Privacy Policy

1. Introduction & Overview

Chemmatrix Inc. (“Company“, “we“, “our“, or “us“) operates the mobile application Peekle OpenTalk (the “App“). We are dedicated to maintaining the trust of our users by protecting their personal data in accordance with globally recognized data protection regulations, including the Google Play Developer Distribution Agreement and Data Safety Policies, the General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA/CPRA).

This Privacy Policy explains what personal data we collect when you use Peekle OpenTalk, why we collect it, how it is processed and secured, how real-time audio/video communications function, and your statutory rights to access, rectify, or permanently delete your account and personal data.

By downloading, installing, registering for, or using Peekle OpenTalk, you confirm that you have read and agreed to this Privacy Policy. If you do not agree with any portion of this policy, you must uninstall the application and discontinue use.

2. Age Restriction & Child Safety Policy (18+ Requirement)

Because Peekle OpenTalk provides live, real-time random video and audio interactions with stranger participants across the globe, the platform is strictly restricted to adults. We do not knowingly solicit, collect, or store personal data from children under 13 or minors under 18.

A prominent safety and age acknowledgement modal is presented to all users upon first launch and periodically during use. If we discover or are notified that an individual under the age of 18 has registered an account or accessed the service, we will immediately terminate the account, ban associated hardware/device identifiers, and permanently delete their data from our databases.

3. Information We Collect

We collect only the information strictly necessary to provide live communication, matchmaking, account security, and app functionality.

3.1. Information You Provide to Us Directly

• Email Address: Collected when you register using our email registration system or Google Sign-In. We use your email for authentication, sending 6-digit One-Time Passwords (OTPs) for verification, password resets, and account notices.
• User Profile Data: You may provide a display name (or nickname), select an avatar from our pre-designed avatar catalogue (or custom avatar URL), and specify personal interests (e.g., Gaming, Tech, Music, Travel) and preferred spoken language.
• Third-Party Sign-In Information (Google OAuth): If you choose to sign in with Google, we receive basic authentication tokens, your Google profile name, email address, and avatar image authorized by your Google account. We never receive or store your Google account password.
• Support Inquiries & Reports: Information you provide when submitting a user misconduct report or contacting our support team (such as descriptions of issues and communication history).

3.2. Real-Time Communications: Video, Voice & In-Call Messages

• Live Camera Video: Processed in real time for local video preview and transmitted peer-to-peer via WebRTC. Never saved on our servers.
• Live Audio / Voice: Captured in real time for live transmission to the connected peer via WebRTC. Never saved on our servers.
• In-Call Chat Messages: Text messages exchanged during an active call session are transmitted via Google Cloud Firestore (/calls/{callId}/messages) so both participants can view them in the chat window. Messages are ephemeral and associated with the transient call session.

3.3. Information Collected Automatically

• Unique App Device Identifier: To enforce our single-active-device security policy (preventing account takeover from multiple devices concurrently) and prevent abusive multi-account spam, the App generates a persistent unique device token (peekle_unique_device_id) stored locally in your device’s SharedPreferences and synchronized with your user document in Firestore.
• Online Presence & Availability Status: Real-time status indicators (isOnline, isBusy, lastActive timestamp) to orchestrate matchmaking queues and prevent interrupted calls.
• Call Session Metadata: Session identifiers, caller ID, callee ID, connection state (offering, connected, ended, missed, declined), timestamps, and duration in seconds used for connection management and service stability.
• Signaling & NAT Traversal Data: Temporary Session Description Protocol (SDP) offers, answers, and ICE candidate data exchanged through Cloud Firestore to negotiate the direct WebRTC peer connection.
• In-App Notifications: History of call requests, missed calls, and system announcements delivered to your account inbox.

4. How We Use Your Information

We process your personal information strictly for lawful, legitimate purposes:

• Facilitating Random & Intent-Based Matchmaking: Connecting you with compatible live conversation partners based on language preference and shared interests.
• Establishing Real-Time Peer-to-Peer Calls: Orchestrating WebRTC signaling to connect audio and video streams between devices.
• Authentication & Security: Verifying your identity with secure 6-digit email OTPs, managing login sessions, and preventing unauthorized concurrent device logins.
• Community Safety & Moderation: Reviewing reported user IDs, enforcing zero-tolerance policies against inappropriate content, and blocking abusive accounts.
• Advertising & Monetization: Serving relevant advertisements (App Open ads, Rewarded ads, and Banner ads) via Google Mobile Ads SDK (AdMob) in full compliance with Google Play Developer policies.
• Dynamic Configuration & Policy Updates: Fetching dynamic feature flags, ad thresholds, and updated legal links in real time via Firebase Remote Config.
• Customer Support: Addressing technical questions, bug reports, and user feedback.

5. Device Permissions Requested

Peekle OpenTalk requires specific runtime permissions on Android devices to operate. The table below provides a comprehensive breakdown of each requested permission and its explicit purpose:

6. Third-Party Services and SDKs

We integrate certified third-party SDKs that process technical data under strict contractual data protection agreements:

• Google Firebase (Google LLC): We use Firebase Authentication for identity management, Cloud Firestore for cloud database and WebRTC signaling, and Firebase Remote Config for remote feature configuration. Data is processed in Google Cloud data centers under Google’s enterprise security standards.
• Google Mobile Ads / AdMob (Google LLC): We show ads powered by Google AdMob. AdMob may collect device identifiers (such as the Google Advertising ID / GAID), IP address, general coarse location (country/city level), and ad interaction telemetry to serve, optimize, and measure advertisements. You can reset or limit your Advertising ID at any time via your Android device’s Settings > Google > Ads.
• Google Sign-In (Google LLC): Allows secure single-sign-on using your Google account without exposing your password.
• Google STUN Servers (stun.l.google.com): Enables NAT traversal so peer devices can discover their public-facing IP endpoints and establish a direct WebRTC audio/video channel.
• Chemmatrix Mail Services (mail.chemmatrixinc.org): Dedicated enterprise mail relay used solely for transmitting single-use 6-digit OTP verification codes to your registered email address.

For more information on Google’s privacy practices, please visit the Google Privacy & Terms.

7. Community Standards, Content Moderation & Reporting

Prohibited Actions Include:

• Nudity, sexual acts, pornographic material, or sexually suggestive conduct;
• Harassment, bullying, hate speech, threats, intimidation, or derogatory slurs;
• Depictions or threats of violence, self-harm, weapons, or illegal activities;
• Impersonation, fraud, spam, commercial solicitations, or extortion;
• Sharing personal contact details, physical addresses, passwords, or financial information.

In-App Reporting Mechanism: During any live call, users can tap the Report User icon on screen. Submitting a report immediately terminates the live call, disconnects you from the stranger, submits the reported user ID to our moderation review queue, and immediately searches for a new match.

8. Data Retention and Account Deletion

In accordance with Google Play’s User Data Policy on Account and Data Deletion, users have full rights and self-service channels to request total deletion of their accounts and all associated data.

Data Retention Periods:

• Active User Profiles: Stored while your account remains active so you can log in, retain your display name, selected avatar, and preferences.
• Audio and Video Streams: 0 seconds retention. Transmitted strictly peer-to-peer in real time and never recorded or saved.
• Call Signaling Data: Temporary WebRTC session data and connection candidates are automatically cleaned up when the call concludes.
• Inactivity & Offline Presence: When you disconnect or close the App, your presence status is immediately marked as offline.

9. Data Security Safeguards

We employ multi-layered technical, physical, and administrative safeguards to protect your personal information:

• Encrypted Data in Transit: All communications between the App and Firebase servers are encrypted using modern Transport Layer Security (TLS/HTTPS).
• End-to-End Encrypted Media Streams: WebRTC voice and video streams between peer devices utilize Datagram Transport Layer Security (DTLS) and Secure Real-time Transport Protocol (SRTP).
• Single-Device Session Locking: Database safeguards prevent concurrent multi-device logins to stop unauthorized account hijackings.
• Strict Cloud Security Rules: Cloud Firestore security rules ensure that authenticated users can only access their authorized data.

10. Your Privacy Rights (GDPR, CCPA/CPRA & International)

Depending on your jurisdiction, you possess specific statutory rights regarding your personal information:

• Right to Access / Portability: You may request a copy of the personal information we maintain about you.
• Right to Rectification: You may correct or update your display name, interests, and avatar directly within the App’s profile screen.
• Right to Erasure (“Right to be Forgotten”): You may request the permanent deletion of your account and all personal data.
• Right to Restrict or Object to Processing: You may restrict the processing of your information or opt-out of personalized advertisements.
• California Residents (CCPA/CPRA): We do not sell your personal information for monetary value. We do not discriminate against any user for exercising their statutory privacy rights.

To exercise any of these rights, please contact our Data Protection Officer at support@chemmatrixinc.org.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to accommodate new features, security updates, or changes in legal regulations. When material modifications occur, we will update the “Effective Date” at the top of this page, deliver an in-app update notice, or synchronize notification banners via Firebase Remote Config. Your continued use of Peekle OpenTalk after notice of updates constitutes your acceptance of the revised policy.

12. Contact Information & Data Controller

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: