Privacy Policy
1. Controller and contact
The data controller is Aurora Web & Security, the operator of mingletv.app. Address: To be completed by the operator before public launch.. For questions about your data, complaints or vulnerabilities, contact aurorawebsec@gmail.com.
2. Data and purposes
Conversation: your camera, microphone, messages and connection information are used to establish and transmit the conversation you request. WebRTC audio and video streams are encrypted. Messages are transmitted without storing chat history or recording video. Messages remain visible in the browser during the conversation and are cleared when it ends.
Connection and country: the server receives your IP and a country estimate supplied by Vercel. You can hide your country in settings. Supabase temporarily stores the IP, session identifiers, matches and preferences needed for the conversation. A technical Supabase Auth identity is created automatically after you confirm your age, without an email address or sign-up form. The country estimate is not a GPS location. A VPN may change the country displayed.
Depending on the relay configuration, a direct video connection may reveal your network IP to your partner. Relay settings and availability are shown in the privacy settings.
Moderation: a report contains the reported person’s IP and estimated country, the reason, submitted details, date, technical identifiers for the reporter and conversation, status and review notes. No capture or chat copy is added automatically. A ban stores the relevant IP and its expiry date. The reporter’s IP is not saved in the report itself; it is used in a separate temporary counter to limit reporting abuse.
Activity: page loads, chat connections and reconnections, peak concurrent connections, matches and reports are counted daily without storing IPs in these statistics. Page view measurement uses no cookie, identifier or referring URL. Online counts are estimated from open chat connections; multiple tabs may count more than once.
Optional unique visitor statistics: enabling this option creates a random identifier in your browser. The server stores a different hash each month to deduplicate consenting visits. This measurement does not cover all visitors or count individual people precisely.
Administration and correspondence: admin access uses a secure session and an audit log. If you email the operator, your address and message are used to handle your request. Do not include unnecessary sensitive information or illegal content.
3. Legal bases
Providing the conversation relies on delivering the requested service. Abuse prevention, moderation and aggregate activity counters serve legitimate interests in security and service operation, subject to your rights and freedoms. Optional unique visitor tracking relies on consent, is disabled by default and can be withdrawn at any time. Responses to rights requests and legally required disclosures rely on the applicable legal obligations. Browser camera permission is not consent to optional statistics.
4. Recipients and hosting
Your partner receives the content you send and your estimated country if you share it. Authenticated administrators can access reports and restrictions. Network, hosting and relay providers process the data needed for their services and may receive your IP. Google STUN may be contacted to establish WebRTC connectivity. When used, a TURN relay receives encrypted streams and the information needed to route them.
Vercel hosts the site and its APIs. Supabase provides technical authentication, the database and ephemeral message transport. Hosting providers, locations, other recipients, transfers outside the European Economic Area and safeguards: To be completed by the operator before public launch, including Vercel, Supabase, TURN and contact email services.
No advertising tools, social sign-in or payments are included in this version. The operator does not sell your conversations. Your partner can capture content on their device; the service cannot prevent this.
5. Retention and deletion
- Conversation sessions expire after 90 seconds without a heartbeat, then are removed by cleanup running every minute. An abrupt disconnection may remain counted briefly. Ended matches are deleted after one day.
- Anonymous technical identities are scheduled for batch deletion after 30 days without a new sign-in, when the visitor has no active session.
- Temporary protection counters expire within one minute to one hour, then are cleaned up.
- Reports and the admin audit log are retained for 30 days, then cleaned up every minute. Administrators can delete a report earlier.
- IP bans last 1, 7 or 30 days, then are cleaned up automatically.
- Statistics cover the current month and the previous 12 months. Withdrawing consent also requests deletion of retained unique visitor hashes linked to the identifier available in your browser; activity totals without identifiers remain.
- Admin sessions last up to eight hours and can be ended immediately by signing out.
The operator must specify retention periods and deletion procedures for infrastructure logs, contact emails and backups in the hosting information before public launch. Any specific legal retention obligation must be documented and communicated to affected people where required.
6. Browser storage and your choices
Local storage remembers settings under “mingle.preferences” and, only with your permission, the statistics identifier under “mingle.visitor”. Preferences remain until changed or site data is cleared. The optional identifier remains until consent is withdrawn or that data is cleared. No measurement identifier is installed before your choice. Technical authentication under “mingle.auth”, needed for private chat, is kept in tab session storage and is not used for statistics. A session cookie is reserved for administrators.
The age declaration is requested on each arrival at the chat and is not saved as an age-verification record in browser storage. Confirming your age does not start your camera. Selecting “I am under 18” takes you to Google, which has its own policies.
Use the settings button in the chat to hide your country, choose a relay when available and accept or withdraw optional statistics. Withdrawal does not block chat access. Make the request while connected so it can be sent. Clearing browser data directly may prevent old hashes from being located. You can always contact the operator.
7. Your rights and security
You may request access, correction, deletion, restriction, portability where applicable, or object to processing depending on your situation. Contact the operator with useful details, such as a report reference and date. Only information needed to verify and handle your request should be requested. An IP alone does not reliably identify a person. You can complain to the CNIL or the relevant supervisory authority.
Admin access is authenticated and production communications must use HTTPS. The application does not itself encrypt the database at rest; protection of storage and backups depends on the operator’s infrastructure. Report vulnerabilities without accessing other people’s data.
8. Minors and changes
Mingle TV is for adults only. Age is self-declared before chat access; this version uses neither identity documents nor a third-party age-verification provider. If you are a minor, do not use the service. A parent may contact the operator to report use and request review or deletion of a child’s data. New policy versions are dated on this page. A new purpose requiring consent must be presented as a separate choice.