Privacy Policy

In one line: we use data to run Potion and don't sell it or run ads. Posts are visible to everyone signed in. Message privacy depends on whether the message was sent using the encrypted messaging version described below.

Potion does not add advertising or analytics tools. External fonts and media services receive data when your browser connects to them; see the third-party section below.

What we collect

When you sign up

• Username and email address. The email is used to verify the account and to send password resets.
• Login credentials. The updated login flow derives a credential from your password in your browser; the server stores a bcrypt hash of that credential. Older accounts may send their existing password once when moving to this flow. Hashing does not make weak passwords immune to guessing.
• Date of birth, submitted to check that you're at least 18.
• The date and time you accepted these terms.

What you choose to add

• Display name, profile picture, bio, country, phone number, Steam username.

All of these are optional and you can clear them from Settings.

What you create in the app

• Messages, including photos and voice notes.
• Posts, comments and likes.
• Your friends list and your blocked list.
• A log entry for each call who called whom and how long it lasted. Not the call itself.

When you contact us or report something

The support form sends your name, email address and message. In-app reports send the account or content being reported, the reason and any details you enter. We use these to respond to requests and investigate reports. Include only information needed to explain the issue.

Technical

• Online status and last activity, so friends can see when you're around.
• Standard server logs at our host, which may include IP addresses, for debugging and abuse handling.
• For encrypted messaging, public identity keys and an encrypted backup of your messaging identity. Your browser also stores keys locally, as explained in the Cookie Policy.

Two things worth being clear about

Encrypted messaging applies to messages sent through the updated service. In that version, new message text, edits, shared-post references, captions, voice notes and attachments are encrypted in your browser before upload. The server stores encrypted content. This requires the updated app and server; this policy alone does not confirm that the update is active.

Older messages and uploads are not retroactively encrypted. Content sent through the older service can be readable by the server operator. Public posts, call records, reactions, read receipts, participants, timestamps and sizes are outside message encryption. Live call media is separate from this messaging feature.

Encrypted messaging does not protect against someone accessing your unlocked device or compromising your browser. If a messaging identity is compromised, earlier conversations may also be exposed. Signing in can restore an identity that has been backed up. After a password reset, you may need an original device; if no device retains the identity and the old password is unavailable, old encrypted messages may be unrecoverable.

Calls connect your device directly to the other person's. That's how voice, video and screen sharing stay fast. It also means the two devices exchange IP addresses to find each other, so the person you're on a call with can potentially learn your approximate location from it. If the direct connection fails, the call falls back to a relay server run by a third party. Only accept calls from people you're comfortable with you can only be called by friends, which is why.

Who else touches your data

These services help run Potion or provide content you open. External services have their own privacy practices; loading their resources shares connection information such as your IP address.

• Render runs the server.
• Supabase the database and the file storage where pictures and voice notes live.
• Resend sends the verification and password reset emails.
• Netlify serves the website itself.
• Google Fonts the site's typeface loads from Google's servers, which means Google sees your IP address when a page loads.
• YouTube provides link thumbnails and the player used for shared videos.
• Spotify provides the player used for shared music and other Spotify media.
• Google STUN helps devices establish call connections.
• Metered the relay used when a call can't connect directly.

Country flags are served with the website. Embedded media services may use cookies or similar storage under their own policies. See our Cookie Policy for more detail.

What's public and what isn't

• Posts and comments are visible to everyone signed in to Potion. The Friends tab filters the feed down to people you're friends with, but that's a filter, not a privacy setting. Treat every post as public.
• Direct messages are shown to the conversation participants rather than the public feed. The encryption limits above still apply, and recipients can save or share copies.
• Your profile name, picture, bio, country, Steam link is visible to anyone signed in to Potion. Your name, tag and picture already appear on every post you make, so treat the rest of the profile the same way. Blocking someone hides it from them.
• Your profile picture sits at a public URL. Anyone with the exact link can open it without signing in.

Deleting things

You can delete messages and posts in the app and request account deletion from Settings. Removing content from view should not be treated as confirmation that every associated file, log or backup has been erased. Contact support if you need a specific uploaded file removed.

Deletion cannot remove copies other people have saved. Older unencrypted uploads and public images may remain accessible to someone with their URL while the stored file exists. New encrypted message attachments require the corresponding decryption key to read.

How long we keep things

We store account data and content to provide the service, and support messages and reports to handle requests and abuse. Retention can differ for active content, uploaded files, logs and backups; we do not promise one deletion deadline for all of them. Contact support for details about specific data. Verification and password reset links have limited validity; request a new link if one has expired.

Your choices

• Edit or clear any profile field from Settings.
• Turn read receipts off so people can't see when you've read a message.
• Go invisible so friends can't see you're online.
• Block someone to cut off messages, calls, and each other's posts.
• Request account deletion from Settings using a confirmation code sent to your email.
• Ask us for a copy of your data, or ask us to delete something specific, through the support form.

Security

Traffic runs over HTTPS. Login credentials are protected as described above. Sessions use tokens; you may need to sign in again when a token expires or is invalidated. Message encryption adds protection within the limits explained above. No service can promise it won't be breached.

Under-18s

Potion is not for people under 18. If we find out an account belongs to someone younger, we delete it. If you think a minor has an account here, tell us through the support form.

Changes

We'll update the date at the top of this page whenever this changes, and say something in the app if it's significant.