Privacy Policy

Last updated: November 8, 2026

JChat is operated by Otunity Labs LLC ("Otunity Labs", "we", "us"), 6000 Palm Trace Landings Dr APT 312, Davie, FL 33314, United States. This policy explains what information we collect when you use the JChat mobile app, the JChat website (jchat.cloud), the business dashboard (including dashboard.tabpos.cloud) and related services (together, the "Service"), how we use it, and the choices you have.

1. Who this applies to

JChat has three kinds of users: members (people who use the app to see nearby venues, chat and order), business owners and staff (who manage a venue through the dashboard and point-of-sale tools), and guests (people who order or pay at a venue by scanning a QR code without creating an account). This policy covers all of them.

2. Information we collect

Account information: email address, password (stored hashed by our authentication provider), name, username, profile photo, bio, language and app settings, and the year of birth you give us to confirm you are 18 or older (we keep only the year). If you sign in with Apple or Google, we receive the name and email those services share with us.
Match profile (optional): if you use Match, your gender (woman, man or non-binary), who you want to meet (women, men or everyone), your interests and your photos. This is sensitive information: it is used only to show you people who fit and to show you to them. Your likes, matches and Match chats are erased when you leave the venue (except with people who follow each other).
Precise location, only while you use the app: to show venues near you, to let you join a venue's or group's chat when you are within its radius, and to connect nearby card readers. We do not collect location in the background. We need your location to confirm that you are inside the venue. That way no one from outside gets into the chat. We do not store your exact location; we only confirm that you are here.
Content you create: chat messages, direct messages, posts, photos, stories, reviews, voice notes and anything else you share. Photos require camera or photo-library permission; voice notes require microphone permission.
Orders and payments: items ordered, amounts, tips and receipt codes. We never see or store your card number. Payments are processed by Stripe; we receive only a payment confirmation, the card brand and the last four digits.
Guest ordering: if you order or pay at a venue by QR code without an account, we store a random device identifier, a hashed device fingerprint and a hashed IP address for security and fraud prevention (for example, to limit abusive orders). These are not linked to your name.
Business data: if you are a business owner or employee, information about your business, menu, employees, tables, sales, inventory and your Stripe Connect account.
Device and diagnostic data: device type, operating system, app version, push-notification token, crash and error logs (attached to your account ID only, never to your name, email or IP address).
Safety data: reports you submit, users you block, moderation actions taken by venue owners, and CAPTCHA verification results.

3. How we use information

To provide the Service (maps, chat, ordering, payments, receipts, notifications); to keep the Service safe (fraud prevention, rate limiting, moderation, blocking abusive devices); to communicate with you about your account and orders; to improve the Service; and to comply with the law. We use location only for the features described above.

We do not sell your personal information. We share it only with service providers who process it for us under contract, and only as needed:

Supabase — database, authentication and file storage, hosted in the United States.
Stripe — payment processing, business payouts and card readers. We never see or store your card number.
Google Cloud Vision — safety review of photos you send in Match and in direct messages: the bytes of the photo are sent to Google to detect content that breaks our rules.
Google Maps and Firebase Cloud Messaging (Google) — maps on Android and push notifications. Apple — push notifications and Apple Maps on iOS.
Expo — push notifications (the title and text of a notification pass through Expo's push service on their way to your phone) and app builds and updates.
Sentry — technical diagnostics (crash and error reports), linked only to your account ID, without your name, email or IP address.
hCaptcha — protection against bots when you sign in, sign up or recover a password.
Have I Been Pwned — when you create an account we check whether your password has appeared in a known data breach. Only the first 5 characters of the password's SHA-1 hash are sent (k-anonymity), together with your IP address as in any web request, and only when you sign up. Your password and the rest of the hash never leave your device.
Resend — sending account emails (sign-up confirmation, password recovery, receipts).
Vercel — website hosting.

Venue owners who use the optional AI menu assistant send their own menu content to an AI provider (Anthropic / Claude); no member data is sent. When you order at a venue, the venue receives your order details (and, for reservations, the name and contact you provide). We may also disclose information if required by law or to protect the rights and safety of users and the Service.

5. Your content and other users

Messages you post in a venue or group chat are visible to other people in that chat. Your public profile (username, display name, photo, bio) is visible to other members. Venue owners can moderate their own chats (mute, remove, ban). You can report or block anyone from their profile.

6. Data retention

We keep your information while your account is active. When you delete your account we delete right away your profile, photos, messages, Match profile and posts. Some records are kept after that, for these periods:

Orders and payments: 7 years, without your personal data, for tax and accounting obligations.
Security logs: 90 days. The record of moderation actions and account suspensions: 1 year.
Closed reports (with the evidence attached to them, including copies of the reported content): 1 year after they are resolved. Reports about child safety, or sent to the authorities (NCMEC): 2 years after they are resolved. Open reports are kept until they are resolved.
Moderation records of venue chats and games, and table reservation records: 1 year.
Photo-scan records and e-mail delivery records: 90 days (30 days for e-mails that were delivered).
Gifts you sent or received: kept without your identity.

Guest ordering identifiers are kept for a limited period for security.

When you delete your account, the reports you made or received stay without your identity until their term above ends. If your account was suspended for a confirmed violation, we keep an encrypted fingerprint of your e-mail address (not the address itself) for up to 2 years to prevent new accounts from being opened. To appeal, write to soporte@jchat.cloud.

7. Deleting your account

You can permanently delete your account at any time in the app: Settings → Delete account, or on the web at jchat.cloud/account/delete. Deletion is immediate and irreversible. If you cannot access the app, email soporte@jchat.cloud from the address on your account and we will delete it.

Venue owner accounts. You can delete your account yourself in the app (Settings → Delete account) or at jchat.cloud/account/delete. Your venue closes (it stops being visible and taking orders) and your personal data is deleted immediately. The venue's order, payment and receipt records are kept for up to 7 years, without your personal data, because accounting and tax rules require it. Your subscription is cancelled immediately, with no refund of the period already paid. If Stripe still holds a balance for you, it must reach your bank first.

8. Your rights

Depending on where you live, you may have the right to access, correct, download or delete your personal information, and to object to or restrict certain processing. You can edit your profile and settings in the app, and contact us for anything else. We will not discriminate against you for exercising your rights.

9. Children

JChat is for adults. You must be 18 or older to create an account. We do not knowingly collect information from anyone under 18; if you believe we have, contact us and we will delete it.

10. Security

Data is encrypted in transit (HTTPS/TLS). Access to personal data is restricted, and sensitive operations (payments, account deletion, moderation) run on our servers, not on your device. No system is perfectly secure; please use a strong password and enable the optional biometric lock in Settings.

11. International users

Our servers are in the United States. If you use the Service from elsewhere, your information is transferred to and processed in the United States.

12. Tracking and advertising

We do not use your data for third-party advertising and we do not track you across other companies' apps or websites.

13. Changes

We may update this policy. We will post the new version here with a new date and, for material changes, notify you in the app.

14. Contact

Otunity Labs LLC · 6000 Palm Trace Landings Dr APT 312, Davie, FL 33314, USA · soporte@jchat.cloud