This Policy explains how LLC TICHAT handles personal data when you use the Tichat messenger, tichat.co, tichat.ru, and related services. It is written for an international audience and describes your rights where the GDPR or the UK GDPR applies.
Limited Liability Company TICHAT (LLC TICHAT, also ООО «ТИЧАТ») is the controller of personal data for the Tichat messenger, the websites tichat.co and tichat.ru, and the related services described here (together, the Service).
We are established in the Russian Federation, and our servers are there. Russian data-protection law applies to processing we carry out in Russia. If you are in the European Economic Area or the United Kingdom, the EU General Data Protection Regulation or the UK GDPR can also apply when we offer the Service to you. This Policy describes the same product in that language. It is the international statement for tichat.co. The Russian-language documents on tichat.ru describe the same operator for the Russian-language site.
Website forms are separate. The early-access waitlist and the investor form ask for consent on their own, version consent-en-1.0, by a checkbox that is not pre-ticked. Read Consent for website forms. That consent is not bundled into these Terms and is not assumed because you browse the site.
Creating an account or using the messenger means you have read this Policy. We process the data needed to run the messenger on the bases in section 4, including the contract between you and us.
If you do not agree with this Policy, stop using the Service and email info@tichat.ru to ask us to delete the personal data we hold about you.
The controller is:
Personal data is processed and stored in the Russian Federation. We have not appointed a representative in the EEA or the United Kingdom under GDPR Article 27. Contact the controller at info@tichat.ru.
| Category | What it includes | When |
|---|---|---|
| Identity | Phone number, name, username (@username) | When you register in the messenger |
| Contact | Email address | Waitlist, profile, or a form you submit |
| Profile photo | An image you choose to display. We do not use it for facial recognition or other biometric identification. | If you upload one |
| Messages | Text, media files, and messages you forward | When you use the messenger |
| Technical | IP address, device data, connection time, activity status | Automatically, while you use the Service |
If you join the early-access list or write through the investor form, we process your name, email, phone number if you provide one, and, for investors, company name and message. We use that data to reply to you. We do not sell it. The legal basis for these forms is your consent, version consent-en-1.0.
Paid plans (Tichat Pro and Tichat Business) are checked out today on the Russian product surface — in the Tichat app — through YooKassa (NCO YuMoney LLC). When you pay that way, we process the account identifier, email if you gave one, subscription status and term, the plan you chose, the amount and date, YooKassa transaction identifiers, and masked payment-method details if the partner provides them.
Card number, expiry, and security code are entered on YooKassa’s form and processed by that payment partner. We do not receive or store the full card details. Prices on tichat.co/pricing are informational. This site does not charge a card. For billing outside the Russian checkout, contact info@tichat.ru. Subscription terms are in the Terms of Service.
We do not collect your device location, your address book, or the contents of notifications from other apps. We do not use advertising trackers. Card details, when you pay on the Russian checkout, are handled by YooKassa, not stored by Tichat.
Where the GDPR or the UK GDPR applies, we rely on the following bases in Article 6. We do not use personal data to build advertising profiles.
| Purpose | Data | Basis |
|---|---|---|
| Run the messenger — deliver messages, manage chats, show status | Phone, name, profile photo, messages, activity status | Contract (Art. 6(1)(b)) |
| Sign you in — phone number, one-time code, session token | Phone number, IP address | Contract |
| Keep the Service secure — block unauthorised access and fraud, keep connection logs | IP address, connection logs, device data | Legitimate interests (Art. 6(1)(f)): a secure service. You can object. |
| Handle a waitlist or investor request | Name, email, phone, company, message | Consent (Art. 6(1)(a)), version consent-en-1.0 |
| Send service messages — one-time codes, invitations, technical notices | Email, phone number | Contract, or legitimate interests for security notices |
| Improve the Service — errors, load, aggregated use | Technical logs and aggregated statistics. Not message text. | Legitimate interests |
| Account for a paid plan on the Russian checkout | Account id, subscription status, amount, date, YooKassa transaction ids | Contract, and legal obligation where tax or accounting law requires a record |
| Meet a legal duty — answer a request from a competent authority | What that request lawfully requires | Legal obligation (Art. 6(1)(c)) |
Our legitimate interests are running a reliable messenger and understanding aggregate product use without advertising. We do not rely on legitimate interests for marketing.
Personal data is stored on servers physically located in the Russian Federation. In ordinary operation we do not move production personal data to another country.
If you are in the EEA, the United Kingdom, or another country, using the Service or submitting a form means your data is processed in Russia. The European Commission has not adopted an adequacy decision for Russia. Where the GDPR applies:
Russian law does not copy EEA safeguards. The measures in section 6 are how we protect the data. Read this before you create an account or submit a form.
| Data | Retention |
|---|---|
| Account data (phone, name, username) | Until you delete the account, then 30 days |
| Messages and media | Until you delete them, or until the account is deleted |
| One-time codes | 10 minutes from when they are created |
| Session tokens | Until the token expires |
| Technical logs | 90 days |
| Waitlist and investor requests | 3 years, or until you withdraw consent, whichever comes first, unless the law requires longer |
| Payment records from the Russian checkout | As long as we need them to account for the subscription and to meet tax and accounting duties |
LLC TICHAT does not sell, rent, or trade personal data.
We share personal data only in these cases:
We do not connect third-party ad networks or external analytics tags, including Google Analytics and Yandex Metrica. We do not build advertising profiles. Aggregated product statistics are described in Product statistics.
Where the GDPR or the UK GDPR applies, you can:
Email info@tichat.ru with the subject Personal data — [what you are asking]. Include your name and the phone number or email on the account or the form, and what you want us to do. We reply within 30 days. If a GDPR request is complex, we may extend that by up to two further months and will tell you if we do. We may need to confirm that the request comes from you.
You can also complain to a supervisory authority. If you live in the EEA, that is the authority in your country. In the United Kingdom, it is the Information Commissioner’s Office (ico.org.uk). You may also contact Roskomnadzor (rkn.gov.ru), the Russian authority for personal data, at Kitaygorodsky proezd 7, bld. 2, Moscow, 109074.
tichat.co and tichat.ru use technical session cookies only where they are needed to run an administrative console. We do not set analytics cookies or advertising cookies. Because we do not use non-essential cookies, we do not show a consent banner for advertising tags.
The Tichat mobile app does not use cookies. Sign-in uses a JWT stored in the device secure store (flutter_secure_storage, iOS Keychain, or Android Keystore).
We process technical and aggregated data about how the app is used: registrations and sign-ins, device platform, the fact that a message was sent and its type (text, voice, photo, and similar), creation of chats and channels, screens opened, and subscription and payment facts needed to account for a plan. Message text and media contents are not part of this.
Administrative reports are totals and trends. They are not tied to the contents of a particular person’s chats. This processing does not remove end-to-end encryption in private chats.
The Service is not directed at children. You must be at least 14 to create an account. If you are under 18, use the Service only with permission from a parent or guardian.
Where the GDPR’s rule on a child’s consent for an information-society service applies, we do not rely on consent from a child below the age set in that country (16, or as low as 13 where that country allows). The waitlist and investor forms use consent; if you are under that age, do not submit them.
We do not knowingly collect personal data from children under 14. If you believe a child under 14 has registered, email info@tichat.ru. We will delete that account within 3 business days.
The current version of this Policy is always at tichat.co/privacy.
If we make a material change, we will tell you in the app or by email at least 7 days before it takes effect. If the law requires fresh consent, we will ask for it. Continuing to use the Service after the change takes effect means you accept the updated Policy, except where consent has to be given again.
Questions about personal data:
Supervisory authorities: your local EEA authority, the UK ICO (ico.org.uk) if you are in the UK, and Roskomnadzor (rkn.gov.ru), Kitaygorodsky proezd 7, bld. 2, Moscow, 109074.