Privacy Policy
Effective and last updated: September 4, 2026.
This policy explains how personal information is handled when you use Yapaa. Yapaa is operated by Flowna Circuit Tech Limited ("Flowna", "we", "us", or "our"). For applicable data-protection laws, Flowna is the controller of personal information used to provide Yapaa unless this policy says otherwise.
1. Information we collect
- Account and profile: email address, authentication identifiers, username, display name, biography, profile photo, locale, timezone, and a private birth date used to verify the 16+ eligibility requirement.
- Content and activity: daily answers, photos, reactions, mentions, Memories, streak activity, and the actions needed to provide answer-to-reveal.
- Connections: friend requests, accepted friendships, invitations, blocks, and related interaction history.
- Safety: reports, moderation records, the content snapshot associated with a report, and security or fraud signals.
- Device and service: platform, app version, push-notification token, notification preferences and quiet hours, coarse technical request data, reliability events, and product activity needed to operate and improve Yapaa.
2. Contact matching
Contact matching starts only when you choose to use it and grant device permission. Yapaa normalizes and one-way hashes email addresses on your device, then sends those hashes for matching. Your raw address book is not uploaded to Yapaa. You can remove contact permission in your device settings.
3. How we use information
- create and secure accounts and provide authentication;
- deliver daily questions, mutual friendships, answer-to-reveal, reactions, mentions, streaks, and Memories;
- send communications according to your notification choices and quiet hours;
- provide support, enforce blocks, investigate reports, and prevent abuse or fraud;
- diagnose reliability issues and measure aggregated product performance; and
- comply with applicable law and protect people, rights, and the service.
4. Legal bases for EEA and UK users
Where these legal bases apply, we process information:
- to perform our contract, including authentication, friendships, answers, reveal eligibility, account functionality, and requested support;
- with consent, including device contact access and push-notification permission, where required;
- for legitimate interests, including service security, abuse prevention, safety, and proportionate first-party product analysis; and
- to meet legal obligations or, in exceptional cases, protect someone's vital interests.
5. How answers are shared
Yapaa is not a public social feed. Your current answer is available to you. An accepted, unblocked friend can see it only after answering the same canonical daily question. Before reveal, friends may see that you answered without seeing the answer itself. Blocking ends mutual access and notification eligibility.
Yapaa administrators do not have a general browser for private answers. An authorized moderator can access the snapshot attached to a report when needed to review that report.
6. When information is shared
We share information only as needed in these circumstances:
- with the friends and recipients you choose, according to Yapaa's visibility rules;
- with service providers acting for us under appropriate contractual controls;
- to comply with law or a valid legal process;
- to protect a person, rights, safety, security, or the integrity of Yapaa; or
- as part of a corporate transaction, subject to appropriate confidentiality and notice where required.
7. Service providers
Yapaa currently relies on:
- Supabase for authentication, database, private media storage, and backend functions;
- Expo for app builds and push-notification delivery;
- Apple and Google for optional sign-in, device platform services, and push-notification delivery through APNs and Firebase Cloud Messaging;
- Resend for authentication and service email; and
- Vercel for Yapaa's website and restricted web administration service.
These providers process information only for the relevant service function and may publish their own privacy information.
8. No sale or behavioural advertising
We do not sell personal information. Yapaa does not currently show advertising or use personal information for cross-context behavioural advertising. We will update this policy and provide legally required choices before introducing such processing.
9. Age and teen privacy
Yapaa is for people aged 16 and older. Accounts do not have a public follower feed, and Yapaa does not publicly broadcast precise location. We use mutual connections, answer locks, blocking, reporting, and limited discovery to support a private-by-design service. See our Child & Teen Safety Policy.
10. International transfers
Our providers may process information outside your country. Where data-protection law requires safeguards for an international transfer, we use legally recognized mechanisms such as an adequacy decision, Standard Contractual Clauses, or an equivalent approved safeguard.
11. Retention and deletion
- Account and profile information is kept while the account is active.
- Answers and photos are kept until you delete them or delete the account.
- Push tokens are removed when they expire, are revoked, or the account is deleted.
- A deletion request disables discovery, sessions, notifications, and protected content immediately. Covered personal profile and content data is purged within 30 days.
- Pseudonymized safety and audit records may be retained for up to 24 months where necessary and legally justified. Aggregated information that no longer identifies a person may be retained for longer.
See the Account & Data Deletion Policy for the exact request process.
12. Your choices and rights
You can manage notification settings, remove friends, block people, report content, delete answers, and request account deletion in Yapaa. A birth-date correction requires an audited support request.
Depending on your location, you may have rights to access, correct, delete, restrict, or object to processing; receive portable information; withdraw consent; and complain to your local data-protection authority. Email privacy@yapaa.co from the address associated with your account. We may verify your identity before completing a request.
13. Security
We use safeguards designed to protect personal information, including encrypted transport, secure authentication, database access controls, restricted private-media access, least-privilege administration, secrets management, and security logging. No online service can guarantee absolute security. If a personal-data breach requires notice, we will notify affected people or regulators within the applicable legal timeframe.
14. Changes to this policy
We may update this policy as Yapaa, our providers, or legal requirements change. We will identify the current effective date and provide appropriate notice of material changes.
15. Contact
For privacy questions or rights requests, contact Flowna Circuit Tech Limited at privacy@yapaa.co or through yapaa.co.
