fireplacePrivacy policy
Fireplace is a private messenger. This page explains what information it handles, why, how long we keep it, and the choices you have. Effective 4 October 2026.
Who is responsible
Fireplace is run from the Netherlands. For the purposes of the EU General Data Protection Regulation (GDPR, known in the Netherlands as the AVG) and Dutch law, its operator is the controller of the personal data described here.
Questions, requests and complaints about privacy: [email protected]. We answer privacy requests without undue delay and within one month.
Information we collect
- Account information. Your username, display name and password, the invite code you used, and when your account was created. We do not ask for your email address or phone number. Passwords are handled by Google Firebase Authentication and we cannot read them.
- Device information. For each device you use with Fireplace, an identifier and its public encryption keys.
- Messages and chat information. Messages are end-to-end encrypted. We store the encrypted message data with the sender, the sending device and a timestamp, and who is in each chat, whether a message request was accepted, and when the chat was last active.
- Information on your device. Your private keys, session data and message history are stored on your device, encrypted. If you turn on recovery, an encrypted backup of your identity key is stored on our servers, which we cannot open.
- Safety information. Block lists, rate-limiting records, reports, suspensions and moderation records. A report includes the accounts involved, the reason, an optional note and, if you choose to include them, recent messages from the chat. Reports are reviewed by Fireplace's operator and may include information about other people.
- Technical information. Our service providers process technical information such as IP addresses and connection events when you use the app.
- Your enquiries. If you email us, we keep your message and our reply so we can help you and have a record of your request.
- Camera. The camera is used on your device only to scan QR codes for verifying a contact and linking a device. Images are not uploaded.
Fireplace contains no advertising or analytics tools. We do not sell personal information or use it for targeted advertising.
Why we use it
| What we do | Our reason under the GDPR |
|---|---|
| Create and sign in accounts, deliver encrypted messages, link devices, offer recovery | It is needed to provide the service you asked for (contract) |
| Security, rate limits, preventing abuse, handling reports | Our legitimate interest in a safe and reliable service |
| Answer support and privacy requests | Contract and legitimate interest; legal obligation where a right applies |
| Follow the law | The legal obligation that applies, when it applies |
We do not make decisions about you by automated means that have legal or similarly significant effects. A person decides on suspensions.
Who else sees it
- Google (Firebase) hosts accounts and data for us under its business terms. Cloudflare delivers this website. Apple and Google handle app distribution under their own terms. Our domain provider forwards mail sent to our fireplacechat.com addresses to the operator.
- Authorities. We may provide information if a valid legal demand requires it.
- Outside the EU. Our providers may process data in countries outside the European Economic Area, including the United States, using safeguards such as standard contractual clauses or adequacy decisions.
How long we keep it
- Messages on our servers: deleted 30 days after they were sent.
- Accounts: an account that has not been used for 13 months is deleted. Opening the app counts as use. We hold no email address or phone number, so we cannot notify you beforehand. The clean-up runs at least monthly.
- Chat details (who chatted with whom, and when) are kept as long as an account in that chat still exists.
- Reports and moderation records are kept for as long as needed to deal with abuse and to handle appeals, and then deleted.
- Backups and logs at Google and Cloudflare follow those companies' own schedules.
Deleting your account
You can delete your account in the app under Settings, or write to us if you cannot sign in; see how to delete your account. Deleting removes your sign-in account, profile, username, devices and keys, recovery backup, block list and the messages you sent that are still on our servers. It does not remove copies other people already hold, or reports kept for safety reasons.
Your rights
You can ask for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive eligible data in a portable form. Where we rely on your consent you can withdraw it. We may need to check the request really comes from you, and we may redact other people's details from reports.
Write to [email protected]. If you are not happy with the answer, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority in the EU country where you live or work. You do not have to contact us first. People in the UK can complain to the ICO and people in Australia to the OAIC. US residents with state privacy rights can use the same address for requests; we do not sell personal information. This page does not take away any rights you have under the law where you live.
Age
Fireplace is for people aged 16 and over. We delete accounts that we find belong to someone under 16.
Security
Messages are end-to-end encrypted, and your message history and keys are encrypted on your device (how it works). We take reasonable measures to protect your information, but no system is completely secure.
Changes
We will update this page and its date when something changes. For significant changes we will also tell you in the app where we can.