Yapp

Age assurance and biometric notice

The short version

  • Everyone takes a short selfie video so we can estimate their age and check they’re a real person. Adults also show a photo ID that’s compared with their selfie.
  • The video, the ID images and the face measurements made from them are deleted as soon as the check is done, within 10 minutes at most.
  • We keep only the result, the method, the provider, a reference number and the time.
  • We never sell this information, never use it to recognize you anywhere else, and never use it for advertising.

This notice explains the age and face checks Yapp uses, what information they use, how long it’s kept, and your choices. It is also our public biometric information policy. Our Consumer Health Data Privacy Policy for Washington and Nevada is a separate page.

Contents
  1. 1. The checks we use
  2. 2. Why we use them
  3. 3. Who does the checks
  4. 4. What information is used
  5. 5. What we keep and for how long
  6. 6. Your consent and choices
  7. 7. Disclosure
  8. 8. Consumer health data (Washington and Nevada)
  9. 9. If you live in the UK, once Yapp opens there
  10. 10. Contact

1. The checks we use

Age estimation
Who: Everyone
When: At sign-up, and when a re-check is needed
What it does: Estimates your age from a selfie video, without identifying you.
Liveness
Who: Everyone
When: With every face check
What it does: Checks that a real person is in front of the camera, not a photo, mask or video.
ID check
Who: Adults and Parent Portal users
When: At sign-up, at age 18, and when a re-check is needed
What it does: Reads the date of birth on a government photo ID and checks that the ID is genuine.
ID face check
Who: Adults and Parent Portal users
When: With the ID check
What it does: Compares the face on the ID with your selfie to check the ID is yours.
Photo check
Who: Everyone
When: When you add or change your main profile photo, and in “Still you?” re-checks
What it does: Compares your profile photo with a fresh selfie to check the photo shows you.

We may also use the age range your phone or app store shares with us (Apple’s Declared Age Range or Google Play Age Signals). That doesn’t involve your face. A store signal that says you’re under 18 always puts you on the teen path, and no store signal can move a verified teen into the adult group.

2. Why we use them

  • To keep under-13s off Yapp.
  • To put everyone in the right age group, and keep teens and adults apart.
  • To make sure profile photos show the real person.
  • To meet US state laws on minors’ accounts and, once Yapp opens in the UK, our duties to protect children under the UK Online Safety Act and Ofcom’s codes.

We use the information only for these purposes. We never use it to identify you in other photos, for advertising, for marketing, for profiling, or to train our own systems.

3. Who does the checks

The checks are done by k-ID, acting for us as our service provider (in UK law, our processor). Our contract requires the provider to:

  • use your images and face measurements only to do the check and return the result to us,
  • delete them as soon as it returns the result,
  • not sell, share or keep them, and not use them to train or improve its technology,
  • keep them secure while it has them.

4. What information is used

  • Selfie video frames, and the face geometry (measurements of facial features) calculated from them. This is biometric information.
  • For the ID check: images of the front (and back, if needed) of your ID, and what’s printed on it, including your date of birth, the type of document, the issuing country and its expiry date.
  • Device information needed to run the check securely.

5. What we keep and for how long

Selfie video, ID images, and face measurements from them
Deleted as soon as the check is finished, within 10 minutes at most (for an appeal selfie, as soon as the review is done). Never stored with your account.
Result (for example “verified 16-17”, “18+ confirmed”, “retry”)
While your account exists, and 3 years after it’s deleted.
Method, provider, reference number and time
The same as the result.
Under-13 results
Nothing is kept, apart from a count that doesn’t identify anyone.

Our biometric retention schedule: we permanently destroy biometric identifiers and biometric information when the purpose of collecting them is complete, which is when the check finishes, and in no case later than 10 minutes after collection. A selfie you agree to provide for a human review of an appeal is destroyed when the review is done, and in no case later than 30 days after you provide it. This is much sooner than the law’s outer limits (for example, three years after your last interaction with us in Illinois, or one year after the purpose ends in Texas).

6. Your consent and choices

  • Before any check, we explain what it does. In the US, you agree by tapping “I agree”, which is your written release. Once Yapp opens in the UK, people there confirm they understand the check instead (section 9). We keep a record of the consent screen you saw and when you agreed.
  • If you stop before the check, you can’t use Yapp, because the check is how we keep age groups safe. We delete anything you entered.
  • If you’re an adult and the face estimate isn’t sure, you can use the ID route. Teens don’t have an ID route; if the estimate isn’t sure, you can try again in better light.
  • If you think a result is wrong, tap “This is wrong”. A person reviews it and aims to reply within 7 days. If they need a new selfie to decide, we ask you first and delete it as soon as the review is done. Ask for a new check at any time.
  • You can withdraw your consent by deleting your account. If you ask us to delete your data, there is nothing biometric left to delete; we delete the result record with your account, except as section 5 says.

Accuracy: age estimation is an estimate. It is tested for accuracy across ages, skin tones and genders, and borderline results are sent to a retry or the ID route rather than decided. Teens who look older are never placed in an adult group, and anyone who estimates as an adult can’t join a teen group.

7. Disclosure

We don’t sell, lease, trade or otherwise profit from biometric information. We disclose it only to our age assurance provider to do the check, or where the law requires it (for example, a valid court order). We don’t disclose it for any other reason.

8. Consumer health data (Washington and Nevada)

Washington’s My Health My Data Act and Nevada’s consumer health data law treat some biometric information as “consumer health data”. Our separate Consumer Health Data Privacy Policy explains how we handle it and how to use your rights.

9. If you live in the UK, once Yapp opens there

The face estimation and liveness checks don’t identify you, but they use personal information. We rely on our duties to protect children under the Online Safety Act and Ofcom’s codes, and our legitimate interest in keeping age groups apart. The adult ID face check, the photo check and “Still you?” re-checks use biometric information to confirm you are the same person, which is special category data. For these we rely on the substantial public interest in safeguarding children and individuals at risk and in preventing unlawful acts, and we keep an appropriate policy document. You can complain to us or to the Information Commission (ico.org.uk). The Privacy Policy lists your other rights.

10. Contact

Latency LLC, [Address], privacy@joinyapp.app