Last updated 29 July 2026
URLChat lets you chat with other people who are viewing the same web page at the same time. This policy describes exactly what the extension sends, what the server can see, and how long anything is kept.
URLChat has no sign-up, no login, no email address and no password. It sets no cookies
and uses no analytics, advertising or third-party tracking of any kind. Your identity in
a conversation is a randomly assigned nickname such as fluent-quoll-95.
| Data | Why | Kept for |
|---|---|---|
| An opaque room identifier for each open tab; a truncated SHA-256 hash of the normalised page address | To place you in the same room as other people on the same page, and to count how many people are there | While the tab is open |
| Messages you send | To deliver them to the other people in the room | In memory only; the last 50 per room, deleted when the room empties |
| A random installation identifier, generated in your browser on first run | To derive your per-room nickname so it stays consistent within a conversation | For the duration of your connection |
| Your IP address, as with any internet connection | To limit how many connections one address may open, which is what prevents abuse | In server logs, typically a few days |
The addresses of the pages you visit are never sent. The extension normalises and hashes each address inside your browser and transmits only the hash.
Two points must be made, and stated plainly because both are consequences of how the service has to work:
Messages are readable by the server. They are not end-to-end encrypted. Connections use TLS, so nobody between you and the server can read them, but the server itself processes message text in order to relay it, apply rate limits and make moderation possible. Do not send anything private, personal or sensitive through URLChat.
The site you are on can be inferred, even though the specific page cannot.
Each page maps to two rooms: one for the exact address and one for the bare domain.
The identifier for a specific page is a hash of a full address and cannot realistically
be reversed. The identifier for a domain is a hash of something like
example.com, and there are few enough real domains that anyone operating
the server could compare against a precomputed list. So the operator can determine
which sites connected users are on, though not which pages.
Nothing is written to a database (there isn't one). Rooms exist only in the server's memory, hold at most the last 50 messages for people joining mid-conversation, and are destroyed the moment the last participant leaves. Restarting the server erases everything, including all nicknames.
Message text is not written to the server's logs. The logs record connection events, shortened room identifiers, nicknames, timestamps, message lengths and IP addresses, which is what makes it possible to investigate abuse.
Inside your browser, the extension stores one value: the random installation identifier. Removing the extension deletes it.
The extension deliberately refuses to open a room on addresses that are likely to be private, including local and private network addresses, and any address whose path looks like an account, inbox, checkout, login, settings or administrative page. On those pages no identifier is generated and nothing is sent.
No data is sold, rented or shared with third parties. It is not used for advertising, profiling, credit assessment or any purpose unrelated to running the chat service. There are no third-party services embedded in the extension.
URLChat is not directed at children under 13. Because conversations are with strangers and unmoderated in real time, it is not a suitable service for young children.
Because nothing is stored persistently and there is no account, there is no history to request or delete. Uninstalling the extension ends all data collection immediately. Messages already sent to a room disappear when that room empties or the server restarts.
If this policy changes, the date at the top of this page will change with it.
Questions about privacy, and reports of abuse, can be raised on the project's public issue tracker at https://github.com/mdbloice/URLChat-Public/issues. Please do not include personal information in a public issue.