browser storage, up to one year); a note that you confirmed you are of age (browser storage, up to 90 days); who you say you are and whom you look for (browser storage until you delete it); a note that an age check stopped a chat (24 hours); the country code we derived from your IP address, used to choose your language (7 days); and a random device identifier (a cookie for up to two years, refreshed each time you connect, and a browser storage entry that stays until you delete it) that we use only for safety, to enforce bans and stop abuse, and never for advertising or for following you around the web. After you accept the terms, your browser also sends us the technical device details and fingerprint described above, which we use for the same safety purposes. The first items make the site work the way you asked. The device identifier and fingerprint protect other users from people who were banned. You can delete the stored items at any time in your browser settings, but if you do, we will still recognise a banned device by other signals such as its network address and fingerprint.
Who receives data
- Our hosting provider, which processes data on our behalf.
- STUN and TURN servers used to connect two browsers behind home routers and mobile networks. They necessarily see your IP address while a call is being set up.
- Authorities, courts and child-protection organisations, when we are legally required to, or when it is necessary to protect someone from serious harm.
- Professional advisers and, if we ever sell or reorganise the service, the new owner, under confidentiality duties.
We do not sell your personal information and we do not share it for advertising. We do not use it for profiling or targeted advertising. We treat Global Privacy Control and Do Not Track signals as an opt-out even though we do not track you.
International transfers
The service is available worldwide, so data can be processed in countries other than yours. When personal data leaves the EEA, the UK or Switzerland, we rely on an adequacy decision or on approved safeguards such as the Standard Contractual Clauses or the UK International Data Transfer Addendum.
Your rights
Depending on where you live, you can ask us to confirm whether we process data about you and to give you a copy, to correct it, to delete it, to restrict or stop the processing, to move it to another service, to withdraw a consent you gave, to ask for a human review of an automated decision, and to not be discriminated against for using your rights. Because we keep no accounts, we may need your help to find your data, for example your IP address and the approximate time of your visit. Write to support@spymelive.com. We answer within one month, or sooner if your local law requires it.
You also have the right to complain to your data protection authority, for example the Commissioner for Personal Data Protection in Cyprus, the Information Commissioner's Office in the United Kingdom, your national authority in the EU or EEA, the Office of the Privacy Commissioner in Canada, the OAIC in Australia, the ANPD in Brazil, or the California Privacy Protection Agency.
Automated decisions
Restrictions that follow several reports about the same connection in 24 hours are applied automatically. They are temporary, they can be reviewed by a person on request, and no other automated decision with legal or similarly significant effect is made about you. The age check can also stop a chat and block a device for a period when it estimates that a person on camera is under a set age. People review flagged cases, and you can ask for a review by writing to support@spymelive.com.
Children
SpyMeLive is not for anyone under 18 (or the age of majority where you live, if higher), and we do not knowingly process data of minors. If you are a parent or guardian and believe a minor has used the service, write to us and we will act on it promptly. To help enforce this, an age estimation runs on your device while your camera is on, as described above.
Security
We use encrypted connections (HTTPS and WebRTC encryption), salted one-way hashing, limited staff access and automatic deletion. No system is perfectly secure, so please use the service with care.
Changes
If we change this policy in a meaningful way, for example before adding age or identity verification or paid features, we will update this page and its date before the change takes effect.