Privacy Policy for HeyStranger

Effective Date: September 19, 2026 • Version: 1.0.0

At MadCodeLab ("we", "our", or "us"), we respect your privacy and are committed to protecting your personal information. This Privacy Policy details how we collect, process, secure, and manage your data when using the HeyStranger mobile application across Android and iOS platforms.

1. Introduction & Overview

HeyStranger is a real-time social networking and anonymous communication application designed to help people connect, chat, and share life perspectives safely. The app incorporates an intelligent AI Wingman assistant to provide icebreaker conversation starters, analyze room sentiment, and encourage engaging and respectful dialogue between strangers.

2. Information We Process

A. Account & Authentication Information

To access our platform, users may create an account using an email address, password, or one-time passcode (OTP/Magic Link), or explore the platform using an anonymous Guest Account.

• Credentials: All passwords are salted and hashed cryptographically using modern hashing algorithms prior to storage. Plain-text passwords are never accessible to our systems or staff.
• Anonymous Guest Mode: Users utilizing guest login are assigned a transient cryptographic identifier without requiring personal contact details.
• Local Device Security: User authentication tokens and session keys are secured inside your device's hardware-backed Secure Storage (Android KeyStore and iOS Keychain).

B. Public Profile & Match Preferences

HeyStranger emphasizes anonymity. You do not need to provide your legal name or physical address. You may optionally configure:

• Nickname & Bio: A public display name and a brief mood or vibe status.
• Demographic Generation & Gender Preferences: Age cohort generation (such as 8X, 9X, Gen Z) and gender preferences used solely by our matching radar algorithm to connect compatible conversational partners.
• Avatar & Unlockables: Default anonymous cartoon avatar or optional unlockable custom profile visuals.

C. Real-Time Chat & Multimedia Transmissions

During active chat sessions:

• Text Messages: Transmitted through secure WebSocket channels (WSS) and encrypted with Transport Layer Security (TLS 1.3).
• Voice Notes: Temporary audio messages sent between users are processed strictly to deliver the playback file to your chat partner. Voice files are not stored indefinitely and are pruned on server cycles.
• Photos & Media: Shared images are transmitted over encrypted HTTPS/WSS channels. They are not indexed publicly or made searchable outside of the active chat conversation.

D. AI Wingman Companion

HeyStranger includes an integrated AI Wingman feature designed to assist conversation flow (suggesting conversational topics, breaking the ice, and evaluating conversation vibe).

• Scope of Processing: When AI assistance is invoked, only the immediate recent conversational context is processed transiently to generate relevant prompts and icebreakers.
• No Public Model Training: Your private conversations are never utilized to train public machine learning foundation models or commercial advertising models.

3. User-Generated Content (UGC) & Safety Governance

In strict compliance with Apple App Store Review Guideline 1.2 (User-Generated Content) and Google Play Developer Policies, HeyStranger enforces a zero-tolerance policy against abusive, harassing, harmful, or illegal behavior:

• Instant User Blocking: Users can instantly block any conversational partner directly within the chat screen. Blocking immediately severs the active connection, suppresses all subsequent messages, and permanently excludes that user from your future matchmaking radar.
• Immediate Incident Reporting: An accessible reporting button is present in every chat room. Users can flag misconduct under clear categories (Harassment/Bullying, Inappropriate/NSFW Content, Hate Speech, Spam/Scams, or Threats).
• Prompt Moderation Action: Our moderation team reviews flagged content within 24 hours. Accounts confirmed to engage in violations are subject to immediate permanent bans and hardware-level identifier blacklisting.
• Prohibited Content: Content that depicts sexual violence, explicit nudity, hate speech, terrorism, non-consensual sexual content, or child sexual exploitation and abuse (CSAM) is strictly forbidden and immediately forwarded to relevant law enforcement agencies where required by law.

4. Device Permissions

HeyStranger requests device permissions strictly necessary for delivering user-initiated actions:

• android.permission.INTERNET: Required for establishing secure WebSocket chat connections and API synchronization.
• android.permission.ACCESS_NETWORK_STATE: Monitored to detect connection interruptions and ensure smooth chat auto-reconnects.
• android.permission.RECORD_AUDIO / NSMicrophoneUsageDescription: Requested only when you tap and hold the microphone button to record a voice note for your chat partner. Audio is never recorded in the background.
• READ_MEDIA_IMAGES / Photo Library Access: Requested only when you deliberately select an image to share in the chat room or customize your profile.
• POST_NOTIFICATIONS: Delivers optional push notifications for incoming match alerts or new direct messages.
• No Invasive Permissions: HeyStranger does NOT request access to your phone contacts, SMS messages, device call logs, or continuous background GPS location coordinates.

5. Advertising Practices (Google AdMob)

HeyStranger may serve advertisements through Google Mobile Ads (AdMob) to support free community infrastructure.

• Identifiers & Diagnostics: The AdMob SDK may collect coarse diagnostic information and standard advertising identifiers (such as Google Advertising ID or Apple IDFA, subject to your explicit App Tracking Transparency consent).
• Consent Management: In the European Economic Area (EEA), UK, and other relevant jurisdictions, we utilize Google's User Messaging Platform (UMP) to offer granular control over personalized versus non-personalized advertisements.
• Publisher Verification: HeyStranger complies with our verified Authorized Digital Sellers declaration hosted at app-ads.txt under publisher ID pub-1133420470079320.

6. Data Security & Storage

We employ robust industry-grade security measures to safeguard all handled information:

• Transport Encryption: All data in transit between the HeyStranger client and our servers is secured with TLS 1.3 encryption and Secure WebSockets (WSS).
• Authentication Protection: Cryptographic access tokens and refresh tokens follow OAuth 2.0 / JWT standards with strict expiration and revocation mechanisms.
• Access Controls: Server infrastructure is hosted in protected cloud environments with multi-factor authentication and role-based access restrictions.

7. Data Retention & Account Deletion

You have complete control over your account and information in accordance with Apple App Store Guideline 5.1.1(v) and Google Play Data Safety standards:

• In-App Deletion: You may permanently delete your account and profile directly within the application via Profile Settings → Delete Account.
• Deletion via Email: You can also submit an account deletion request by emailing madcodelab68@gmail.com from your registered address.
• Permanent Removal: Once initiated, your account credentials, profile details, match history, and associated logs are permanently expunged from active production systems within 30 days.

8. Minimum Age Restriction (17+)

HeyStranger is exclusively intended for individuals aged 17 years and older (17+ on Apple App Store, 18+ on Google Play) due to the open-ended nature of real-time anonymous communication between strangers.

We do not knowingly collect personal data from minors under the age of 17. If we discover that an account has been established by an individual under 17, the account and all associated data will be terminated immediately.

9. Policy Updates

We may update this Privacy Policy periodically to reflect new features, infrastructure changes, or legal obligations. When significant updates occur, we will revise the "Effective Date" at the top of this policy and notify users through an in-app announcement where appropriate.

10. Contact Us

For inquiries, data protection requests, or feedback regarding this Privacy Policy, please contact our privacy team:

• Entity: MadCodeLab
• Email: madcodelab68@gmail.com
• Website: https://blog.madcodelab.com