Anonymous Chat: Stranger Connect — Moderated 1:1 Stranger Chat
Anonymous one-to-one chat with strangers, built safety-first — because in this app category, moderation isn't a feature, it's the foundation.
Random stranger chat has real demand — roughly 380M monthly users globally post-Omegle — but it's the single most heavily scrutinised user-generated-content category on both app stores. Apple pulled random chat under its stricter UGC review guideline; Google requires self-certified CSAM reporting processes and a named child-safety contact before an app in this category can stay listed. Most entrants build the chat first and bolt moderation on before submission, which is why they get rejected, delisted, or named in investigative reporting. The engineering problem isn't the chat — it's shipping a compliant UGC platform where every safety requirement is launch-blocking.
A Flutter and Firebase app where every trust-and-safety requirement was scoped as P0 and sequenced into the first milestone, before core chat existed. Users start with anonymous auth — no email, no phone, no real-name field anywhere in the schema — pass a date-of-birth age gate and a mandatory guidelines tap-through, then match by interest tags, mood, or gender preference. Live chat runs on Realtime Database rather than Firestore, chosen for latency and write cost at high frequency, with transcripts deleted once both parties close and a 24-hour fallback expiry so a never-closing counterpart can't keep a transcript alive. Outgoing messages are screened client-side before send. Every uploaded image enters a server-side moderation queue before delivery, with a 90-day retention purge that exempts anything under legal hold — because US federal law requires reported CSAM content to be preserved for 90 days after the NCMEC report, which a flat retention window alone would delete. Reports preserve evidence into Firestore at report time, so deletion-on-close never destroys the moderation trail. Moderators work from a separate static console on Firebase Hosting that holds no credentials — all privileged actions run through Cloud Functions gated by custom claims, deliberately unlike a Django-style dashboard carrying a full-admin service key into a browser.
Outcome
Shipped to both stores at v2.1.0, through eight milestones and an Apple resubmission cycle for the UGC guideline. Live moderation console in production with an audit trail and aggregate metrics. The build carries a documented runbook covering release ordering, rules deployment, and signature verification, plus a widget and security-rules test suite. Published under a deliberately separate developer account — Google's child-safety enforcement terminates associated developer accounts, so this app's store risk was firewalled from the company's other products by design, with distinct ownership and payment details so the accounts aren't linked.
Key features
- Anonymous authentication, no email or phone, no real-name field anywhere in the schema
- Date-of-birth age gate with an adults-only store rating declared consistently across app, listing, and IARC
- Interest-tag, mood, and gender-preference matching with rate-limited re-matching
- Real-time 1:1 chat on Realtime Database with presence, typing indicators, and read state
- Transcript deletion once both parties close, with a 24-hour fallback expiry
- Evidence preservation at report time, so deletion never destroys the moderation trail
- Client-side content screening that refuses prohibited messages before they send
- Server-side image moderation queue gating delivery, with takedown handling
- 90-day scheduled image purge with legal-hold exemption for reported content
- One-tap report on any message or chat, with recent messages attached and the reporter kept anonymous
- One-tap block with permanent re-match exclusion
- On-device safety nudges detecting contact-sharing and meet-up patterns, with no message content leaving the device
- Sender-side message deletion that removes the message for both parties instantly
- Escalating enforcement — warning, suspension, permanent ban — with mandatory ban for confirmed child-safety violations
- Standalone moderation console on Firebase Hosting, credential-free, with custom-claim gating and moderator self-bootstrap
- Moderation audit log and aggregate analytics for regulator and store-review requests
- Aria, a disclosed AI companion that fills empty-queue dead air — server-side only, discloses itself in its first message, and is prompted never to deny it
- Stars and badge economy earned from matches and rewarded ads, with coin-for-content mechanics explicitly excluded
- Push notifications when a match becomes available
- Published child safety standards and privacy policy pages, with a designated child-safety point of contact
- Dev and prod flavors with separate Firebase projects and a documented release runbook
Tech stack
Build something similar?
Tell us about your project. We'll share how we'd approach it.
Start a project