Kibitz

Privacy Policy

Effective June 8, 2026

Kibitz is built to need as little of your data as possible: no accounts, no sign-ups, and no server in the path of your call. This policy explains exactly what that means.

The short version

• No accounts. No name or email required to make a call.
• Your audio, video, and chat are peer-to-peer and end-to-end encrypted. We never see, hear, store, or record them.
• No analytics, no advertising, no tracking cookies — so there is no cookie banner, because there is nothing to consent to.
• Our servers only ever handle the minimum needed to introduce two browsers to each other.

What stays on your device

Your display name, avatar, and preferences are saved in your browser's local storage. They never leave your device and are never sent to us.

What our servers briefly handle

To connect two browsers we use a signaling step and, when a direct connection isn't possible, a relay:

• Signaling. To introduce two browsers, a signaling server momentarily exchanges connection setup data — a temporary random peer ID, the room name contained in your link, and network "ICE candidates" (which include IP addresses). It is used in the moment to establish the connection and is not stored.
• TURN relay. If your networks can't connect directly, your already-encrypted media is relayed through a TURN server so the call still works. The relay forwards encrypted packets and cannot decrypt them; it processes IP addresses and traffic volume only to route the call.
• Hosting. The kibitz.chat website is served by Cloudflare, which may keep standard server logs (such as IP address, timestamp, and browser type) under its own policy.

We do not record calls, build profiles of you, sell data, or serve ads.

A note on IP addresses

Peer-to-peer calls work by browsers connecting directly, so participants' browsers can see one another's IP addresses. This is inherent to WebRTC, not specific to Kibitz. When a call is relayed (TURN), peers see the relay's address instead of each other's.

Service providers

On kibitz.chat we use Cloudflare for website hosting, DNS, signaling, and the TURN relay. Cloudflare processes the limited connection data above on our behalf. On this site we use no other third-party processors, analytics, or advertising networks.

Self-hosting note. Kibitz is open source. If you run the build on a host that does not provide its own signaling and TURN endpoints (/api/signal and /api/turn), it falls back to public infrastructure to connect calls — PeerJS's public signaling broker and Google's public STUN server (and PeerJS's default public TURN). Like any signaling/STUN/TURN service, these see only connection metadata (IP addresses and network "ICE candidates"); they never receive your call's audio, video, or messages, which stay end-to-end encrypted. kibitz.chat provides its own endpoints, so it does not use these; if you self-host, point those endpoints at infrastructure you control — or disclose this — for your users.

Children

Kibitz is not directed to children under 13, and we do not knowingly collect information from them — indeed we do not knowingly collect identifiable information from anyone.

Changes

We may update this policy; the effective date above will change, and significant changes will be noted here.

Who operates Kibitz & contact

Kibitz is operated by the Kibitz project. Questions about privacy: [email protected].