Privacy
Youtopia is a place to watch something with two other people. It needs almost nothing about you to do that, so it asks for almost nothing.
The short version
- Conversations are never recorded. Voice is not captured, not stored, and never reaches our servers at all.
- There is no account. No name, no email, no password.
- Chat exists while the party does, and goes with it.
- No advertising, no third-party analytics, no trackers. Nothing is sold or shared.
Voice
Voice runs over WebRTC, directly between the browsers in the party. Everyone connects to everyone, so audio goes from your device to theirs without passing through us — there is no server in the middle to record from, and we have written nothing that would record it if there were.
That audio is encrypted end to end. WebRTC has no unencrypted mode: every stream is DTLS-SRTP, and the keys are agreed between the two browsers themselves. We never hold them.
The honest limit of that claim: our server passes the setup messages the two browsers use to find each other, and those messages carry the fingerprints that pin the encryption. There is no code for you to read aloud to verify a call independently, so the server is trusted not to tamper with a handshake in progress. It is the same trust every browser-based call asks for. What it is not is access to the audio, which we do not have and cannot obtain after the fact.
One consequence of a direct connection: the people in your party can see your IP address, as you can see theirs. That is how a direct connection is made. Only join parties with people you know.
Chat and reactions
Chat is not end to end encrypted, and we would rather say so than imply otherwise. Messages travel over an encrypted connection (TLS) to the room and back out to everyone in it, which means the room can read them in passing — it checks their length and how fast they arrive, so one person cannot flood the others.
A room keeps the last 60 messages so someone who joins late can see what was just said. That is all it keeps, it lives only in that room, and it is erased when the room ends — when the last person leaves, or six hours after it was created, whichever comes first. Nothing is written to a database, and there is no transcript anywhere afterwards.
Tapped emoji are passed along and never stored.
What we keep
- An anonymous identity. Your browser holds a random token; we store only its hash, alongside which platform it is (web or extension), an install identifier, the client version, and the browser family. It is there to enforce limits like how many parties one person can open at once. It is not linked to anything about you, because there is nothing to link.
- A record of rooms. The code, how many seats it had, when it opened and closed, and the most people in it at once. Kept indefinitely — it is about rooms, not people.
- Joins and leaves. Which device entered which room, and when. This is the only record that puts a person next to a room, so it is the one with a clock on it: rows are deleted automatically after 10 days.
What we never collect
Your name, your email, your YouTube account, your watch history, your contacts, your location. There is no field to enter any of it and no code that asks. We do not knowingly collect personal information from anyone, of any age.
What stays in your browser
Your identity token, the position you dragged the party bubble to, and your settings live in your browser’s local storage and are never sent anywhere except the token, which authenticates you. Clearing this site’s data discards them and you become a new anonymous person the next time; what is left behind on our side is a hash with no way back to you.
The video itself
The player is a YouTube embed, served from youtube-nocookie.com, which is YouTube’s reduced-tracking domain. It still means YouTube receives the request for the video and applies its own privacy policy to it. We do not tell YouTube anything about your party, and we do not receive anything about what you watch beyond the video ID you paste in.
Abuse limits
Our host, Cloudflare, sees the IP address of requests and we use it to limit how many identities can be created from one place. It is used at the moment of the request and not stored in our database.
Changes
If this policy changes in a way that affects what we keep, the date below changes with it.
Removing yourself
There is nothing to delete an account from, because there is no account. Clearing this site’s data — or removing the extension — discards the token, and with it the only thing that connects your browser to anything we hold. Parties end on their own and take their chat with them.
Last updated 27 August 2026.