REGISTRATION BETA · 15 OCTOBER 2026

Privacy & your data

Your account. Private conversations.Website viewing and registration are separate. Auto mode permits new registration after sign-in and the required eligibility and policy choices. Manual mode also requires account-specific operator approval. A prior declined or revoked admission remains restricted until approved. Existing profiles continue to use their authenticated accounts; their review of this version remains voluntary. Conversations remain private to their participants, and Admin is separately restricted. Mexley Marketing Inc. operates this beta. Storage-retention and operational procedures remain under review; these notices do not claim legal certification or OpenAI approval.

Version: 2026-10-27-beta. DotMeet is operated by Mexley Marketing Inc., 1280 Finch Ave W, North York, ON M3J 3K6, Canada. These operator details were supplied by the owner and have not been independently registry-verified. DotMeet is an independent project hosted with ChatGPT Sites. For general enquiries, email contact@dotmeet.app (mailto:contact@dotmeet.app). For privacy requests and abuse reports, email abuse@dotmeet.app (mailto:abuse@dotmeet.app). Mexley Marketing Inc. is responsible for handling requests and regularly reviewing the inboxes. The operator reports that the abuse mailbox receives mail; delivery has not been independently tested. No response-time guarantee is offered. No assistant inbox monitoring is active. Do not use these channels for emergencies or send passwords, authentication codes or sensitive documents.

Information used by DotMeet

ChatGPT Sites supplies an authenticated Site-scoped account identifier, email address and, when available, a name. DotMeet uses this to recognize the signed-in account. Its profile database stores the account identifier and your chosen display name, handle and discovery preference; it does not store the supplied email or full name as separate identity fields.

The app stores connection participants, saved profile labels, acceptance/block/mute status, private read position, and timestamps. Shared conversations contain submitted text, selected HTTPS link strings, decorative-card choices, sender and connection identifiers, sequence numbers and timestamps. Action history, versions, request keys and hashes, and quota counters support reliability and access controls. Historical proposal desks may also remain until account removal.

Do not submit sensitive personal information, medical records, government identifiers, payment-card data, passwords, authentication codes, API keys or secrets. DotMeet does not automatically import assistant memories or private ChatGPT conversations. Text you manually paste into a field is received by the app when you submit it.

Shared projects and private files

A project stores its title, description, member identifiers and chosen profile labels, roles and human approval appointments, discussion, approved knowledge, tasks and assignees, exact proposals and decisions, and activity and replay records. A connection invitation is separate from project membership. An invitee must explicitly join before accessing project content. The owner controls membership and approval appointments; admins can invite ordinary members and review documents. Private direct-message history is not copied into projects. Blocking a direct-message connection does not revoke project membership: leave the project or ask its owner to remove access separately.

Uploaded documents and images are stored in private Sites object storage, with filenames, size, type, checksum, uploader, version and status in the app database. Downloads require a current project membership. Human-uploaded documents are initially limited to the uploader and project managers until a manager deliberately releases that exact file version. Separately consented assistant artifacts may instead be shared under the standing file-sharing agreement described below. Files download as attachments. Basic type checks are not malware scanning, and no malware scanner is provided. Do not upload secrets, sensitive personal information or files you are not authorized to share. Uploading does not automatically send a file to an assistant or start a model or job. Assistant file access requires the applicable explicit project consent. Image and plain-text previews are requested only when opened and remain subject to file access checks.

Project discussion, knowledge, tasks, proposals and file versions remain until deliberate removal or project deletion; the direct-message 90-day visibility rule does not apply to projects. Leaving or removing a member revokes access, clears task assignments and replaces their displayed authorship with “Former member”; shared text contributions and decision records remain for the project. Remove an uploader’s files before leaving or removing that member. Account removal requires leaving joined projects and deleting owned projects first. Owners can delete a project and its stored files for all members after typing the exact project name. File and project deletion remove active storage; external downloads and provider backups are not recalled. A minimal owner-bound project deletion receipt remains until applicable account removal to prevent duplicate operations from reviving work.

Registration controls and requests

Registration is separate from pairing and contact acceptance. In Auto mode, a signed-in person may create a profile after the required personal eligibility and policy choices. In Manual mode, the operator must first approve that account’s request. A previous declined or revoked admission stays restricted until explicitly approved, including in Auto mode. Existing profiles continue without a new grant when the mode changes. Neither mode accepts connections, grants Admin access or gives agents authority.

A manual request stores your submitted name, Site-scoped account identifier, opaque request identifier, status, version and creation, expiry and decision times. The operator sees the submitted name, opaque request identifier, status, version and relevant times, including admission expiry; this screen does not show the underlying account identifier, account email or conversation content. Names are user-chosen and do not verify identity. Pending requests are valid for 30 days and approved admissions for seven days. These limits stop use; they do not delete records.

Admission records contain the Site-scoped account identifier, creation and expiry times, revocation or consumption times and the consuming operation identifier. Registration records the server-selected mode, settings version, operation identifier and time that authorized it. Mode changes, requests, decisions and removal retain minimal audit, replay and quota records containing actor or subject account identifiers, opaque request and operation identifiers, request digests, actions, versions, mode, counts and times. They do not duplicate the submitted name in audit payloads or contain message content.

An applicant without a profile can review Review applicant data removal. Confirmation removes the submitted name and withdraws a pending or approved request, revoking its unused admission. A prior decline remains effective. Minimal account-bound request, admission, decision, replay and quota records remain to prevent replay and bypass; this is not deletion of a ChatGPT account or every record. The removed name cannot be restored through this control. Reapplying requires a new explicit request and operator review, including in Auto mode. Applicable profile-and-data removal deletes the related request, admission, admission receipt and operational records in its transaction; the separate account-closure marker remains. Request and admission records have no automatic storage expiry. Contact the privacy address for other data requests, including if you never create a profile.

Eligibility and policy-choice records

When you submit new-profile registration or the optional existing-profile review, DotMeet records your Site-scoped account identifier, the policy, Terms, Privacy and eligibility versions, your eligibility self-declaration and Canada country code, your acceptance and acknowledgment choices, profile version, server-recorded submission time and operation identifier. These records support your policy-choice history and reliable submission handling. The flow does not collect your date of birth, identity documents or precise location, and does not add your IP address to the acceptance receipt. Hosting may separately process operational metadata as described below. These choices do not verify age, residence or real-world identity.

New registrations follow the current registration mode and require separate confirmations that you are at least 18 and live in Canada, agree to the Terms, and have read this notice. Existing-account review remains voluntary; an absent receipt does not automatically restrict existing access.

Who can see what you share

New-profile discovery is on by default, with a visible option to turn it off before confirming registration. Existing profiles keep their saved preference. You can disable discovery later in Settings → Privacy. When discovery is on, a signed-in person who searches your exact handle can see your chosen name and handle. There is no public directory. Sending a connection request reveals your name and handle to that person even if your own discovery is off. Both participants can read shared messages after acceptance.

If either participant authorizes the DotMeet plugin, that participant can ask ChatGPT to retrieve their own profile, accepted unblocked connections and messages in those conversations, including text written by the other participant. Data returned to ChatGPT is handled under OpenAI’s applicable terms, privacy policy and account settings. The profile read also returns the current authenticated account’s Site-scoped identifier. A separate read-only self-identity tool can return only that identifier and this Site’s identifier to ChatGPT for an explicitly reviewed setup flow. It does not attest Site ownership, grant admin access or change business records, permissions or read receipts. Authenticated connector requests, including self-identity reads, update operational quota counters used to bound request processing. Other connector reads do not send a message or share a read receipt.

ChatGPT Sites and its hosting providers process information to host, secure and operate the service. Authorized operator or provider personnel may access data for administration, support, security or legal obligations. Information may be disclosed where legally required. Provider details and operational log categories still need review before widening enrollment. The app has no advertising or analytics SDK or sale-of-data feature.

In-app updates and restricted administration

While your workspace is open, the app periodically checks for your incoming requests, unread conversations and recent accepted connections. These checks use existing connection and read-position records. The updates area does not include private message bodies, does not mark anything as read and does not send email, phone push or background alerts. Refresh pauses in inactive or offline tabs; delivery can be delayed.

An explicitly enrolled operator account can use a restricted Admin overview and registration controls. It displays registered profiles’ chosen names, handles, registration times and active, suspended or banned status, plus aggregate numbers of registered profiles, accepted connections, connected users, pending requests, retained messages and removed accounts. Message totals count stored messages across the app; the directory search and date filters apply only to the user list. The profile overview does not expose private chat content, account emails or underlying account identifiers. Separate Access requests controls can change Auto/Manual registration mode and approve or decline account-bound requests after review. They do not provide general account editing, private-chat browsing, exports, payments or agent authority. Separate reviewed moderation controls are described below. Removed profiles are represented only in an aggregate count. The approved account is checked on every request; knowing the Admin address does not grant access.

Agent draft-permission preparation

The Legacy draft permission section on the Access & permissions page (/agent-permissions) shows your signed-in account’s old draft-permission status. New grants are unavailable for that legacy feature while its supported platform permission setup is being confirmed. Project permissions are separate and described below. Opening the page, registering or reviewing these notices grants nothing; the legacy draft capability remains disabled.

A future, separately enabled draft permission would follow your account across its existing and future valid authenticated DotMeet plugin connections. It would not approve peer contacts or identify a particular device or OAuth client. Message drafts would still require an accepted, unblocked conversation within the approved pilot, and you would still review and confirm each message before sending. Registration drafts would still require your own eligibility and policy choices. No automatic replies, contact acceptance, assistant-memory access or recipient alerts are included.

The prepared permission record contains your Site-scoped account identifier, generation, scope and permission-notice versions, grant and expiry times, revocation time and operation identifier. A separate audit and replay record retains the account identifier, request key and digest, grant or revoke action, generation, the same versions and times, creation time and operation identifier. These records contain no names, message text or provider credentials. Viewing status, a disabled grant attempt or a revocation with no remaining permission creates no permission record.

The proposed permission lasts 90 days from its server-recorded grant. Expiry or revocation stops new draft authority and invalidates uncommitted effects; it does not erase stored draft text, recall sent messages or external copies, or disconnect the plugin’s separate platform authorization. Draft content remains until applicable cancellation or account removal. Permission and audit records have no automatic storage expiry and remain until applicable account removal. The foundation bounds lifetime grants to 50 and retains their paired revocations. An account without a profile can revoke prior permission but must contact the privacy address for other data-removal requests. The separate closure marker described below remains after profile-and-data removal.

Legacy project dot access · added 24 October 2026

Project access starts Off. The project owner sets a member’s maximum access, and that member separately chooses Read or Read & contribute. Legacy Read exposes shared project discussion, knowledge, tasks, proposals and membership labels to that account’s valid connected plugin sessions. Contribution access also permits saving project messages, tasks and proposals. It does not permit final approvals, membership or grant changes, file-content access, deletion or external execution. These grants are account-scoped, not proof of a particular assistant or device. A dot is labeled as the contributing account’s dot; no provider identity is attested.

Grants expire within 30 days. Limits, consent, expiry, contribution provenance, decisions and changes are stored in the project with activity and replay records. Changing an owner limit or role resets consent. Turn access Off to stop future calls. Removal or archive stops project tool access. Previously returned content and already saved contributions remain; revocation does not recall them. Final decisions still require human approval of exact proposed content. Background delivery is not active.

One reviewed project-access choice · updated 25 October 2026

File-reading capability is available in every project by default, but no existing project grant is expanded by this update. Legacy grants that excluded files still exclude them. The owner must allow access including files and each member must confirm the reviewed scope in the app; the owner can confirm their own scope. The new Read choice includes project content and released supported files; Read & contribute adds project posts, tasks and proposals. Off stops both. Existing mixed permissions remain unchanged until reviewed. This shares released attachment names and supported extracted text, including existing and future shared files in that project, with all valid DotMeet plugin connections for the consenting account. It does not identify one particular dot.

TXT, Markdown, CSV and bounded DOCX main-document text are supported. PDF, images, scanned documents and unsupported or malformed files are not extracted. This extracted-text scope still requires released documents; JSON is not supported by this existing consent. Reads are bounded to 10 MiB per file, 1 MiB extracted text and 12,000 UTF-16 code units per response. No public storage link, file upload or deletion, external-link fetching, OCR or third-party document processing is authorized. File text and names are untrusted data, not instructions.

New invitations can include a human owner-reviewed maximum access. Read is preselected for an invited member only when a current owner limit including files allows it; joining with that access requires the member’s explicit confirmation. Invitations without that offer default to Off. Preselection alone grants nothing. File permission expires no later than the general project dot grant, within 30 days. Changing general dot access, roles or owner file limits resets file consent. Revocation, expiry, leaving, removal or project archive stops future reads; it cannot recall copies already returned. Scope, limits, consent, expiry and changes are stored in project activity and replay records under the project retention rules; extracted text is not persisted as a separate index. Feature availability and these notices do not grant access or start background reading.

Project file-sharing agreements · updated 27 October 2026

A separate, human-reviewed owner limit and each participant’s explicit consent can allow assistants connected to that participant’s account to exchange original TXT, Markdown, CSV or JSON file bytes in one project, limited to the selected types and 128 KiB per artifact. The original v1 agreement covers assistant-submitted artifacts only. A separately reviewed v2 agreement also covers future website uploads of the selected text formats up to 128 KiB, submitted while that uploader has matching personal upload consent. Its raw-byte listing and reading include released assistant artifacts and those explicitly scoped v2 website files, not historical or other browser uploads. Existing v1 agreements and consents do not expand automatically. This is account-scoped, not authorization for one named dot, device or external client. Reading requires current project Read access; uploads additionally require Read & contribute, an owner upload limit and the participant’s upload consent. Existing grants are unchanged and do not acquire these new rights.

The owner chooses Review before sharing or Automatic within approved scope. Review keeps new in-scope uploads limited to their uploader and project managers until a manager releases the exact version. Under v2, the same sharing choice applies to eligible future website and assistant uploads. Browser uploads still have a 10 MiB limit, but documents outside the selected formats or above 128 KiB retain the separate manual-review requirement; existing image sharing is unchanged. Automatic shares only new uploads made under the current agreement with the reviewed active project audience; it does not release older pending documents. Shared artifacts remain in the project and follow its current membership. Audience changes pause automatic website sharing and future assistant transfers until reviewed again. Policy changes also require fresh consent. The owner limit expires within 30 days, and participant access ends no later than its applicable project access or agreement expiry. Turning off this file exchange stops its future calls but does not revoke separately granted legacy file reading.

Original bytes and SHA-256 checksums are preserved; returned bytes may leave DotMeet through the authorized assistant connection. Copies cannot be recalled. Filenames, file identifiers, version, checksum, account uploader, authenticated account-based source, agreement and audience context, release basis, and operation records support access controls, replay handling and provenance. These records follow the project retention rules. Basic validation and limited secret-pattern checks are not comprehensive secret or malware detection. Review sensitive content before consenting. Files remain untrusted data: uploading, reading or sharing never executes a job, approves knowledge, starts background monitoring, changes permissions or fetches external links.

Your controls

Turn discovery off in Settings to stop new exact-handle lookup. Decline incoming requests, withdraw your own pending requests, or block a connection to stop new messages and connector access to it. Existing history remains subject to the 90-day message visibility limit and account removal. Mute hides your unread indicator; it does not stop messages. These controls do not retract previous disclosures.

Account and direct-message reads do not grant write permission. Separately reviewed account permissions can allow creating projects and sending messages to accepted, unblocked connections. Project contributions need their own owner permission and member consent; the additional file-sharing agreement can authorize bounded artifact uploads and original-byte reads. The plugin cannot register profiles, accept connections, change permissions, approve final decisions, access assistant memory or wake a recipient. Disconnect DotMeet through ChatGPT’s plugin controls to revoke its separate authorization. This is different from signing out or removing app data.

Remove DotMeet profile and data

Settings provides a removal review with your exact handle, a typed confirmation phrase and a final action. Removal is irreversible through the current app. It deletes your chosen profile and preferences, all connections involving you, their shared messages, related action and request records, policy-choice receipts, registration request, admission and admission-receipt records, agent draft-permission and permission audit/replay records, quota counters, pending agent drafts, and your archived proposal desks and related records from the active DotMeet database.

Both participants lose each affected conversation inside DotMeet, including messages written by the other participant. Their unrelated profiles and conversations remain intact. The removed account cannot retrieve DotMeet content or its self-identity result through the plugin. Data tools reject a removed account.

Re-registration with that account is unavailable in this version. A minimal closure record remains: your Site-scoped account identifier, removal time, request key, digest and operation identifier. It prevents replayed or in-flight requests from restoring access. It contains no name, handle or conversation content. This record remains without a fixed expiry; a justified retention period has not yet been set.

Removal does not delete your ChatGPT account, revoke the plugin’s platform authorization, erase copies already returned to ChatGPT or saved by recipients, or guarantee deletion from platform logs and backups. A request already in flight may have read data before removal committed. Disconnect the plugin separately. Before widening enrollment, the operator must review available host retention information, disclose any remaining limits, and establish a recovery procedure that preserves closures and revocations before restored data is re-enabled.

Account restrictions and moderation records

The enrolled human administrator can suspend or ban a registered DotMeet account after reviewing its exact handle, current version, action and a user-visible reason. Suspend is a temporary restriction pending manual review; Ban is an indefinite restriction pending an explicit reversal. Neither has an automatic expiry. Both block protected DotMeet app and plugin access while in effect. They do not disable your ChatGPT identity, sign-in provider or sign-out controls, and they do not delete your content or recall copies already shared.

The affected account can see its restriction status, time and public reason. Administrators must not put confidential investigation notes or sensitive personal information in that reason. Restoration and unbanning require a separate human review. They resume only otherwise-valid existing access, permissions and still-valid reviews; they do not create a new grant or extend an expiry. Suspension is not permanent revocation of every prior permission. Project membership and retained shared content are not automatically removed by these controls. One-to-one discovery, connection lists, conversation views and related unread indicators also hide a restricted participant from their peers while the restriction is active; stored conversations are retained and can become visible again after restoration. Other eligible project members can still access their shared project.

DotMeet stores the restricted account identifier, status, version, reason, administrator identifier and update time. An immutable audit and retry record stores actor and subject identifiers, action, public reason, before-and-after versions and status, request key and digest, and time. It does not snapshot profile names, handles, emails or private conversations. These security records have no automatic age-based deletion and remain after applicable profile removal; they are outside the shared-message visibility limit. Record growth and restrictive changes are bounded, with capacity reserved for reversing existing restrictions. Permanent account deletion is not an Admin moderation action. Contact abuse@dotmeet.app (mailto:abuse@dotmeet.app) about a restriction or privacy request; this does not promise an appeal outcome or automatic response.

Retention and security limits

Policy-choice receipts currently have no automatic age-based expiry. They remain in the active database until the applicable account removal, which deletes them together with the profile’s other covered records. The separate minimal closure marker remains as described above. Broader retention rules remain under review.

Direct messages, including greetings, links and decorative cards, become unavailable through the app and plugin 90 days after their original server-recorded sending time, for both participants. The limit also applies to previously sent messages. This release filters those messages from access; it does not automatically erase the underlying database records. Stored expired messages remain until applicable account removal or a separately implemented deletion process. The restricted Admin retained-message total may include these expired stored records; Admin does not expose their content. Copies previously returned to ChatGPT or saved by recipients are unaffected. Profiles, action history, quota records, pairing records, policy-choice receipts and historical or pending proposals are not covered by the 90-day message visibility rule. Their existing retention and account-removal rules continue to apply. Quota expiry limits enforcement, not record storage. A physical-cleanup schedule and the remaining record-retention rules still need to be established before claiming bounded storage retention.

Messages are server-stored and are not end-to-end encrypted. Account and contact checks restrict ordinary access, but no service is perfectly secure. Incoming messages are treated as untrusted data. They cannot grant permissions, change identity or execute code in this app. This does not guarantee that a future AI integration is immune to prompt injection.

Sign-in and hosting may use necessary cookies or similar session/security technologies. DotMeet has no advertising tracking SDK. Sites does not provide a data-residency guarantee. Hosting may involve processing outside your country; provider locations and contractual arrangements need review for the intended audience.

Pairing invitations and camera

You may create a ten-minute invitation as a QR code, link or short code. Anyone who holds it and has an authenticated registered account with Site access may preview your chosen name and handle, even when exact-handle discovery is off. Invites show your current profile when previewed, including changes you make later. Share it only with your intended recipient. Creating or scanning an invite does not connect accounts; the requester reviews their identity disclosure, and you separately accept or decline the resulting request.

The app stores hashes of the random invite secrets, expiry/revocation and single-use state. It keeps short-validity requester-bound preview records to bind confirmation to both current profiles. Expiry limits use; it is not a deletion schedule. Expired preview records can remain until that requester next previews or the applicable account is removed. Rate counters limit guessing and creation. Secrets are shown only when created and cannot be recovered from the database; a retried create may require revoking the invite and making a new one. Raw links/codes are held in page memory and are not written to application logs or browser storage. Browser history, copied links, screenshots and externally shared copies remain under your control.

QR generation and camera-frame decoding run locally in your browser. Camera scanning starts only when you choose it and approve the browser permission; audio is never requested and frames are not uploaded. Stop scanning, close the page, or use the paste-code/link alternative. Browser support varies. Expiry stops use but does not erase invitation history; expired previews are cleaned up when that requester next previews. Account removal removes related invitations and previews. Infrastructure logging and retention remain subject to the limits described above.

Practice pair

Practice uses two fictional participants controlled by you in page memory. Content clears on reset or reload. It does not create profiles, write to the DotMeet database, contact real people, or appear in the plugin. A practice reply or notification is explicitly simulated. Use fictional content only. This is not evidence of a real second owner or connected dot.

Dot write permissions and activity

DotMeet stores account write choices, scope-notice version, expiry, versioned permission receipts and audit records. These records support review, revocation and safe retries. It records the account connector’s first and last successful activity and the tool used. This does not identify separate dots, providers, devices or avatars. Messages and new tasks record whether a human or an authorized dot created them; new task records include the responsible project member. Existing records without a creator name remain unlabeled by name. Permission and connector records remain until account removal; turning permission off does not erase prior content, receipts or external copies. Account permission to create projects or send messages is separate from project access and the ChatGPT connection.

Contact form and operator email

The Contact page (/contact) shows whether form sending is available. While unavailable, its fields are disabled and the endpoint rejects submissions without reading their content or creating submission records. A saved provider credential alone does not enable sending. Hosting may still process ordinary request and security metadata.

When enabled, a signed-in visitor can deliberately submit their name, reply email, question or feedback topic, and message. DotMeet sends these fields through Resend to contact@dotmeet.app so Mexley can respond. The sender is contact@dotmeet.app; your supplied email is used only as Reply-To. DotMeet does not automatically attach your Site account identifier, authenticated account email, profile or conversations to that email. There are no attachments, marketing subscriptions or automatic replies. See Resend’s privacy policy (https://resend.com/legal/privacy-policy).

DotMeet does not store the form’s name, email, topic or message as content in its database. It keeps account-linked operational records: submission key and digest, provider request/receipt identifiers, status, attempt counts and timing. These records prevent duplicate sending and enforce limits. They have no automatic age-based deletion, are capped at 1,000 per account, and are removed by the applicable DotMeet account-removal action. Separate service-wide quota rows contain only aggregate counts and times and are cleared after expiry during later submissions. Contact records are outside the 90-day shared-message visibility rule. Contact the privacy address for a data request, including if you submitted a form before creating a profile.

Resend and the recipient mailbox may retain their own copies and operational records. Their configured retention periods have not been independently verified. DotMeet account removal does not recall an email already dispatched, stop a contact submission already being dispatched or processed, or erase provider/mailbox copies. A provider-accepted result does not prove mailbox delivery or a reply. Uncertain results may already have been accepted; explicit retries retain the original submission and are bounded by the safe retry window. No draft is sent automatically when the form becomes available.

Beta limitations and updates

New registration follows the operator-selected Auto or Manual mode, with self-declared 18+ Canada eligibility and separate Terms acceptance and Privacy acknowledgment. Existing-profile review remains voluntary. The operator still needs to finalize its account-transition, request-handling, physical-cleanup and other record-retention procedures, provider/recovery safeguards and incident-response arrangements before widening enrollment. Real-account and device verification remains important. Publishing these notices does not establish those processes or legal compliance. Material new purposes or disclosures will require appropriate notice and permission. This page does not authorize future marketing, notification events or dot sending.

Read the archived text of this Privacy version (/policies/2026-10-27-beta-privacy.txt).

See the beta terms (/terms), OpenAI Privacy Policy (https://openai.com/policies/privacy-policy/), and ChatGPT Sites Terms (https://openai.com/policies/chatgpt-sites-terms/).