Cookie policy
There is no consent banner on this site because there is nothing to consent to. This page says exactly what is stored, what is measured and which third parties the page contacts.
The short version
That is not a turn of phrase. The site stores exactly one value in your browser, in
localStorage rather than a cookie, and it exists so that repeat visits are not
counted as new visitors. Everything about it is described below, including how to remove it.
The one thing that is stored
A single localStorage entry:
| Key | Value | Purpose | Lifetime |
|---|---|---|---|
dchat_tel_install | A random UUID, generated in your browser | Distinguishes a returning visitor from a new one, so a single person reading five pages is not counted as five people | Until you clear site data |
The value is random. It is not derived from your device, your network, or anything about you, and it is not linked to any other identifier. Clearing site data for this domain removes it and a fresh one is generated on the next visit. In a private window, or with storage disabled, an ephemeral identifier is used for that tab only and is discarded when you close it.
Do Not Track is honoured
If your browser sends a Do Not Track signal, the analytics script exits immediately. Nothing is stored, nothing is measured, and no request is made. This is checked before any other code runs, so the identifier above is never even created.
Most sites ignore this signal. This one does not, and the check is the first thing in the file if you want to read it.
What is measured, exactly
Page views and clicks on primary buttons. The complete list of what leaves your browser:
| Field | Example | Note |
|---|---|---|
| Path | /faq.html | Query strings and fragments are stripped before sending |
| Referrer host | duckduckgo.com | Host only, never the full URL, and never sent when the referrer is this site |
| Locale | en-GB | The browser language setting |
| Platform | web | A constant that separates website traffic from app traffic |
| Button label | download | Only for clicks on primary calls to action |
| Identifiers | The UUID above, plus a per-tab session id | Random, not linked to anything else |
Events are batched and sent to an endpoint on this domain. There is no advertising network, no third-party analytics SDK, no session recording, no heatmap, no device fingerprinting, and no cross-site tracking. Your IP address is visible to the server receiving the request, as it is for every request to every website.
Third parties this page contacts
Two, and it is worth naming them rather than pretending the page is self-contained.
Google Fonts. Typefaces load from fonts.googleapis.com and
fonts.gstatic.com, which means Google sees the IP address that requested them.
Blocking those domains costs you nothing but the typeface.
Download links. The Android download button goes to Google Play, which is Google's service under Google's terms. Following it is your choice, and the direct APK is offered so you can avoid it.
Nothing else on this site loads from anywhere but this domain.
If you use the contact form
What you type is what is sent: the fields you fill in, nothing more. Submissions are encrypted at rest and stored outside the web root, so they are not reachable by browsing the site. No email service is involved and your message is not forwarded to a third-party helpdesk.
Do not put a recovery phrase or a private key in that form, or in any other form anywhere. No one at DChat will ever ask for one.
The app is not the website
This page covers dchat.online only. The DChat application does not use cookies,
does not embed a web analytics SDK, and stores its data locally in an encrypted database. What the
app and the network can observe is described on the privacy page and,
at protocol level, in the whitepaper.
Questions about this page?
A person reads every message. If something here is unclear or looks wrong, say so and it gets fixed.