Security at VirtuaChat

• Your conversations, uploaded files and memories are encrypted at rest.
• Our admin tools are built so that staff can't read your messages, prompts, generated content or files — we only see totals such as message counts and credit usage.
• We never sell your conversations or use them for advertising.
• You can delete any chat, file, image or audio clip — or your whole account — at any time.

• All traffic between your device and VirtuaChat uses HTTPS (TLS), with HSTS so browsers always connect securely.
• Content and secrets are encrypted at rest with strong, modern encryption.
• API keys and provider credentials are encrypted and never exposed to the browser.

• Passwords are stored only as strong one-way hashes — no one, including us, can read them.
• New accounts confirm their email with a 6-digit code, and password resets use single-use, time-limited links.
• Sign-in attempts are rate limited to block password guessing.
• You can see every device signed in to your account and sign out any device — or all of them — in Settings → Security.
• Changing your password signs out your other devices and we email you about it.
• You can sign in with Google instead of a password.

Payments are handled by Stripe and PayPal, both certified to the highest level of the PCI-DSS standard. Card details go straight to them — we never see or store your full card number. Plans and credits are stored with tamper-evident seals so they can't be altered outside our billing system.

• Every request is validated, and every piece of content is checked for ownership before it's shown — you can only ever see your own chats and files.
• Rate limits, abuse detection and anti-fraud checks protect against spam, scraping and credit farming.
• Strict security headers, including a Content Security Policy, help block cross-site scripting and clickjacking.
• Requests that change data are protected against cross-site request forgery.
• Administrator accounts require two-step verification, and admin actions are logged.

We send prompts only to the AI provider needed to answer them — DeepSeek, OpenAI or Google — over encrypted connections, under their API data-processing terms. Their API services don't use your data for advertising.

We monitor the service around the clock, keep regular backups and can restore data if something goes wrong. Deleted data is removed from backups within 30 days.

• Use a strong, unique password — or sign in with Google.
• Review your signed-in devices from time to time.
• Don't share your account.
• Be wary of emails pretending to be from us — we'll never ask for your password or full card number.

Found a security issue? We'd love to hear from you. Email support@virtuachat.com with "Security" in the subject and as much detail as you can. Please give us reasonable time to fix the issue before sharing it publicly, and don't access other people's data, degrade the service or use social engineering while testing. We don't take legal action against good-faith research that follows these rules, and we'll gladly credit you.