Privacy, in plain language.

The website demo

When you send a message in the demo chat, your browser sends the recent conversation (at most the last 10 messages, with each message limited to 1000 characters) to our server function at /api/chat. The function adds the assistant's instructions and passes the conversation to a Qwen language model on a model server that the site operator configures (the operator chooses where that model runs, for example on their own hardware), then streams the reply back. The server address is set by the operator, not by visitors.

• We do not write your messages or the replies to any database, file or log. They exist in memory for the length of that one request.
• Chat history stays in your browser tab. The widget keeps it in the page's memory only. It is not saved to cookies, localStorage or sessionStorage, and it disappears when you close or reload the tab.
• Please do not share sensitive information (passwords, payment details, health or identity documents) with the demo. It does not need them.
• The model is an AI, and its answers can be wrong. It is instructed to say so when it is unsure.

Rate limiting

To limit abuse and cost, the demo allows at most about 20 messages every 10 minutes per visitor. To count them without storing your IP address, the function computes a salted SHA-256 hash of the IP address, keeps the first 32 hexadecimal characters, and stores a request count under a key made from that hash and the current time window, in Cloudflare KV (when the optional KV namespace is enabled; otherwise a stricter counter lives only in the memory of the running function and is never written anywhere). The stored value is just a number, and the entry expires after 11 minutes. Because KV is eventually consistent, the limit is approximate.

A hash of an IP address is still derived from personal data, and IPv4 addresses have a small search space, so we treat the counter as personal data too. It is short-lived and used for nothing except the limit.

WhatsApp

When someone messages the AbsolutChat WhatsApp number, WhatsApp (Meta) delivers the message to our server function at /api/whatsapp. After verifying that the request really came from Meta, the function generates a reply with the same configured model server and sends it back through Meta's API. Specifically:

• Short conversation memory. So that follow-up questions make sense, the text of up to the last 8 messages (yours and the assistant's) is stored in Cloudflare KV for 1 hour. The time limit restarts each time you send a message, and the entry is deleted automatically once it runs out.
• Your phone number is not stored in plain text. It is used to send the reply, and the stored entries are keyed by a salted SHA-256 hash of it (first 32 hexadecimal characters), not by the number. Message text, however, is stored as described above and may itself contain whatever you wrote.
• De-duplication. Meta sometimes re-delivers a message. To avoid answering twice, we store a marker under a hash of the message ID (no message content) for 1 day (24 hours).
• Rate limit. At most 15 messages per 10 minutes are answered per sender, tracked by a counter keyed by the same kind of hash and expiring after 11 minutes.
• Non-text messages. The assistant reads text only. If you send something else, it replies once (at most once per 1 hour) to say so, and we keep a content-free marker to remember that.
• Logs. No message content, phone numbers, IP addresses or tokens are written to logs.

WhatsApp and Meta. WhatsApp is operated by Meta, which processes your messages, your phone number and related metadata under its own terms and privacy policy (WhatsApp Privacy Policy). AbsolutChat is not affiliated with or endorsed by WhatsApp or Meta. The business that runs the WhatsApp number also receives your messages, by design.

What is stored, at a glance

Cookies, analytics and third parties

This site sets no cookies and uses no analytics, advertising or tracking scripts. Fonts and scripts are served from this site itself, so your browser makes no requests to third-party servers when it loads a page. The services that do touch your messages are:

• Cloudflare, which hosts this site and runs the server functions, and stores the KV entries above only if the site operator has enabled the optional KV namespace (without it, the rate limit counter is kept only in the memory of the running function and nothing is stored for WhatsApp memory). Like any host, it sees technical request data such as your IP address. See Cloudflare's privacy policy.
• The model server that generates the replies. The site operator chooses where it runs. It receives the text of the conversation (see above) from our server function; our function does not send it your IP address.
• Meta / WhatsApp, for the WhatsApp channel only, as described above.

Your choices

• On the website demo there is nothing to delete on our side. Close the tab to clear the chat.
• On WhatsApp, stop messaging and the memory expires on its own within 1 hour. You can also delete the chat in WhatsApp, though that does not touch Meta's own copies.
• Questions or requests about any of this: [email protected].

Changes to this page

If what we store changes, this page changes with it, and the date at the top is updated. This page describes our practices; it is not a certification, and it is not legal advice.