🔒 Privacy Policy

Last updated: 15 June 2026

KOVAT Chat ("we", "our", "us") is committed to protecting your privacy. This policy explains how we collect, use, store, and disclose your information in compliance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. What We Collect

Account information: Username, display name, email (optional), date of birth (age verification only)
Usage data: Login timestamps, IP addresses, device information for security and rate limiting
Encrypted messages: Your messages are end-to-end encrypted. We store only encrypted blobs — we cannot read them
Public keys: Your ECDH P-256 public key for encryption key exchange (never your private key)
Reports: When you report content, we store the report and associated evidence

2. What We DON'T Collect

❌ Your private encryption keys (they never leave your device)
❌ Plaintext message content (encrypted before transmission)
❌ Real-time location (unless you explicitly share it, and it expires after 2 hours)
❌ Browsing history outside KOVAT Chat
❌ Personal contacts or address book

3. How We Use Your Data

Service delivery: To operate the messaging platform — deliver messages, manage chats, process friend requests
Security: Rate limiting, account lockout protection, fraud prevention, DPS moderation
Legal compliance: Responding to lawful requests from Australian authorities under the Online Safety Act 2021
Improvements: Aggregated, anonymized usage statistics to improve the service

We never sell your personal information to third parties.

4. Data Storage & Retention

Messages: Encrypted message data retained for up to 90 days for service delivery
Account data: Retained until account deletion (30-day grace period after request)
Login logs: Retained for 30 days for security purposes
Reports & evidence: Retained for 12 months for moderation audit trails
Location shares: Automatically deleted after 2 hours

5. Data Security

We implement industry-standard security measures:

End-to-end encryption using ECDH P-256 + AES-256-GCM
Passwords hashed with scrypt (Werkzeug)
Two-Factor Authentication (TOTP) available for all users
Account lockout after repeated failed login attempts
Session management with revocation capability
All traffic served over HTTPS via Cloudflare

6. Your Rights (Australian Privacy Principles)

Under the Privacy Act 1988, you have the right to:

Access: Request a copy of your personal data
Correction: Correct inaccurate personal information
Deletion: Request account and data deletion (30-day grace period)
Portability: Export your data in a machine-readable format
Complaint: Lodge a complaint with the Office of the Australian Information Commissioner (OAIC)

To exercise these rights, contact us at [email protected].

7. Third-Party Services

KOVAT Chat's Planner tab links to external services (Event Cinemas, Hoyts, OpenTable, Uber, PTV, etc.). These services have their own privacy policies. We do not share your KOVAT data with them. Clicking external links opens those services in a new tab — they are not integrated with your KOVAT account.

8. Cookies

We use essential session cookies to keep you logged in. No tracking cookies, no advertising cookies, no third-party cookies. Our cookies are HttpOnly, Secure, and SameSite=Lax.

9. Children's Privacy

KOVAT Chat requires users to be 16 years or older per the Australian Online Safety Amendment (Social Media Minimum Age) Act 2024. We do not knowingly collect data from users under 16. If we discover an underage account, it will be suspended.

10. International Data

All data is stored on servers located in Australia. We do not transfer personal data overseas.

11. Changes to This Policy

We will notify users of material changes via in-app notification or email. Continued use after changes constitutes acceptance.

12. Contact

Email: [email protected]
OAIC: If you believe we have breached the APPs, you may complain to the OAIC at oaic.gov.au.