3dchat.space
Start a room

Privacy Policy

Last updated: 15 October 2026

3dchat.space lets you meet friends in a shared 3D room, as an avatar, right in your browser. This page explains what information the service handles and why. The short version: there are no ads, no analytics and no trackers, we only store your profile, avatar and worlds if you save them, and your chat goes straight from your browser to the other people in your room.

Signing in

You can sign in with Google or GitHub, or join as a guest where the server allows it. When you sign in, we receive from your Google or GitHub account:

We use these only to show who you are to the people in your room. We never post anything to your account and we do not ask for access to your files, contacts or repositories. Your name, picture and account ID are kept in a signed cookie on your own device for up to 30 days, which signing out deletes. When you save an avatar or your profile, we also keep your name, picture, account ID, avatar choice and, if you set them, your display name and username in our database, so they follow you to any device. Your display name is shown to the people in your room, and your username lets friends find you.

Avatars

If you're signed in, your avatar choice is saved on our server. If you upload your own avatar file (a .vrm model, for example from VRoid Studio), we store it on our server or in our file storage at Cloudflare (R2), and anyone in a room with you downloads it to show your avatar. We keep only your latest upload: uploading a new one deletes the previous file, and deleting your account deletes it too. Guests' avatar choices stay in their own browser.

Library avatars and their pictures are downloaded by your browser straight from Arweave, the permanent storage where the Open Source Avatars project keeps them, so Arweave sees your IP address when they load, as any website you visit does. We don't send it anything else.

Worlds

If you build a world and save it, we store it on our server: its name, description, layout, a small picture of it, and that it's yours. A private world is shown only to you, and to the people in a room you open in it. A public world is listed on our Worlds page with your display name, and anyone can open rooms in it or make their own copy. You can make a world private again or delete it at any time; deleting your account deletes your worlds. Unsaved drafts stay in your own browser.

AI agents in the builder

In the world builder you can build together with an AI agent. If you connect your own agent (such as Claude or ChatGPT) with your builder's private link, the messages you type in the builder chat and the world you are building, including pictures of it, go through our server to that agent, and that agent's provider handles them under its own privacy policy. If you use the built-in assistant, your messages, the world and pictures of it are sent through our server to Anthropic, which uses them to write the assistant's replies. We don't store builder chats: they pass through our server's memory and are forgotten when you start a new chat or the link expires. A builder link stops working when you make a new one (New link in the builder's connect dialog). After you close the builder tab it stops working within 15 minutes, but works again if that same tab is reopened or restored; make a new link to cut an agent off for good.

Face tracking

Face tracking is off unless you turn it on. When it's on, your camera image is processed entirely on your own device, and face tracking never sends it to us or to anyone else. Only a few numbers describing your expression and head angle (for example, how much you're smiling) are sent directly to the people in your room, so your avatar can mirror you. We don't record or store them.

Showing your camera in a room is a separate switch, and face tracking stays on your device either way. If you choose to show your camera, its picture goes directly to the people in your room, encrypted end to end; when a direct connection isn't possible, our relay (TURN) server passes it on without being able to see it (see "Rooms, chat and movement" below).

Google user data

3dchat.space only asks Google for your basic profile (name, email address and picture). We use it only to sign you in and show your name and picture to the people in your room. We don't use it for advertising, we don't sell or transfer it to anyone, and no person reads it. 3dchat.space's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Cookies

We do not use advertising, analytics or third-party tracking cookies.

Rooms, chat and movement

When you join a room, our server only introduces your browser to the others in it. After that, chat messages and avatar movement travel directly between browsers over encrypted WebRTC connections. When a direct connection isn't possible, the encrypted traffic is passed on by our relay (TURN) server, which cannot read it. We do not record or store chat messages or movement.

Your microphone is off unless you turn it on. When it's on, your voice goes the same way, directly and encrypted to the people in your room (or through our relay when needed, which cannot listen). We never hear, record or store it. Turning it off stops your microphone.

Your camera is off unless you turn it on. When it's on, the people in your room see your camera picture in your face tile instead of your avatar. It goes the same way as your voice: directly between browsers, encrypted end to end by WebRTC. When a direct connection isn't possible, it is relayed through our TURN server, which passes the encrypted video along without being able to see it. We never see, record or store it. Turning it off stops sending it, and stops your camera unless face tracking is still using it on your device.

Sharing your screen, a window, a browser tab or a tab's sound is off unless you start it, and your browser asks you what to share each time. What you share goes the same way as your camera: directly to the people in your room, encrypted end to end (or through our relay when needed, which cannot see or hear it). We never see, record or store it. Stopping it, or leaving the room, ends it.

Anyone in a room can start a YouTube video for everyone to watch together. Only then does your browser load YouTube's player, from YouTube (in its privacy-enhanced mode, youtube-nocookie.com), so YouTube receives your IP address and what browsers usually send, under Google's privacy policy. Nothing is loaded from YouTube before someone starts a video. Which video it is, and where it is playing, go only to the people in your room.

Because browsers connect directly, the other people in your room can see your IP address, as with most voice and video calling apps.

Room passwords are kept only as one-way hashes in the server's memory and are forgotten when everyone leaves the room.

Server logs

To keep the service running and stop abuse, the server keeps short-lived technical logs. These can include your IP address, the pages you load, the room name, your display name, when you joined and left, and failed password attempts. IP addresses are also held in memory for a short time to limit how often someone can try to join. Logs are kept only as long as needed to run and protect the service.

Who we share information with

We do not sell or share your information. Google or GitHub process your sign-in under their own privacy policies. Cloudflare carries the site's traffic and stores uploaded avatar files for us. Anthropic processes your builder chat and pictures of your world when you use the built-in assistant, and an AI agent you connect yourself receives them from us. YouTube plays a video someone in your room starts to watch together. Your name, picture and IP address are visible to the other people in a room you join.

Children

3dchat.space is not meant for children under 13, and we do not knowingly collect information from them.

Your choices

You can join as a guest where allowed, sign out at any time, or remove 3dchat.space's access from your Google account or GitHub settings. To delete your saved avatar, worlds, display name, username and account record, use "Delete my account" on your profile page, or email us and we'll remove them. If you have a question or request, email [email protected].

Changes

If this policy changes, we will update this page and the date at the top.