Privacy policy

1. Who we are

Latency LLC (“Yapp”, “we”, “us”), [Address], runs Yapp and is responsible for your personal information (in UK law, the “controller”).

Privacy questions and requests: privacy@joinyapp.app, or Settings > Help and contact > Privacy.

This policy covers the Yapp app, the public pages at joinyapp.app, the Parent Portal and the one-time parental consent step. It also covers people who aren’t Yapp users but contact us, for example to ask us to remove an image or to report a problem.

2. What we collect

Information you give us

Sign-in: Your Apple or Google account ID, name and email address (or Apple’s private relay address). We don’t get your password or your contacts.; We use them to create your account and sign you in, to email you about your account (for example a deletion code), and so that someone who already has your email address can block or hide you with the contacts tool (below). We keep them while your account exists; after a deletion we keep only a keyed fingerprint of your sign-in identity for 30 days, unless a ban or a legal hold applies (section 8). We share them only as section 7 describes.
Age and region: Your birthday, country, and US state if you live in the US.
Age check: A short selfie video, and for adults a photo of your ID. Used only for the check and deleted straight away (section 5). We keep the result.
Profile: Name, username, pronouns, gender (self-chosen), photos, profile videos (adults), Pins, prompts, voice intro, and any optional details you add, such as school, hometown, height and tags.
For teens (13-17) What you share: Chat requests, messages, photos, videos, voice notes, snaps, stories, reactions and group chats.
Socials: Instagram, Snapchat and TikTok usernames if you add them. Shown to your friends only.
For adults (18+) What you share: Chat requests, messages, photos, videos, voice notes, snaps, stories, reactions, group chats, room posts, events and plans.
Safety and support: Reports, blocks, appeals, support messages, trusted contacts (a name and a phone number or email), and “Someone is threatening me” requests.
Purchases: What you bought, when, the price and currency, and your gem balance. Apple or Google handles your payment details; we never see your card number.
Settings and choices: Privacy, notification and appearance settings, filters, quiet hours, spending limit, and Not for me choices.

Information we collect when you use Yapp

Activity: Which features you use, when you’re active, who you send requests to and accept, profiles you skip or hide, and time spent. Used to run your feed and wellbeing tools, and for safety.
Device and app: Device model, operating system, app version, language, time zone, push notification token, crash reports, and security signals such as whether the app has been tampered with.
Network: IP address, which we use to estimate your country and state, to keep accounts secure, and to stop abuse. We don’t store your precise location from it.
For adults (18+) Approximate location: Adults who choose “Nearby” let the app use device location. It is turned into a rough area before it reaches us. We never store coordinates, and nobody sees a city, a distance or a map position for you. Teens never share device location.

Information from other people

Other users, when they mention, invite, report or block you, or add you to a group chat or Circle.
A parent or guardian who invites you or links to your account.
The app stores, which tell us your age range (where available), parental approval for teens where the law requires it, and purchase and refund records.
Our age assurance provider, which sends us the result of your check.

What we don’t collect

We don’t upload or keep your contacts. The optional “Block people from my contacts” tool turns contacts into coded hashes on your phone, uses them only to find those people’s accounts so you can block or hide them, and then discards them. They are never used for suggestions.
We don’t use advertising identifiers or track you across other apps or websites.
We don’t keep images of your face or your ID after an age check.

3. How we use your information

We use your information to:

Run Yapp: create your account, show your profile to the people your settings allow, build your feed, deliver messages and calls, and keep your settings.
Check age and keep age groups apart: run the age check, place you in the right age group, re-check when needed, and stop people reaching another age group.
Keep people safe: review reports, find and remove content that breaks our rules (section 4), detect fake accounts, scams and ban evasion, support people in danger, and report crimes.
Handle purchases: deliver what you buy, keep your gem balance, handle refunds and spending limits, and keep tax and accounting records.
Support you: answer questions, appeals and complaints, and send messages about your account and safety.
Improve and protect Yapp: fix bugs, measure how features perform, and keep systems secure. We use the smallest amount of data needed and, where we can, data that doesn’t identify you.
Meet legal obligations: respond to lawful requests, keep records the law requires, and protect our legal rights.

We don’t use your private messages, photos, voice notes or snaps to train artificial intelligence models.

How your feed works

Discover shows people in your own age group and area, most recently active people first, then others, ordered using what you’ve told us: your Pins, school or college if you added it, your filters, and how recently people were active. An active Boost raises visibility. We never rank people by looks, popularity or traits we guess about them. For teens, we use only what they’ve told us and their activity on Yapp, never behavioral profiling. “Why am I seeing this” shows the real reasons for each profile.

Decisions made by technology

Some decisions are made by automated tools:

The age check result, which decides which age group you’re in or whether you can use Yapp.
Blurring potentially sensitive media according to the recipient’s settings and filtering chat requests.
Blocking media whose hash is on our list of confirmed child sexual abuse material or intimate images we removed on request.

You can ask for a person to review any automated decision that affects you, explain your view, and challenge it. Tap “This is wrong” on an age result, or appeal from the decision notice or Help and contact.

4. Safety tools that look at content

To protect users and to meet our legal duties, sent messages, media and snaps may be scanned, stored and reviewed by moderators. Our safety tools include:

Photos and videos, including snaps, are compared against our own list of hashes (digital fingerprints) of confirmed child sexual abuse material and of intimate images we removed on request, and anything on that list is blocked before delivery. Cloudflare’s CSAM Scanning Tool also checks the media our servers deliver against known child sexual abuse material. We report apparent child sexual exploitation to NCMEC’s CyberTipline as required by law and preserve the evidence the law requires.
A separate check looks for possible nudity or sexual content. These flags can be wrong, so flagged media may still be delivered with “This content may be sensitive” and blurred for recipients who blur sensitive media. Teen accounts start with blurring on. Flagged media is kept for moderator review; we remove content that breaks the rules and act on the accounts involved.
Chat requests and messages are checked for links, phone numbers and handles (in a teen’s first requests), for scam patterns, and for words that suggest threats, grooming or sextortion.
Moderators may review content reported by a person or flagged by safety tools, along with recent messages that provide context. We may keep a copy of that content and its context as evidence, including after a message, snap or account is deleted.

Staff don’t read messages unless they’ve been reported, flagged by our safety tools, or we’re required to by law. Video calls are recorded for safety and kept for 30 days. A recording is opened only on a report, a safety flag or legal process, and every access is logged. Voice calls aren’t recorded.

5. Age checks and biometric information

We use k-ID to check age. During the check, the provider analyzes your selfie video to estimate your age and confirm you’re a real, live person. For adults, it also reads your ID and compares the face on the ID with your selfie. When you add or change your main profile photo, we compare it with a fresh selfie to make sure the photo shows you.

The selfie video, ID images and any face measurements made from them are used only for the check. We delete them as soon as the check is finished, and no later than 10 minutes after you take them. Our contract requires the provider to delete them as soon as it returns the result, and not to use them for anything else, including training its systems.
We keep: the result (for example, “verified 16-17” or “18+ confirmed”), the method, the provider’s name, a reference number and the time.
In the US, we ask for your written consent (a release) before the check, because state biometric laws require it. Once Yapp opens in the UK, we will ask people there to confirm they understand what the check does; section 11 lists the legal bases we will rely on. If you stop at that screen, we delete what you entered.

The Age Assurance and Biometric Notice explains this in more detail, including the extra information required in Illinois, Texas, Washington, Colorado and other states.

6. Who can see your information on Yapp

People in your age group see your public profile, according to your settings. Teen profiles are private by default, which limits what people who aren’t friends can see.
Your friends see more, such as details you’ve shown to friends and your socials.
Location shows as country (teens) or state, region or country (adults). Never a city, a distance or coordinates.
People in other age groups can never see you, search for you or contact you.
Messages, snaps and calls are visible only to the people in the conversation. A snap recipient may be able to replay or keep it only if you allow it.
If you block someone, they can’t see your profile or contact you, and to them you look the same as a deleted account.

What a linked parent or guardian sees

If a teen links a parent or guardian, or a parent links with a teen’s agreement, the parent sees in the Parent Portal:

the days the teen was active and how long they spent on Yapp,
the names of their friends and recent contacts,
how many people they have blocked or reported,
the privacy and safety settings in force.

A parent never sees messages, photos, voice notes, videos, snaps, stories or anything the teen writes or sends, and never sees the teen’s location beyond their country. The teen can always see who is linked and can unlink at any time.

7. Who we share information with

We don’t sell personal information, and we don’t share it for cross-context behavioral advertising or targeted advertising. That includes the information of users under 18.

We share information only with:

Service providers who work for us under contract and may use it only to provide their service to us: hosting and storage (Cloudflare and PlanetScale), age assurance (k-ID), checks of the media we deliver against known child sexual abuse material (Cloudflare’s CSAM Scanning Tool), push notifications (Apple and Google) and email delivery (Cloudflare).
Apple and Google integrity services (App Attest, DeviceCheck and Play Integrity), which tell us whether a request comes from a genuine copy of Yapp on a genuine device. Apple and Google can hold a small device flag for us that records only a ban or sign-up-limit state.
Apple and Google, for sign-in, app distribution, payments, refunds, age signals and parental approval. We use the stores’ age and consent signals only to apply age rules and safety settings, and delete them once applied.
Crash and error reporting (Google’s Firebase Crashlytics): crash reports, device and app details and your IP address, used to find and fix bugs. It never receives your messages or media.
Child safety organizations and authorities: we report child sexual exploitation to NCMEC in the US and the National Crime Agency in the UK, as the law requires. NCMEC may pass reports to law enforcement in the US and other countries.
Law enforcement and courts: when we receive valid legal process, when the law requires it, or when we believe in good faith that sharing is needed to prevent death or serious harm. We review each request and may push back on requests that are too broad.
For adults (18+) Trusted contacts you add: only when you choose to send them something, for example during a meetup check-in or an SOS.
For teens (13-17) Trusted contacts you add: only when you choose to send them something, for example an SOS.
A buyer or successor, if Yapp is sold or merged. This policy would continue to protect your information, and we’d tell you before it falls under a different policy.
Others, when you ask us to.

8. How long we keep information

We keep information only as long as we need it for the reasons in this policy. Then we delete it or make it anonymous.

Selfie video, ID images and face measurements: Deleted as soon as the check finishes, and within 10 minutes at most. A selfie you agree to provide for an appeal review: when the review is done, within 30 days at most.
Age check result record: While your account exists, then 3 years after it’s deleted, to prove we checked ages and to stop banned people from coming back.
Under-13 sign-up attempts: Nothing kept, apart from a count that doesn’t identify anyone.
Profile, photos, Pins and settings: Until you delete them or your account. If you deactivate, 60 days (28 days in the UK, once Yapp opens there) to change your mind, then deleted from live systems; backups within 14 more days.
Messages, voice notes and media in chats: Until you delete your account (messages you sent are then removed for everyone), unless they are part of a report. A message unsent or deleted for everyone is kept as a safety copy for 1 year.
Snaps: View once and one replay: removed from the app once every recipient has opened them, or after 30 days if unopened. 24-hour snaps: after 24 hours. Keep-in-chat snaps: like messages. Opened or expired snaps are kept as safety copies for 1 year.
Stories: Removed from the app 24 hours after posting, then kept as a safety copy for 1 year.
Safety copies: Safety copies of removed messages and of opened or expired snaps and stories are kept for 1 year (longer if reported, flagged, held for a legal reason or preserved under US child-safety law). Only our safety team can open them, on a report, a safety flag, legal process or a child-safety investigation, and every access is logged. They are deleted with your account, and you can ask us to erase a single item unless one of those reasons applies.
Video call recordings: 30 days, unless a recording is part of a report, a safety flag or legal process. Voice calls aren’t recorded.
Terms acceptances and arbitration opt-outs: The version of the terms you agreed to, when and how, and any arbitration opt-out (how you sent it and when we received it): for the life of your account. Download my data includes them.
Device bindings and sign-up limits: A keyed fingerprint of your app install, removed with the device or your account. After a deletion, keyed fingerprints of the device, identity and network range are kept for 30 days so a new account can’t be created straight away. Keyed IP fingerprints for ban enforcement: up to 1 year.
Reports, evidence and moderation decisions: 12 months after the case is closed. If an account is banned, the ban record (account reference, age check reference and device signals) for as long as the ban lasts, up to 5 years. We keep only the references and signals needed to recognize a return, never your profile or messages.
Child sexual exploitation reports: After a CyberTipline report, US law requires us to preserve the reported content and related data for 1 year. We keep the report reference for 5 years as our retention policy. Longer if law or law enforcement requires preservation.
Intimate image removal requests: The request record for 3 years. Hashes of removed images for as long as we run Yapp, to block re-uploads.
Purchases and gem history: 7 years, for tax and accounting law.
Support messages and complaints: 2 years after they are closed.
Account deletion requests from our website: Unconfirmed requests: 24 hours. Confirmed requests: deleted with the account.
Deletion-block records: Coded (keyed hash) device, identity and IP-range records: 30 days after a deletion takes effect, so the same device or identity can’t sign up again straight away.
Security and system logs: 90 days, longer if needed to investigate a security incident.
Parent Portal account: Until the parent deletes it. Consent records (that verified consent was given, the parent’s typed signature, the method, the time, the terms version and a reference number, never the ID or card used to check it): while consent lasts, then 3 years to prove it was given.
Contact hashes for blocking: Not kept. Discarded straight after the check.

We may keep information longer if the law requires it, if it’s needed for a legal claim, or if law enforcement asks us to preserve it.

9. Teens and children

Yapp is not for children under 13. Everyone passes an age check before using Yapp. If the check shows someone is under 13, we stop the sign-up and delete what they entered. If we learn in another way that a user is under 13, we close the account and delete their information, except anything we must keep by law (for example, a child safety report). If you think a child under 13 is using Yapp, tell us at privacy@joinyapp.app.

For teens (13-17):

Settings start at the most private level: private profile, country-only location, no friend suggestions, no read receipts, quiet hours 9 PM to 7 AM, and sensitive incoming media blurred.
We don’t use behavioral profiling for teens, and we never share teen information for advertising.
We explain things in the app at the moment they matter, in plain words.
Teens can use all the rights in section 11 themselves. A parent or guardian can also make requests for their teen where the law allows.

Once Yapp opens in the UK, we will follow the Information Commission’s Age Appropriate Design Code (the Children’s Code) for everyone there under 18.

10. How we protect your information

Encrypted in transit and at rest, not end-to-end. Yapp’s safety systems scan content, and our team can review it to keep people safe or when the law requires or allows it. We also use strict access controls, logging, and a written information security program with a named person responsible for it. Only trained staff who need it can see reported content and age check records, and that access is logged. We don’t store face or ID images.

No security is perfect. If a breach puts your information at risk, we tell you and the regulators as the law requires.

11. Your rights and choices

Everyone can:

Download your data: Settings > Download my data, free and at any time.
Correct it: edit your profile, or ask us to fix anything else.
Delete it: Settings > Delete account, or our web deletion page at joinyapp.app/delete-account if you no longer have the app. A web request takes effect 72 hours after you enter the code we email you, and signing in or opening the app before then cancels it. You can also remove single photos, messages and other content; removed messages and snaps are kept as safety copies as section 8 explains, and you can ask us to erase a safety copy.
Change who sees what: Settings > Privacy.
Turn off notifications and location in Settings or on your device.
Withdraw consent you gave us, for example for location.
Ask for a person to review an automated decision (section 3).

To make a request, use the tools above, Settings > Help and contact > Privacy, or email privacy@joinyapp.app. We confirm who you are through your sign-in, not by asking for ID images. You can use an authorized agent; we may ask them for proof that you authorized them. We answer within 45 days (within one month in the UK, once Yapp opens there). If a request is complex, we may take longer where the law allows and will tell you why.

Using your rights doesn’t change the price or features you get, with one exception that applies to everyone: after you delete an account, a new one can’t be created from the same device or identity for 30 days, to stop banned people from returning and to limit age-check abuse. You can contest that block and ask for a person to review it.

If we turn down a request, we tell you why. You can appeal by replying to our answer or emailing privacy@joinyapp.app with “Appeal” in the subject. We answer appeals within 45 days. If we don’t fix it, you can complain to your state attorney general.

More rights if you live in the UK, once Yapp opens there

Under UK data protection law you also have the right to object to our use of your information, to restrict it, and to data portability. You can complain to us, and we will acknowledge your complaint within 30 days and handle it without undue delay. You can also complain to the Information Commission (ico.org.uk, 0303 123 1113).

Our legal reasons (lawful bases) for using your information:

Running Yapp and delivering purchases: Contract: we need it to provide what you asked for.
Age checks and keeping age groups apart: Our duties to protect children under the Online Safety Act and Ofcom’s codes, and our legitimate interest in keeping age groups apart (legal obligation where the Act or a regulator requires a check). The adult ID face check, the photo check and “Still you?” re-checks use biometric data to confirm you are the same person; for these we rely on the substantial public interest in safeguarding children and individuals at risk and in preventing unlawful acts.
Safety, moderation and reporting crimes: Legal obligation, and the recognized legitimate interests (as UK law calls them) of preventing crime and safeguarding vulnerable people, including children.
For adults (18+) Approximate nearby location (adults): Consent, which you can withdraw at any time.
Improving and securing Yapp: Legitimate interests, balanced against your rights. For under-18s we give extra weight to their best interests.
Tax, accounting and legal records: Legal obligation.
Legal claims: Legitimate interests.

You don’t have to give us information, but without the sign-in, age check and a face photo, you can’t use Yapp.

International transfers: we’re based in the US and store information in the United States (US East). Once Yapp opens in the UK, when we transfer information about people in the UK to the US, we use the UK-US data bridge where the recipient is certified, or the UK International Data Transfer Agreement or Addendum.

More rights if you live in a US state with a privacy law

This section is our notice for California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and other states with similar laws.

Categories we collect: identifiers (sign-in ID, email, username, IP address); personal records (name); characteristics (age, gender if you add it); commercial information (purchases); internet and app activity; approximate location; audio and visual information (photos, videos, voice notes, selfie video during the check); inferences we make only to run your feed and safety tools; and sensitive information (age check data including biometric information for a few minutes, account sign-in, the content of your messages, and information about users under 16 or 18).
Sources, purposes and recipients: as described in sections 2, 3 and 7.
Sensitive information: we use it only for the purposes the law allows without an opt-out, such as providing the service you asked for, security, and preventing fraud and crime. We don’t use it to infer things about you.
Sale, sharing and targeted advertising: we don’t sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising, and haven’t done so in the past 12 months. That includes users under 18. We honor Global Privacy Control signals.
Retention: section 8.
Your rights: to know and access, correct, delete, get a portable copy, and opt out of sale, sharing, targeted advertising and profiling that has legal or similarly significant effects (we don’t do any of these). How to use them: section 11.

California “Shine the Light”: we don’t share personal information with third parties for their own direct marketing.

Washington and Nevada consumer health data: see our separate Consumer Health Data Privacy Policy.

12. Cookies on our public pages

Our public pages have no sign-in and use only the cookies and similar storage they need to work and to block automated abuse of their forms. We don’t use advertising or analytics cookies or cross-site tracking. Because we don’t track you across other sites, Do Not Track signals change nothing; we honor Global Privacy Control as an opt-out signal. Our Cookie Notice lists each cookie.

13. Changes to this policy

When we make an important change, we tell you in the app before it takes effect and update the date at the top. Where the law requires your consent or a parent’s consent for a change, we ask for it first.

14. Contact

Latency LLC, [Address]. Privacy: privacy@joinyapp.app.

The short version