Version 1.0 · Effective 2026-09-01 · Last updated 2026-09-01
This Policy explains how BoldWord ("we", "us") collects, uses and protects your personal data when you use BoldWord (the "Service").
BoldWord.For data protection matters, contact: we@boldword.chat
We collect only the data needed to provide the Service.
2.1 Data you provide
| Category | What it is | Why we need it |
|---|---|---|
| Account information | Username (in email format), password (stored only as an irreversible hash), display name | To create and sign in to your account |
| Message content | The text, images, files and voice messages you send | To deliver them to the other person and let you view and search them across your devices |
| Contact relationships | Who you added and who added you | To establish one-to-one channels and count seat usage |
| Feedback | Problem reports you submit in the app, and any screenshots attached | To handle your issue |
2.2 Data generated through use
| Category | What it is | Why we need it |
|---|---|---|
| Account activity | Last active time, last read time, last sent time | To show presence, and to let the operator judge whether an account is still in use |
| Call records | The initiator, time and duration of calls (not the call content) | Call history and troubleshooting |
| Subscription and billing | Plan, validity period, order records, credit events | To fulfil the subscription, reconcile accounts and issue receipts |
| Push subscriptions | The push endpoint identifier for your device | To alert you to new messages when you are not in the app |
| Technical logs | Request times, error information, IP addresses | Security protection and troubleshooting |
2.3 What we do not collect
| Purpose | Data | GDPR legal basis |
|---|---|---|
| Providing the messaging service itself | Account information, message content, contact relationships | Performance of a contract (Art. 6(1)(b)) |
| Handling subscriptions and payments | Subscription and billing data | Performance of a contract / legal obligation |
| Push notifications for messages | Push subscription identifier | Performance of a contract (you can turn it off on your device) |
| Security protection and abuse prevention | Technical logs, account activity | Legitimate interests (Art. 6(1)(f)) |
| Complying with tax and accounting rules | Billing records | Legal obligation (Art. 6(1)(c)) |
| Speech-to-text and message translation (optional features) | The content of the specific message you triggered | Your consent (Art. 6(1)(a)); you can stop using them at any time |
We do not use your personal data for advertising, nor for automated decision-making or profiling.
| Data | Retention |
|---|---|
| Message content | You decide — you can set a retention period per conversation, after which messages are automatically archived or deleted; if you set none, until you delete them or close your account |
| Account information | For the life of the account; permanently deleted within 30 days of closure |
| Order and billing records | 7 years from the date of the transaction (tax and accounting requirements), then deleted |
| Technical logs | 90 days |
| Call records (metadata) | 180 days |
| Feedback tickets | 12 months after closure |
| Encrypted backups | Rolling 30 days; content you delete is also removed from backups |
When the retention period ends, data is deleted or irreversibly anonymised.
We do not sell your personal information. We also do not use it for third-party advertising.
Data is processed by third parties only where necessary, and always under a data processing agreement:
| Third party | What they process | Purpose |
|---|---|---|
| Waffo Pancake | Payment information (card numbers are handled by them; we never see them), order amounts | Payment processing |
| Server and infrastructure providers | Storage and transmission of encrypted data | Hosting the Service |
| Email delivery providers | Your email address and the message body | Sending password resets, billing and renewal reminders |
| Third-party AI model providers | Only the content of the specific message you actively triggered | Speech-to-text and message translation (optional features) |
We may also disclose data to competent authorities where the law requires it. When we receive such a request, we check that it is lawful and, to the extent the law allows, notify you.
6.1 Payments for the Service are handled by Waffo Pancake as a PCI-DSS compliant payment processor. Your full card number is never stored on our servers. We keep only what is needed for reconciliation: amount, time, status and the last four digits.
6.2 If you pay with cryptocurrency, we keep only the transaction hash and amount for reconciliation. We do not hold your wallet's private keys.
⚠️ In plain terms: text and image messages are stored on the server in readable form (so that you can switch devices and scroll back), which means the operator is technically able to read them. We do not claim that text messages are end-to-end encrypted. If you need stronger control, you can deploy the Service on your own server.
Breach notification: if a breach occurs that may put your rights and freedoms at risk, we will notify the supervisory authority within 72 hours of becoming aware of it, and notify affected users promptly.
Our servers may be located outside your country or region. Where we transfer data outside the European Economic Area, we do so on the basis of Standard Contractual Clauses (SCCs) or another recognised safeguard, with supplementary measures where necessary.
Wherever you are, you can:
To exercise these rights, email we@boldword.chat. We respond within 30 calendar days; complex cases may take longer, but we will tell you first. Exercising your rights is free, unless a request is manifestly unfounded or excessively repetitive.
California residents (CCPA/CPRA): you have the rights to know, delete, correct, and not be discriminated against. We do not sell personal information, nor share it for cross-context behavioural advertising. Exercise your rights through we@boldword.chat in the same way.
The Service uses no third-party advertising or analytics cookies and does no cross-site tracking.
We use only the technical storage needed to run the Service:
| Name / purpose | Type | What it does | Lifetime |
|---|---|---|---|
| Login session | Cookie (httpOnly) | Keeps you signed in | Until sign-out or expiry |
| Interface preferences | Browser local storage | Remembers your own choices, such as language and appearance | Until you clear browser data |
| Offline cache | Service Worker cache | Lets the app open without a network | Until you clear browser data |
Because all of this storage is strictly necessary, the Service does not display a cookie consent banner.
The Service is not directed to persons under 16. We do not knowingly collect their personal data. If you believe someone below that age has given us data, contact we@boldword.chat and we will delete it.
By default we send only service-related emails that are necessary (password resets, billing, renewal reminders, notice of significant changes).
If you have agreed to receive product news, every such email carries a one-click unsubscribe link. Unsubscribing does not affect the necessary emails above.
The Service or our website may contain links to third-party sites. Those sites have their own privacy policies and we are not responsible for their content or practices.
We may update this Policy. For material changes affecting your rights, we will notify you at least 30 days before they take effect, by in-app notice or email. Each version is marked with a version number and effective date and archived; previous versions can be requested from we@boldword.chat.
For privacy and data rights, security incidents and general support, please email we@boldword.chat and state the subject in the email title.
BoldWord
The accompanying Terms of Service are at https://boldword.chat/en/terms .