Skip to main content

Privacy Policy

Effective as of April 2026.

Your privacy matters to us. This policy explains what data onCamChat.com (the "Service", "we", "us") collects, why we collect it, how we use it, and the rights you have under the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

Controller

The controller responsible for processing your personal data on this Service is Anatoli Reznik, contactable via the postal and e-mail addresses listed in the Imprint.

Data we collect

Depending on how you use the Service we process the following categories of data:

  1. Account data: username, e-mail address, hashed password (bcrypt), profile fields you provide (avatar, header image, bio, sexual orientation preferences for filtering, language settings).
  2. Content you create: posts, comments, quotes, reposts, likes, follows, hashtags, conversations, uploaded images and videos, metadata such as creation timestamps.
  3. Real-time video chat data: when you use the random 1:1 video chat or live-cam pages, audio and video streams are routed through a Selective Forwarding Unit (LiveKit). Streams are not stored on our servers; only short-lived signalling tokens (JWT) and connection metadata are processed for the duration of a session.
  4. Technical data: IP address, browser user-agent, device type, referrer URL, request timestamps. Stored in server log files for security, abuse prevention and operational diagnostics.
  5. Authentication tokens: on successful login a signed JSON Web Token (JWT) is issued and stored client-side; it identifies your session against our REST and Socket.IO endpoints.
  6. Cookies and local storage: see the Cookies section below.

Legal bases (Art. 6 GDPR)

  1. Performance of a contract (Art. 6 (1) (b) GDPR): processing required to operate your account and to deliver the Service.
  2. Legitimate interests (Art. 6 (1) (f) GDPR): security, abuse prevention, fraud detection, log retention, basic analytics, and responding to legal requests.
  3. Consent (Art. 6 (1) (a) GDPR): where the law requires consent, e.g. for non-essential cookies or analytics. You may withdraw consent at any time with effect for the future.
  4. Legal obligation (Art. 6 (1) (c) GDPR): retention obligations under tax and commercial law.

Recipients and third-party processors

We use the following processors and integrated third parties. Where applicable we have data-processing agreements (DPA / Auftragsverarbeitungsvertrag) and Standard Contractual Clauses (SCC) in place to safeguard transfers outside the European Economic Area (EEA).

  1. Hosting provider for application servers, database (MongoDB) and uploaded media. Servers are located in the United States. Transfers of personal data to the U.S. are based on Art. 46 (2) (c) GDPR (Standard Contractual Clauses) and, where the provider is certified, on the EU-US Data Privacy Framework (Art. 45 GDPR adequacy decision of 10 July 2023).
  2. LiveKit for the SFU/WebRTC media routing of 1:1 random video chat and live broadcasts. We operate our own LiveKit instance; participants connect peer-to-peer or via SFU. Stream payloads are not persistently stored.
  3. Google Analytics 4 (Google Ireland Limited / Google LLC) using measurement ID G-J8WVYHHD71 for aggregated usage statistics, loaded through Google Tag Manager (container GTM-MFDVLXD), which itself only orchestrates the tags listed here. IP-anonymisation is applied. Data may be transferred to the United States on the basis of the EU-US Data Privacy Framework. You can opt out at any time, see "Cookies".
  4. Chaturbate (Multi Media LLC, USA): live broadcasting rooms on the /live page are embedded as iframes from chaturbate.com. When you load such a page your browser establishes a direct connection to Chaturbate, which may set its own cookies and process your IP address according to its own privacy policy. We act as an affiliate partner; we do not receive personal data from Chaturbate beyond aggregated affiliate statistics.
  5. E-mail provider for transactional notifications (account verification, password reset, contact replies).

International data transfers

Some of our processors are located in the United States. We rely on the EU-US Data Privacy Framework (where the recipient is certified) and on the EU Standard Contractual Clauses (Decision (EU) 2021/914) together with supplementary technical measures (TLS in transit, encryption at rest where supported, hashed passwords, signed session tokens) to ensure an adequate level of protection. You can request a copy of the transfer safeguards by contacting support@oncamchat.com.

Cookies and similar technologies

We use a small number of strictly necessary cookies and local-storage entries to keep you logged in (JWT), remember your theme preference (light / dark / dim) and store UI state. These do not require consent under § 25 (2) TTDSG.

Non-essential cookies (Google Analytics) are only set with your consent. You may withdraw consent at any time by clearing cookies for this domain or by using a browser-level analytics opt-out add-on. You can also change your consent at any time via "Cookie settings" in the sidebar.

User-uploaded media

Images and videos you upload (avatars, header images, post media) are stored on our servers. By uploading content you confirm that you have the necessary rights and that the content complies with these Terms (see "User Content"). You can delete your content at any time via the corresponding UI; deletion is performed promptly, residual copies in backups are overwritten in the regular backup rotation.

Data retention

Account data is retained as long as your account exists. Server log files are retained for up to 14 days for security purposes and then deleted or anonymised. Content you delete is removed from active databases immediately. Where statutory retention periods apply (e.g. invoices, six to ten years under HGB / AO), data is retained for the legally required time and otherwise blocked from further processing.

Your rights under GDPR

You have the right to:

  1. access your personal data (Art. 15 GDPR);
  2. rectification of inaccurate data (Art. 16 GDPR);
  3. erasure (Art. 17 GDPR), unless retention is legally required;
  4. restriction of processing (Art. 18 GDPR);
  5. data portability (Art. 20 GDPR);
  6. object to processing based on legitimate interests (Art. 21 GDPR);
  7. withdraw consent at any time with effect for the future (Art. 7 (3) GDPR);
  8. lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence.

To exercise these rights, contact us at support@oncamchat.com. We may need to verify your identity before answering the request.

Security

We use TLS for all connections, hash passwords with bcrypt, sign session tokens with strong cryptographic keys (JWT/JOSE), and apply state-of-the-art measures to protect data against loss, misuse and unauthorised access. No method of transmission over the Internet is, however, 100% secure.

This Privacy Policy is effective as of April 2026.