Privacy Policy

Last updated: October 2026

Couch is a free, private video room for two people. This policy explains what we collect, why, who helps us run Couch, and what you can ask us to do with your data. It's written to be readable, not to trick you.

1. Who Runs Couch

Couch is run by Hemendra Khatik, an individual based in India. It isn't a company. When this policy says "we" or "us", it means Hemendra Khatik.

Hemendra decides what personal data Couch uses and why, and is responsible for it (the "data controller" under European law and the "data fiduciary" under India's Digital Personal Data Protection Act). You can reach Hemendra about anything in this policy at [email protected].

2. The Short Version

3. What We Collect

Here's what we store, feature by feature. Apart from home page visits, all of it is linked to your Couch account.

• Your account — when you sign in with Google, we store your name, email address, a link to your profile photo, how you signed in, when you joined and when you last signed in. We also store when you confirmed you're 18 or older, which version of our terms you agreed to, and which "what's new" notes you've already seen.
• Rooms — the names you give your rooms, the rooms you've visited, whether you created or joined each one, and how often you've been there.
• Time together — when you were in a room, for how long, and the name of the person you were with. This powers your session history and your total time together.
• Little things (removed) — notes you added to a room's list before we removed the feature, with your name as the author. They are no longer shown or used in Couch.
• How Couch is working — simple product events such as opening a room, knocking, joining, whether a call connected directly or through our relay, connection speed (round-trip time), error codes, and the kind of device you're on (worked out from your browser's user agent). These are linked to your account and the room, and help us find bugs and understand how Couch is used.
• Feedback and reports — if you send feedback or use "Report a problem" in a room, we store what you write, what kind of message it is, and your account ID, name and email. Reports from inside a room also include the room ID. When you report a person from the app, we store who you reported, the reason you picked, anything you wrote, the room ID, your account ID, and the last messages (up to 20) that person sent you in that room's chat, so we can see what happened. The person you report isn't told who reported them.
• People you block — who you blocked (their account ID and name) and when, so we can keep you apart. They aren't told.
• Your story (optional) — after you've spent a few hours on Couch, we may invite you to share your story. If you choose to, we store your name, email, phone number and country, preferred language, how you found Couch, your short story and whether you'd like your photo shown. We use your phone number only to contact you about your story, by call or WhatsApp, never for marketing. Nothing is published without your OK, and you can ask us to delete it at any time.
• Home page visits — on our home page only, Google Analytics measures visits and where visitors come from. See section 6.

Face filters also run entirely on your device. No images or face data leave it. The filter itself is downloaded from Google's servers the first time you use it.

What we don't collect:

• No audio or video recordings of your calls
• No copies of your chat messages, reactions or game moves (apart from messages included in a report)
• No payment information — Couch is free
• No contacts or address book
• No location tracking — though, like any website, your IP address can hint at roughly where you are (see sections 4 and 6)

4. How Calls Work

Your audio, video and screen share go directly between your browser and the other person's, peer to peer. They're encrypted end to end using the standard encryption built into WebRTC (DTLS-SRTP). Calls are never recorded.

Sometimes a direct connection isn't possible, for example on strict office or public Wi-Fi networks. Then your call goes through our own relay server, hosted with DigitalOcean in India. It stays encrypted the whole way, so the relay only passes scrambled data along and can't see or hear your call.

To set up the connection, we run a signaling server, hosted with Fly.io in India. It passes connection details between the two of you (including network addresses), along with knocks, chat messages, reactions, game moves and "saved a moment" notices, in real time. Chat, reactions and game moves aren't stored. The server does note when sessions start and end, which feeds the time-together and usage data in section 3.

To help your browsers find each other, they also contact Google's STUN servers, which see your IP address.

5. Why We Use It

We only use your data for these reasons. In brackets is the legal basis European data protection law asks us to name.

• To run Couch for you — signing you in, rooms, knocks, calls, chat, games and your time together. (Needed to provide the service you signed up for.)
• To keep Couch safe and working — preventing abuse, handling reports, and fixing bugs and connection problems. (Legitimate interests.)
• To understand and improve Couch — product events and usage totals. (Legitimate interests. You can object, see section 10.)
• To measure home page visits — Google Analytics. (Your consent, if you're in Europe or South Korea.)
• To contact you about your story — only if you filled in the story form. (Your consent.)
• To follow the law — for example, answering valid legal requests. (Legal obligation.)

If you're in India, we use your data based on the consent you give when you sign in and agree to our terms, or where India's data protection law otherwise allows it. We never use your data for advertising, and we don't make automated decisions about you that have legal or similar effects.

6. Cookies & Browser Storage

Google Analytics, home page only. Our home page uses Google Analytics to count visits and see where visitors come from (such as the site that sent you, your country and device type). It sets the cookies _ga and _ga_*, which last up to two years unless you clear them. It doesn't run on your dashboard or in rooms. Advertising storage and Google signals are turned off.

If you're in Europe (the EU, EEA, UK or Switzerland) or South Korea, we ask first, and Google Analytics only loads if you accept. Elsewhere, it loads by default on the home page. You can block it with your browser's settings or Google's Analytics opt-out add-on.

Storage Couch needs to work. Couch also keeps a few things in your browser so the app works and remembers your choices. These aren't used for tracking:

• Your sign-in session (kept by Firebase in your browser)
• Your Moments
• Small preferences, like mute settings, notices you've dismissed, your 18+ confirmation and your analytics choice
• Your display name for a room session, cleared when you close the tab

Reaction animations are loaded from Google (fonts.gstatic.com) and the face filter from Google's storage servers. As with any web request, Google sees your IP address when your browser fetches them.

7. Who We Share It With

We never sell your data, and we don't share it for advertising. A few providers help us run Couch and handle data only to do that job:

• Google (Firebase) — sign-in, and storing your account and the data in section 3.
• Fly.io — hosts our signaling server, in India.
• DigitalOcean — hosts our call relay, in India. It only ever sees encrypted call data.
• Vercel — hosts and serves the Couch website and app pages, and keeps standard technical logs such as IP addresses.
• Google Analytics — home page visits, as described in section 6.
• Google STUN, storage and font servers — help connect calls and deliver the face filter and reaction animations. They see your IP address.

The other person in your room sees your display name, whatever you share on camera, screen and chat, and, on a direct connection, your IP address.

We may also share information if the law requires it, to answer a valid legal request, or to protect someone's safety.

8. Where Data Is Stored

Your data is stored with Google (Firebase), Vercel, Fly.io and DigitalOcean, and may be processed in India, the United States and other countries where these providers operate. That can mean it's handled outside the country you live in. We rely on the safeguards these providers offer in their data processing terms, including for data that leaves Europe.

9. How Long We Keep It

• Account info, rooms and your total time together: until you delete your account
• Session history: up to 12 months, then deleted
• Little things notes (feature removed): until the room is deleted
• Product events: up to 180 days, then deleted
• Other usage records (sessions and room activity): up to 90 days, then deleted
• Feedback and reports: as long as we need to handle them
• People you block: until you unblock them or delete your account
• Your story: until you ask us to delete it
• Calls, chat messages, reactions and game moves: never stored (except chat messages in a report)
• Moments and preferences on your device: until you delete them or clear your browser data

When you delete your account, we delete your account data straight away (or within 30 days when you ask us by email). A few things may be kept longer only where the law requires it or where they're needed for a legal claim or a safety report: we keep your account registration details (name, email and sign-in method) for 180 days after deletion, as India's IT Rules require, and safety reports you sent without your name or email.

10. Your Rights

Wherever you live, you can ask us to:

• Show you the data we have about you
• Correct anything that's wrong
• Delete your account and data
• Send you a copy of your data in a format you can take elsewhere
• Stop or limit some uses, such as product analytics
• Withdraw a consent you gave (this doesn't affect what happened before)
• If you're in India, nominate someone to act for you if you die or can't act yourself

You can delete your account yourself, any time: in the Couch app under Settings, or on the web at couchspace.live/delete-account. It happens straight away. You can also delete your Moments yourself in the app. For anything else, email [email protected], ideally from the email you sign in with. We may ask you to confirm it's really you.

We aim to reply to every request within one month. If you're unhappy with how we handled your data, you can complain to a regulator, such as your data protection authority in the EU or UK, or the Data Protection Board of India. We'd appreciate the chance to sort it out with you first.

11. Grievance Officer

Under India's IT Rules 2021, our Grievance Officer is Hemendra Khatik, reachable at [email protected]. Hemendra is also the person who answers questions about how your data is used under India's Digital Personal Data Protection Act, and the person in charge of personal information for Quebec's privacy law.

We acknowledge complaints within 24 hours and aim to resolve them within 15 days. Privacy grievances are resolved within 90 days at the latest.

12. Children

Couch is only for people aged 18 or older, and everyone confirms this before using it. We don't knowingly collect data from anyone under 18. If we learn that someone under 18 has an account, we delete it. If you think that's happened, please email us.

13. Security

Data is encrypted in transit, and calls are encrypted end to end. Access to stored data is limited to Hemendra Khatik, who runs Couch. We occasionally export data for backups and analysis, and those exports are kept securely. No system is perfectly secure, but if a breach affects your data, we'll tell you and the authorities where the law requires.

14. California & Other Regions

• Do Not Track — Couch doesn't track you across other websites, so we don't change anything based on your browser's Do Not Track signal. Google Analytics runs only on our home page and only measures visits to it.
• California — we don't sell your personal information or share it for cross-site advertising. You can make any of the requests in section 10, and we'll tell you about changes as described in section 15.
• Europe and the UK — section 5 lists our legal bases and section 10 your rights, including complaining to your data protection authority.
• Quebec — the person in charge of personal information is Hemendra Khatik (section 11).

15. Changes

We may update this policy. When we do, the date at the top of this page will change. If the change is significant, we'll also let you know in the app or by email.

16. Contact

Questions, requests or complaints about your privacy:

See also our Terms of Service.