Privacy Policy

1. Scope and operator information

This policy explains how UFI’s reviewed implementation handles information when you sign in, use calls and chat, report someone or appeal a ban. It distinguishes live media, temporary device memory, uploaded evidence and other service records.

UFI is operated by Covert Digital Solution. For privacy, account data or underage-data concerns, contact hello@ufi.my. The data-deletion page below explains the manual request process, including requests relating to Facebook Login.

2. Social sign-in information

When you use an available Apple, Google or Facebook sign-in option, UFI processes the provider name, that provider’s account identifier, and the email address and display name where supplied. It records an email-verification status; Facebook email is not treated as verified by this implementation.

UFI also stores a limited-length serialized copy of the provider profile or validated identity-token claims, together with identity and login timestamps. This copy may contain additional claims supplied by the provider; it is not limited to the separately listed email and name fields. A name supplied by the provider may be a real name.

The sign-in flow uses temporary state, a code verifier and, for the applicable providers, a nonce to protect the login exchange. UFI receives login tokens as part of that exchange. The reviewed identity record does not persist the provider’s access token as a profile field. UFI does not ask you to enter your social-provider password into UFI.

3. Account preferences and acceptance records

Account records include an internal identifier, account timestamps, email-verification information, optional display name, country and gender, language, favourite languages, preference version and moderation-related flags. Country data is at country level, not exact coordinates. A stored country or profile choice is not independently verified identity or location.

UFI records a consent timestamp and version when it creates a social account. This is not documentary age verification. The current implementation does not create a fresh acceptance record for every sign-in by an existing account. The document revision shown on these pages is not itself a newly accepted consent version.

4. Session and security cookies

UFI uses cookies to keep you signed in, rotate session credentials, protect requests against cross-site request forgery and identify the session to revoke on sign-out. These cookies are named ufi_at, ufi_rt, ufi_csrf and ufi_sid. The login exchange also uses ufi_oauth_state.

Access and refresh credentials are stored as hashes in the session database. The browser holds the actual cookie values; the CSRF cookie is intentionally readable by the app. Production session cookies use Secure and SameSite controls, and authentication cookies are HttpOnly.

The configured defaults are 15 minutes for an access credential and 30 days for refresh-related cookies. Refresh rotates credentials and renews their validity. The OAuth-state cookie lasts up to 10 minutes. Operators can configure session durations. Cookie expiry is not a promise that related database records or backups are deleted at the same time. Blocking or clearing required cookies can interrupt sign-in and calls.

5. Preferences stored on your device

UFI caches saved language and favourite-language preferences in localStorage under an account-specific key. The saved profile is authoritative. Theme selection is stored separately in localStorage. The chat page also uses sessionStorage to remember whether calling was active or stopped.

These preference and interface entries are separate from report images. The report-image buffer is not saved to localStorage or IndexedDB. Signing out clears the in-memory report buffer but does not promise to remove saved language or theme preferences. You can clear browser site data; doing so does not delete server-side account or moderation records.

The saved partner-country filter is separate from your own country and uses the same account-scoped preference cache. Logout attempts to remove that account cache; browser storage may be unavailable.

6. Connection and conversation metadata

UFI processes connection information to authenticate sessions, match participants, relay signaling and apply security limits. Session records can include a browser user-agent value and an IP value from a configured trusted ingress header; when that trusted value is unavailable, the application uses an untrusted marker instead. Service infrastructure still handles network addresses to deliver traffic.

Conversation records contain the paired account identifiers, an opaque conversation identifier, start time and, when recorded, end time and end reason. Moderation and security audit records can contain an actor, action, target, time and supporting metadata. These records are not call recordings.

A partner’s matching payload contains an opaque per-match identifier and a coarse country value, not their email address or internal account identifier. Signaling passes connection descriptions and ICE candidates between participants. Those network details can reveal an IP address even though account fields are limited.

7. Live audio and video

Calls use WebRTC to send encrypted audio and video between participants, directly when possible or through a configured TURN relay. UFI does not record live audio or video on the server. The signaling and TURN components in this design cannot take their own video frame from the encrypted call. Report snapshots are a separate browser-side feature described below.

Your partner receives what your camera and microphone share. They may use their own device or software to record it, even though UFI’s rules prohibit recording and sharing others. UFI’s lack of server recording does not mean a call cannot be copied by another person.

8. Direct connections and relay-only mode

The default connection policy permits direct connections. A peer may learn your network IP address. The operator can configure relay-only calling, which routes media through a TURN relay rather than using a direct media connection.

When relay-only mode is enabled, missing or invalid relay configuration prevents calling rather than allowing a direct fallback. A failed relay connection does not switch to a direct connection. Relay use can add latency and bandwidth costs for the operator. This is an operator configuration, not a user privacy switch promised by these pages.

Relay-only calling is not complete anonymity. The other participant still sees and hears you, and service and relay infrastructure process connection metadata. Relay availability and deployment mode depend on service configuration; this policy does not guarantee a particular relay provider or processing country. Contact hello@ufi.my for current infrastructure information.

9. Text chat and reactions

Text messages and reactions pass through UFI’s WebSocket server to the current conversation partner. Unlike the WebRTC media path, the server processes the message text to route it. Do not assume text chat has the same peer-to-peer encryption properties as audio and video.

The chat path does not save a chat transcript to the application database or attach a transcript to a report. Messages can remain visible in the chat interface while you use it. This is not a guarantee about infrastructure logs, backups of other records or copies made by a participant. Contact hello@ufi.my with questions about infrastructure logging.

10. Temporary report snapshots

When a usable remote video frame is available, the browser captures one reduced-size JPEG for a partner. It keeps snapshots for up to the last five distinct partners in device memory only. A rematch replaces that partner’s earlier eligible entry. The image is a still frame, not a recording of the call.

Unreported snapshots are not uploaded or saved by this feature to localStorage, IndexedDB or an application disk cache. The report window is bounded to 30 minutes from the conversation’s start, not from when you later open reporting. Older or ineligible entries are removed, and the buffer and its object URLs are cleared when you sign out or leave the chat page.

The same feature runs for the other participant. Their browser may temporarily hold a snapshot of you, and they may submit the selected snapshot if they confirm a report. Do not assume that only your browser can make a report image.

11. What confirming a report sends

Only the selected snapshot is uploaded when you confirm a report. The request identifies the selected conversation; the server checks your membership and eligibility and derives the reported account from that conversation. Other buffered snapshots, chat transcripts and audio or video recordings are not included.

The server validates and re-encodes the image as a bounded JPEG and strips image metadata. It stores the accepted report’s account and conversation references, category and time, with image metadata such as a hash, dimensions, size, provenance and expiry. A limited temporary storage reservation may exist during a failed or interrupted submission and is eligible for cleanup.

Cancelling stops the browser request but cannot undo a report already accepted by the server. A timeout may therefore require retrying with the same snapshot. Submitting a report does not make the image independently authenticated: it comes from a user-controlled device and can be altered.

12. Private evidence and human moderation

Uploaded report images are kept in private storage outside the public web directory. The application serves them through a protected moderator route rather than a public image URL. Authorized moderator reads and expiry-based denials are audited. Responses instruct browsers not to cache the image.

Moderators can review evidence and record a reasoned decision. Reports, review states, decisions, bans, appeals and access logs are separate records. Automated rules can prioritize reports and apply bounded temporary protection, but a complaint count is not proof of misconduct and does not itself impose a permanent ban.

The software can receive reports continuously when available. Human coverage and response times are not guaranteed. A private route and access audit do not prevent an authorized recipient from copying pixels already delivered to their device.

13. Seven-day image expiry and other retention

An accepted report snapshot expires seven days after the successful report, not seven days after capture. Retrying the same accepted report, moderator review or an appeal does not restart that image’s expiry period. The service denies new reads at expiry even if physical deletion has not yet completed.

The deletion target is seven days after acceptance. Cleanup removes expired server image files and retries failures. Outages or storage errors can delay physical removal; access expiry remains separate from cleanup. This policy does not promise instantaneous physical erasure at the deadline.

After account-control verification, our deletion process removes the UFI profile, sign-in identities, password hash where present and session credentials, and deletes or unlinks the requester’s unreported conversation records while preserving another participant’s records. Requests involving moderation, administrative access or a documented legal hold need separate review. Necessary pseudonymous references and keyed sign-in identifiers may be retained to preserve active bans and another person’s case; they are not a retained full profile. Deletion must not undo an active ban or destroy required evidence.

We retain only the minimum moderation and related audit records needed while a case, appeal or ban is active, with deletion 90 days after closure or expiry, whichever relevant event occurs last. This is a deletion requirement, not merely a review date. A permanent ban remains active until lifted. A documented legal hold may extend retention of the affected records; its reason, scope and review must be recorded. Report images keep the separate seven-day access expiry described in the Privacy Policy.

Our policy requires backups to expire within 30 days and verified erasures to be reapplied before restored data is returned to service. A restricted erasure ledger outside database backups holds identifiers and integrity information needed for that replay. The 90-day rule concerns eligible moderation and audit records in the application database, not automatic expiry of this separate ledger or its independent recovery copy. Documented legal-hold exceptions must identify affected records and be reviewed; they are not a blanket exemption for all backups. This is not instantaneous deletion of every backup.

These are policy requirements, not a claim that all retention controls have already been verified in the deployed service. Deletion and retention operations require operator action and verification; publication alone does not install an automatic cleanup schedule or confirm completed removal. Our response distinguishes completed removal from retained information and outstanding work, with the reason and applicable retention period.

Report images retain the separate seven-day access expiry described above. Signing out, removing UFI in Facebook settings, or clearing browser data is not by itself a request to erase UFI’s server records. We cannot recall copies made by another participant.

14. Why information is processed

UFI uses account and session information for sign-in and access control; preferences and country values for the interface and matching; connection data, text and reactions for delivering conversations; and reports, evidence and audit records for abuse prevention, human review, appeals and operational checks.

These purposes do not mean that one consent covers every legal basis. Applicable privacy law governs the legal grounds, notices and rights required for processing. Accepting terms or granting camera permission does not waive those rights or remove the operator’s obligations. Contact hello@ufi.my with questions about the grounds for processing your information.

15. Who receives information

Your conversation partner receives the media, text and reactions you send and limited matching information. Social sign-in providers process the authentication exchange. Authorized moderators can access accepted report evidence before expiry and the records needed for review. Configured hosting and network or relay infrastructure process information needed to run their parts of the service.

Provider privacy terms apply to their own services. Hosting, network and social-provider processing may involve different countries; this policy does not promise that information stays in one country or certify any contractual safeguard. Contact hello@ufi.my for current provider and processing-location information or questions about disclosures, advertising, analytics or data-sale practices.

16. Your controls and privacy requests

You can stop a call, sign out, change supported preferences, and manage camera, microphone and site-storage permissions in your browser. Calls need both camera and microphone access; withholding or withdrawing either can prevent calls. Changing browser settings or signing out does not delete accepted reports or server records.

To request access, correction or deletion, or raise a privacy concern, email hello@ufi.my. Depending on applicable law you may also have rights to object, restrict processing, withdraw consent or complain to a competent authority. We handle these requests manually and verify control of the relevant UFI account before disclosing or deleting information.

Follow the Data Deletion Instructions below. Facebook email, a display name, a screenshot or a claimed account ID alone is not sufficient verification. Do not send passwords, login codes, cookies or access tokens. If you cannot sign in, tell us; we will discuss a proportionate alternative without promising deletion of an unverified account.

17. Security and underage use

UFI uses server-side session checks, restricted evidence access and other security controls, but no system can guarantee complete security or prevent every misuse by a recipient. Keep your provider account secure and avoid sharing sensitive personal information in calls, text or appeals.

UFI is for adults aged 18 and over. Social sign-in and an age statement are not age verification. If you suspect a participant is under 18, end the interaction and use the available reporting control. Contact hello@ufi.my for concerns about an underage person’s data.

18. Changes to this policy

We publish an effective date with revisions to this policy and explain material changes as required by applicable law. English and Bahasa Melayu versions are available. Publishing new text does not retroactively change the consent record for an earlier sign-in.