MitrHub is engineered on strict data minimization principles. We do not require user accounts, we do not store chat transcripts in databases, our 60-second voice and video calls route through TURN relays to shield your IP address, and optional analytics or ads are strictly prohibited on the chat route.
Zero Saved Chats
Messages exist solely in transient server RAM during relay and are erased immediately when you skip or disconnect.
Relay-Protected Calls
60-second voice and video calls route through TURN relays. Direct peer IP addresses are never exposed to partners.
You Control Tracking
Non-essential analytics and ads are denied by default, never run on /chat, and can be adjusted at any time.
1. Service Architecture & Operator Identity
Welcome to MitrHub ("we", "our", or "us"). MitrHub is operated as an independent, guest-accessible communication service that enables spontaneous, 1-on-1 text conversations and optional 60-second voice or video calls without requiring personal user registration, phone numbers, email addresses, or profile creation.
We believe that privacy policies should describe actual software implementation rather than generic legal boilerplate. This policy details our complete technical boundaries: what data is never requested, how real-time ephemeral communications are routed, how operational network metadata is processed, how safety controls operate, and how third-party infrastructure and measurement scripts interact with your connection.
Core Architectural Guardrails
No Personal Registration: You never need to submit a name, email address, password, or phone number to chat.
No Persistent Chat Databases: Conversations are relayed strictly through volatile server RAM and are never written to application database disks.
Zero Server-Side Media Recording: Audio and video call streams passing through our TURN relay infrastructure are never recorded, transcoded, or archived on our servers.
Strict Route Isolation: Google Analytics and Google AdSense are strictly excluded from loading on the active /chat route under all circumstances.
2. Ephemeral Text Messaging & Memory Stores
When you type a message on MitrHub, it travels over an encrypted WebSocket connection (TLS) directly to our application servers, which relay it immediately to your matched chat partner.
Encrypted In-Transit Transmission: All chat packets travel over encrypted WebSocket (WSS/TLS) tunnels between your client browser and our Node.js servers.
Transient In-Memory Routing: In-flight messages exist solely in volatile server RAM while being routed. Automated filtering evaluates packets in memory for malicious spam repetition, prohibited link patterns, and abusive keywords without logging the message text to persistent storage.
Disconnection Grace Buffering: If a partner temporarily encounters network instability, pending unacknowledged messages may be held in volatile memory during a brief grace window (up to 120 seconds). Once reconnected, messages are delivered; if the window expires or either party leaves, buffers are immediately destroyed.
Immediate Room Dissolution: When you or your partner taps "Next", confirms "End chat", or closes the browser tab, the room association is severed immediately. All ephemeral buffers in memory are wiped. Client-side message bubbles exist only in your browser tab's volatile React state and vanish on refresh or tab closure.
3. WebRTC Voice & Video Calling (TURN Relay Architecture)
MitrHub supports both optional 1-on-1 voice calling and 1-on-1 video calling. Both calling modalities are engineered with purposeful privacy boundaries and authoritative constraints:
Authoritative Calling Constraints
Mutual Explicit Consent: Calling is completely opt-in. A caller sends an invitation, and the callee must explicitly accept before any camera or microphone hardware is initialized. Declining dismisses the request without penalty, and text chat continues uninterrupted.
Strict 60-Second Duration Limit: Both voice and video calls are enforced by an authoritative server-side timer capped at exactly 60 seconds per match. At 45 seconds, a synchronized 15-second countdown warning is issued. At 60 seconds, the server terminates media signaling, cleanly returning both participants to their unlimited text conversation.
One Call Allowance Per Match: Each matched conversation is permitted at most one call session, preventing unmoderated continuous streaming and keeping the primary focus on text.
TURN Relay IP Shielding: Standard WebRTC peer-to-peer (P2P) connections expose user IP addresses directly to the remote peer. To protect your digital footprint, MitrHub enforces a strict relay-only ICE transport policy. Media packets route through Traversal Using Relays around NAT (TURN) servers. Your public IP address is never revealed to your chat partner; they only see the relay server's IP address.
Ephemeral Session Watermark Codes: During active voice and video sessions, the server issues dynamic pseudonymous session viewer codes (e.g., V-XXXXXX for video, A-XXXXXX for voice). These codes rotate per call and allow participants to reference a specific session when submitting abuse reports without revealing personal identities.
Zero Server Recording: Media packets passing through TURN relays are encrypted in transit via DTLS-SRTP and are never recorded, transcoded, inspected, or archived on our servers.
While MitrHub never records calls on server infrastructure and shields your network IP via TURN relays, MitrHub does not and cannot control actions taken by the other participant on their own physical device.
The other participant could potentially capture external photographs, take screenshots, or record audio using third-party operating system tools or secondary cameras. Always keep your physical surroundings neutral, avoid showing personal documents or badges, and exercise sound personal judgment during live voice and video interactions.
MitrHub provides immediate, user-empowered safety mechanisms to handle unwanted encounters:
Next (Skip)
Instantly disconnects your active room, cleanses volatile buffers in server memory, and enters the queue for a new match.
Report User
Flags abusive behavior. Emits an operational event containing transient socket ID, room ID, timestamp, report category, and ephemeral call session code (no chat transcripts or media recordings).
1-Hour Block
Registers a pseudonymous one-way cryptographic hash in volatile server memory to prevent rematching with that participant for one hour.
Temporary Block Details: 1-hour block records exist strictly in volatile server memory and are never written to permanent disk storage. If the application server restarts, all temporary block records in volatile memory are cleared.
To prevent relay bandwidth abuse, automated bot flooding, and infrastructure exhaustion while maintaining guest anonymity, MitrHub employs pseudonymous daily calling quota accounting:
Pseudonymous Cryptographic Token: When you connect, your browser receives a pseudonymous session token stored locally in localStorage under mitrhub_anon_token. This token contains zero personally identifiable information (no names, emails, or phone numbers).
Daily Quota Records: The backend tracks daily call allowances (1 voice call and 1 video call per day for guest users) using a cryptographic identity hash keyed by UTC date (YYYY-MM-DD).
Automatic Expiration: Quota records in the database feature strict automated Time-To-Live (TTL) expiration and are purged automatically after 7 days.
Platform-Wide Aggregate Budget: Platform-wide daily call seconds and call counts are tracked in aggregate solely for operational capacity safeguards and infrastructure cost limits. Aggregate metrics contain zero user IDs, room IDs, IP addresses, or message content.
6. Cookies, Local Storage, Analytics & Advertising
MitrHub distinguishes between essential client-side application storage, first-party analytics cookies set by measurement scripts, and advertising technologies:
MitrHub's own code and backend servers set zero custom first-party HTTP cookies on your device. We use browser localStorage exclusively for essential client-side operations:
mitrhub-theme: Remembers your dark or light display preference.
mitrhub_anon_token: Stores your pseudonymous cryptographic session token for fair-use daily calling quota safeguards.
mitrhub_consent_preferences: Stores your privacy and cookie choices so your decisions persist without repeated popups.
Third-Party Google Integrations (Public Non-Chat Pages Only)
Google Analytics 4 (GA4):
We use Google Analytics (via gtag.js) to evaluate aggregate website traffic, page visits, and platform stability on public non-chat pages. The script sets first-party cookies (such as _ga and _ga_*) under the MitrHub domain containing pseudonymous identifiers. Google Analytics is strictly excluded from loading on the active /chat route, and operates under Basic Consent Mode gating—meaning measurement tags do not fire on public pages until you grant affirmative consent through our Cookie Settings.
Google AdSense (Display Advertising):
We display third-party advertisements via Google AdSense on public non-chat pages (such as our homepage and blog) to support free anonymous chatting. When advertising consent is granted, Google uses cookies and device identifiers (such as __gads and __gpi) to personalize advertisements. When rejected, AdSense is signaled to request limited non-personalized ads (requestNonPersonalizedAds = 1) with data processing restricted to essential invalid traffic (IVT) fraud prevention where permitted; ad impressions are not guaranteed upon rejection. AdSense scripts and cookies are strictly prohibited and never loaded on the active /chat route under all circumstances.
7. Third-Party Infrastructure & Data Processors
MitrHub relies on reputable infrastructure providers to deliver a secure, scalable, real-time application. Each provider processes technical metadata in accordance with its respective operational privacy policies:
Hosting & Edge Network Infrastructure: Provides server execution environments, reverse proxying, DDoS mitigation, and SSL termination. Edge infrastructure logs standard HTTP request metadata (connecting IP address, user-agent string, timestamp, request URL) for operational security and routing. MitrHub does not store or manage these provider edge logs in application databases.
Real-Time Communications Relay Infrastructure (TURN): Relays encrypted WebSockets and DTLS-SRTP media packets to facilitate real-time chat and WebRTC calling without direct peer-to-peer IP exposure. Media packets are relayed in real time and are never recorded or stored.
Google LLC: Provides site analytics (GA4) and advertising (AdSense) on public non-chat pages subject to user consent and Google's Privacy & Terms.
8. Legal Frameworks, DPDP Act (2023) & International Rights
MitrHub is engineered with global data protection principles at its core:
Data Minimization & Purpose Limitation: We collect only the minimum technical metadata strictly necessary to operate the service, enforce fair-use limits, and prevent automated abuse.
Digital Personal Data Protection Act (DPDP Act, 2023 - India): MitrHub is operated from India. We adhere to statutory data protection principles regarding lawful processing, purpose limitation, and storage limitation. Because guest chat accounts and persistent chat transcripts do not exist, personal profiling is avoided by design.
European & International Privacy Frameworks (GDPR / UK GDPR / CCPA): Because MitrHub operates an unauthenticated guest service where text chats are ephemeral (in-memory relay only) and no persistent personal profiles exist for chat guests, MitrHub does not maintain databases of personal records linking your real-world identity to past anonymous chat sessions.
Exercising Rights: If you wish to clear your local storage tokens, theme settings, or consent preferences, you can do so instantly through your browser settings or via our on-site Cookie Settings modal.
9. 18+ Age Restriction & Child Safety
Under our Terms of Service (Section 1: Eligibility), MitrHub is intended strictly for individuals who are at least 18 years of age. By accessing or using the platform, users represent and warrant that they are at least 18 years old.
Because MitrHub operates as an unauthenticated guest platform that does not require user accounts, passwords, or identity documents, MitrHub does not conduct technical age verification or collect proof of age at connection time. The platform relies on user warranties and contractual eligibility under our Terms. We do not knowingly solicit or collect personal information from individuals under 18. If we receive credible notice or reasonably identify that a user is under 18, we will take operational steps to sever the session and restrict access.
10. Summary Data Retention Table
Scroll horizontally to inspect full table columns →
Data Category
Storage Location
Purpose & Scope
Retention Duration
Third-Party Access
Text Chat Messages
Volatile server RAM only
Real-time messaging between matched partners
0s in databases. Purged immediately upon session exit or after up to 120s reconnection grace window.
None (Never saved or shared)
Voice & Video Call Streams
Relayed through TURN servers
Real-time 60s communications with peer IP shielding
0s on server. Encrypted stream; never recorded or saved.
Relay infrastructure (in-transit relay only)
1-Hour Block Records
Volatile server RAM (hash)
Prevents rematching with a blocked user during active browsing
Purged after 1 hour or upon server reboot; never written to disk.
0s in application database. Governed by infrastructure provider log retention.
Hosting infrastructure provider
Daily Call Quotas
Database (MongoDB)
Fair-use daily limits (keyed by pseudonymous token hash, no PII)
Auto-expires after 7 days via database TTL index.
None
Client Preferences
Browser localStorage
Theme mode, consent choices, and anonymous quota token
Persistent on local device until cleared by user.
None
Site Analytics (GA4)
Google LLC infrastructure
Aggregate traffic evaluation on public pages (never on /chat)
Up to 2 years under Google settings; strictly consent-gated.
Google LLC
Display Advertising (AdSense)
Google LLC infrastructure
Personalized ads when consented; limited ads with anti-fraud IVT when rejected (never on /chat)
Governed by Google ad policies; consent-gated for personalization.
Google LLC
11. Inquiries, Safety Concerns & Contact Details
If you have questions regarding this Privacy Policy, wish to report an urgent safety concern, or have inquiries regarding our data minimization practices, you can reach out through our official channels:
Instagram Direct Message: Reach our team at @_mitrhub_.
Contact & Support Expectations: Review our Contact Us page for details on support expectations.
Terms of Service: Review community guidelines and user obligations on our Terms and Conditions page.
