Privacy Policy

Last updated: 8 October 2026

MESTONY (“we”, “us”) is an anonymous chat. Privacy is the whole point of the product, and this policy explains exactly what we do and don’t collect, why, and how you stay in control.

The short version

We don’t require your real name or email.
Live chat messages are relayed, not stored on our servers.
Anything you save, you can permanently erase at any time (“Delete everything”).
We never sell your data.
We use no AI: nothing you write is sent to a language model.

What we collect

Your nickname and chosen interests: to match you and run the service.
A recovery code: a random, memorable code that is your account. It is stored hashed so we can recognise you on return.
Optional private profile (first name, age, gender, location): if you enter it, it is stored on your own device and is never shown to anyone unless you explicitly agree to reveal it to a specific person.
IP address, in two narrow ways, never shown to other users. Country: Cloudflare, which carries traffic to our site, tells us the two-letter country your request came from. We use it to weight matching and to apply country rules at the After Dark door. We do not send your IP to any outside location service. Consent proof: when you open After Dark we store a salted one-way hash of your IP, which cannot be turned back into your address, as evidence of when you consented. It is kept while the account exists and is destroyed with “Delete everything”.
Optional social sign-in (e.g. Google): if you choose it, we store the provider’s account identifier (and email, if provided) only to link you to your MESTONY account.
Offline messages: if someone leaves you a message while you’re away, it is stored until you read it, and is deleted when you delete your account.

What we do NOT collect

We don’t store your live conversations.
We don’t use advertising or tracking cookies.
We don’t build advertising profiles or sell data to anyone.

No AI

MESTONY uses no AI service, anywhere. Nothing you type is sent to a language model, and no text on this site is generated by one. There is no AI processor in the list below because there is no AI in the product. Until 8 October 2026 a language service wrote the reading after a test, the Echo reply, the tidying of a typed interest word, and translations. All four were removed on that date and the service was disconnected.

Local storage

We use your browser’s local storage (not tracking cookies) to keep you signed in and remember your choices on your device. Clearing it, or using “Log out”, removes that local data.

Service providers

We use a small number of processors strictly to run the service:

Hostinger International: hosting of our servers and database, in its data centre in Frankfurt, Germany. This is the machine that physically holds the database, including the record that your After Dark request was approved and your consent records.
Cloudflare: content delivery, security and HTTPS.
Google: only if you choose “Sign in with Google”. Google Fonts also serves the typefaces on our pages, which means your browser contacts Google to fetch them.

There is no AI service on that list. MESTONY uses no AI, so nothing you type is sent to a language model, anywhere on the site.

Where your data is, and where it goes

Our server and database sit in Frankfurt, Germany, inside the EU. The service is run from Spain. So the data stays in the European Economic Area, with these exceptions, which are the only transfers we make:

Cloudflare carries every request to our site, so every visit passes through it, including visits to After Dark pages. It is a United States company operating a global network and relies on the EU Standard Contractual Clauses.
Google, for sign-in if you choose it, and for serving the typefaces on our pages.

We previously sent visitor IP addresses to an outside location service to estimate a country. That was removed on 8 October 2026 and we now take the country from Cloudflare instead, so that transfer no longer happens.

After Dark: special-category data

If you choose to open After Dark, the 18+ layer, you tell us about your desires. Under the GDPR (Article 9) this is special-category data concerning sex life, and we process it only with your explicit consent, which you give separately from accepting these terms and can withdraw at any time with “Close the door”. What we then do with it:

Age check: access to After Dark is approved by the operator by hand in an admin console. We record that it was approved, the date and time, the method (manual review by the operator), and which operator account approved it. We never store an identity document, a photo, or a card number. No outside verification vendor is connected today, and if one is ever used it will act as our processor under a data-processing agreement and will be named here before it goes live.
Your consent: we keep the time, the version of the rules you agreed to, and a salted hash of your IP, kept for as long as the account exists, as proof that consent was given.
Your After Dark answers stay in your own browser, like your private profile. They are never written to your public Card, the Flow, compare links, or matching outside After Dark, and, like everything else you write here, they are never sent to an AI service, because we use none.
Deletion: “Delete everything” removes all of it. “Close the door” withdraws consent and stops After Dark immediately; the fact that your age was checked is kept so you are not asked twice.

A data-protection impact assessment covers this layer. Single point of contact, including for the EU Digital Services Act: [email protected].

Your rights

Depending on where you live (including the EU/EEA under the GDPR), you have the right to access, correct, or erase your data, and to object to processing. You can erase everything yourself at any time with the “Delete everything” action in the app, which permanently removes your account, connections, interests, saved profile and stored messages. To make any other request, contact us below.

If you believe we have handled your data wrongly, you may lodge a complaint with our supervisory authority, the Agencia Española de Protección de Datos (AEPD), Paseo de la Castellana 141, planta 9 (Edificio Cuzco IV), 28046 Madrid, Spain. Its website is www.aepd.es, complaints are filed through its electronic office at sedeaepd.gob.es, which requires a digital certificate or Cl@ve, and its citizen information line is +34 900 293 183, Monday to Friday, 09:00 to 17:30. You may also complain to the data protection authority of the country where you live. Please write to us first if you can: most things are faster to fix directly.

Age

MESTONY is for adults 18 and older. We do not knowingly collect data from anyone under 18.

Security

Traffic is encrypted in transit (HTTPS). Recovery codes and passwords are stored hashed. No system is perfectly secure, but we keep the data we hold deliberately minimal.

Changes

We may update this policy; we’ll revise the “last updated” date above.

Contact

Questions or data requests: [email protected].