Privacy notice
Last updated 11 November 2026. Tavero is run by newfrontsites, who is responsible for the data described here under Thailand's Personal Data Protection Act (PDPA).
What “anonymous” means here
- Anonymous to other people. Others see only a random name, a generated avatar and your voice. They never see an account, email, phone number, IP address or any identifier that links you across rooms.
- Not invisible to the platform. To run rooms, enforce bans and handle reports, the service knows which guest session joined which room for a limited time (see retention below). Your internet provider and the voice infrastructure provider can also see network-level information such as your IP address while you're connected.
- Your voice is still your voice. Voice effects make you harder to recognise but don't guarantee it. Don't share details that identify you or others.
What we store
- A random guest id in an httpOnly cookie on your device, signed so it can't be forged.
- A guest profile: the random display name and avatar seed, and when it was last used.
- Rooms: topic, description, category, settings, timestamps and status.
- Room membership: role (host, speaker, listener), mute state, voice effect name, join/leave timestamps.
- Speaking requests, removals (room bans), your blocks, and reports you send.
- Device preferences (voice effect, volume) in your browser's local storage only.
- Abuse limits: a keyed hash of your network address (never the address itself) with a count of recent actions, so one network can't create unlimited guests, rooms or voice sessions. These counts are deleted after a day.
- Bot check: before you start a room or turn on voice, Cloudflare Turnstile may check that you're a person. Cloudflare processes your browser and network information to do this, under its own privacy policy. We keep only a signed cookie saying the check passed, for 12 hours.
Payments
- Room Boosts are paid through Stripe Checkout. Stripe collects your email address and payment details and processes them under its own privacy policy, including for fraud prevention and receipts.
- We keep only the payment id, amount, currency, which boost was bought and whether it was refunded, without your guest id or the room. The room keeps its boost times until it is deleted. We never see your card number, and nobody in the room sees who paid.
- Payment records are kept as long as accounting and tax law requires.
Usage statistics
- We count, per day, how many guest sessions opened the app and joined rooms, how many rooms were started in each category, voice minutes, the most people online at once and boosts bought. These are totals only.
- We also count single words used in room topics, to understand what people talk about. Full topics are not kept for this, and a word is only kept if it appeared in at least 3 different rooms that day.
- These statistics can't identify you and are deleted after about 13 months.
Who processes data for us
- Vercel (hosting), Supabase (database), LiveKit (live audio relay), Cloudflare (bot check) and Stripe (payments).
- Some of them store or process data outside Thailand, under their own data protection commitments.
- We don't sell personal data and don't use advertising or tracking cookies.
What we never do
- We do not record, store or transcribe audio. Audio is relayed live and is gone when it's spoken.
- We do not ask for an account, phone number or social login. Only Stripe asks for an email, and only if you buy a boost.
- We do not show IP addresses or internal ids to other participants.
- We do not keep a public archive of conversations.
Retention
- Rooms close automatically when they become inactive or the host leaves.
- Closed rooms and their membership, requests and bans are deleted 24 hours after closing.
- Guest profiles unused for 30 days are deleted.
- Reports are kept for moderation with a snapshot of the room topic; links to deleted rooms are removed.
Your controls
- Generate a new name and avatar at any time from My activity.
- “Forget me on this device” starts a brand-new guest session.
- Clearing this site's cookies has the same effect.
Your rights
- Under the PDPA you can ask to access, correct, delete or move your data, object to or restrict how we use it, and withdraw consent. Contact chutipong@newfrontsites.com. We answer within 30 days.
- Because Tavero has no accounts, we may only be able to find your data if you tell us your guest name or give details of your payment.
- You can also complain to the Office of the Personal Data Protection Committee (PDPC) of Thailand.
- See also the terms of service.