Privacy policy
Last updated 20 August 2026 · version 1.0
Cogpit is a live video-chat service. This page says exactly what we hold about you. It is written to satisfy the EU General Data Protection Regulation (GDPR) and the UK GDPR.
1. Who is responsible
The data controller is the operator of cogpit.org (legal entity name and registered address to be inserted before public launch). Write to a moderator.
2. What we do not do
- We do not require an account, an email address or a phone number to chat.
- We do not record your video or audio. Media travels directly between the two participants, encrypted with DTLS-SRTP; our servers only exchange the connection details.
- We do not store your raw IP address in our database. Where we need to recognise a device (rate limiting, bans, abuse reports) we store a salted one-way hash of it. There is exactly one exception, described in section 4: a report of a minor, of illegal content or of violence, made while the reported person is still connected, keeps that one address so that we can report the crime. It is encrypted, it is never used for anything else, and it is deleted as soon as the referral has been made.
- We do not sell personal data.
- Translation, where you switch it on, runs inside your own browser using models your browser downloads once and keeps. The text of your messages is not sent to us, or to anybody else, in order to translate it. That is the only way a feature like this could exist here at all: we promise never to read your messages, and we were not going to make an exception for our own convenience.
3. What we process
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Salted device fingerprint (hash of IP + secret) | Abuse prevention, bans, linking a report to an offender | Legitimate interest (Art. 6(1)(f)): keeping a live video service lawful and safe | 12 months |
| Agreement acceptance (timestamp, version, browser string) | Proving that the 18+ and moderation terms were accepted | Legal obligation and legitimate interest | 24 months |
| Abuse reports (room id, reason, free-text note, fingerprints) | Reviewing and acting on reports | Legitimate interest; legal obligation where the content is illegal | 24 months, or longer if handed to authorities |
| The last four messages typed in the reported conversation, captured at the instant REPORT is pressed | Letting a moderator judge a report about words, which a still frame cannot show | Legitimate interest; legal obligation where the content is illegal | 30 days, then deleted automatically (kept longer only if handed to authorities) |
| One still picture showing both participants’ cameras side by side, captured at the instant REPORT is pressed | Letting a moderator judge a report on evidence instead of on an accusation. Both halves are captured because a frame of one person shows nothing about what it was a response to, and half a picture is not fair to either party | Legitimate interest; legal obligation where the content is illegal | 30 days, then deleted automatically (kept longer only if handed to authorities) |
| The same picture, where the report is about a minor or about illegal content | The same, but such a picture can be unlawful to possess, so it is not held on the ordinary schedule | Legitimate interest and legal obligation; processing limited to what reporting the matter requires | Destroyed as soon as a moderator decides the report, and in any case within 48 hours whether or not anyone has decided it. Where the matter goes to an authority, the copy sent to them is the only one that continues to exist |
| One IP address, kept only when a report names a minor, illegal content or violence, and only if the reported person was still connected at that moment | Reporting a suspected crime to the police, who cannot act on a hash: only an internet provider can say who used an address, and only on a court order | Legitimate interest (Art. 6(1)(f)), read together with recital 50, which names the reporting of criminal acts; legal obligation where one applies | Deleted the moment the referral has been handed over, and in any case after 30 days. Encrypted at rest in the meantime, and opened only by a named moderator, which is logged |
| Pairing record (room id, the two throw-away session ids and fingerprints, camera or mic mode) | Identifying who was in a reported conversation so the right person is sanctioned | Legitimate interest | 7 days |
| A pass code you redeem, and the fact that a pass was issued | Making sure a code is only spent once, and answering “I paid and lost it” | Performance of a contract (Art. 6(1)(b)) | 24 months |
| Daily counters (chats started, queue-wait bands, reports made), only if you switched analytics on | Telling whether matching is fast enough | Consent (Art. 6(1)(a)), withdrawable at any time from /cookies | Aggregated from the start; there is no per-person record to delete |
| Interests you pick and your consent choice | Matching you, remembering your cookie preference | Consent / strictly necessary | Stored in your own browser only |
| The bot check when you press START: by default a puzzle solved entirely in your own browser, or Cloudflare Turnstile where it is configured | Keeping automated accounts out of the queue | Legitimate interest (Art. 6(1)(f)) | The built-in puzzle stores nothing; for Turnstile see Cloudflare’s documentation |
| Connection metadata processed transiently by Cloudflare | Delivering the service, blocking attacks | Legitimate interest | See Cloudflare’s retention |
4. Moderation and inspection
One decision here is automated. If three different people report the same person within ten minutes, that person is automatically stopped from starting new chats for one hour. It is a temporary measure taken while a human is found, not a judgement: it expires on its own, a moderator can lift it early, and the person is told what happened and given an address to contest it (write to a moderator), where a person, not a system, reads it. Nothing else about the service is decided automatically, and no automated decision here has a legal or similarly significant effect within the meaning of Article 22 GDPR.
We do not record conversations. Video and audio travel directly between the two participants and are never stored. The only exceptions are the still picture and the four messages described above, which are captured only at the moment somebody presses REPORT, only from the reported person’s camera, and only so that a moderator can act on evidence. It is deleted after 30 days.
Because Cogpit puts strangers on camera together, a moderator may inspect an ongoing conversation to check the rules are being followed. You are told this before your first chat and you must accept it to use the service. Inspection is logged in an internal audit trail (who, when, which room). Recordings are only made when we are legally required to preserve evidence of a crime.
5. Processors we use
- Cloudflare, Inc.: hosting, edge network, database and DDoS protection.
- STUN/TURN relay providers: help two browsers find each other; they see connection metadata, not the content of a call, which stays encrypted.
Transfers outside the EEA rely on the EU Standard Contractual Clauses.
6. Your rights
You can ask for access, correction, erasure, restriction, portability, and you can object to processing based on legitimate interest. Because we deliberately hold no account and no raw identifier, we usually need the room id and rough time of the conversation to find anything about you. write to a moderator; we answer within 30 days. You may also complain to your national data-protection authority.
7. Children
Cogpit is strictly 18+. If we learn that a user is a minor we terminate the session and ban the device. Report a suspected minor with the REPORT button; it goes straight to the top of the queue.
8. Security
The site runs entirely on Cloudflare’s edge; there is no self-hosted origin server that could be located or attacked. All traffic is HTTPS with HSTS; media is end-to-end encrypted between participants; admin access requires a password and a signed session, and every admin action is audited.
9. Changes
If this policy changes materially we bump the agreement version, which means you are asked to accept the new terms before your next chat.