Privacy requests

Your rights and choices

Everyone can:

• Download your data: Settings > Download my data, free and at any time.
• Correct it: edit your profile, or ask us to fix anything else.
• Delete it: Settings > Delete account, or our web deletion page at joinyapp.app/delete-account if you no longer have the app. A web request takes effect 72 hours after you enter the code we email you, and signing in or opening the app before then cancels it. You can also remove single photos, messages and other content; removed messages and snaps are kept as safety copies as section 8 explains, and you can ask us to erase a safety copy.
• Change who sees what: Settings > Privacy.
• Turn off notifications and location in Settings or on your device.
• Withdraw consent you gave us, for example for location.
• Ask for a person to review an automated decision (section 3).

To make a request, use the tools above, Settings > Help and contact > Privacy, or email privacy@joinyapp.app. We confirm who you are through your sign-in, not by asking for ID images. You can use an authorized agent; we may ask them for proof that you authorized them. We answer within 45 days (within one month in the UK, once Yapp opens there). If a request is complex, we may take longer where the law allows and will tell you why.

Using your rights doesn’t change the price or features you get, with one exception that applies to everyone: after you delete an account, a new one can’t be created from the same device or identity for 30 days, to stop banned people from returning and to limit age-check abuse. You can contest that block and ask for a person to review it.

If we turn down a request, we tell you why. You can appeal by replying to our answer or emailing privacy@joinyapp.app with “Appeal” in the subject. We answer appeals within 45 days. If we don’t fix it, you can complain to your state attorney general.

More rights if you live in the UK, once Yapp opens there

Under UK data protection law you also have the right to object to our use of your information, to restrict it, and to data portability. You can complain to us, and we will acknowledge your complaint within 30 days and handle it without undue delay. You can also complain to the Information Commission (ico.org.uk, 0303 123 1113).

Our legal reasons (lawful bases) for using your information:

Running Yapp and delivering purchases

Contract: we need it to provide what you asked for.

Age checks and keeping age groups apart

Our duties to protect children under the Online Safety Act and Ofcom’s codes, and our legitimate interest in keeping age groups apart (legal obligation where the Act or a regulator requires a check). The adult ID face check, the photo check and “Still you?” re-checks use biometric data to confirm you are the same person; for these we rely on the substantial public interest in safeguarding children and individuals at risk and in preventing unlawful acts.

Safety, moderation and reporting crimes

Legal obligation, and the recognized legitimate interests (as UK law calls them) of preventing crime and safeguarding vulnerable people, including children.

For adults (18+) Approximate nearby location (adults)

Consent, which you can withdraw at any time.

Improving and securing Yapp

Legitimate interests, balanced against your rights. For under-18s we give extra weight to their best interests.

Tax, accounting and legal records

Legal obligation.

Legal claims

Legitimate interests.

You don’t have to give us information, but without the sign-in, age check and a face photo, you can’t use Yapp.

International transfers: we’re based in the US and store information in the United States (US East). Once Yapp opens in the UK, when we transfer information about people in the UK to the US, we use the UK-US data bridge where the recipient is certified, or the UK International Data Transfer Agreement or Addendum.

More rights if you live in a US state with a privacy law

This section is our notice for California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and other states with similar laws.

• Categories we collect: identifiers (sign-in ID, email, username, IP address); personal records (name); characteristics (age, gender if you add it); commercial information (purchases); internet and app activity; approximate location; audio and visual information (photos, videos, voice notes, selfie video during the check); inferences we make only to run your feed and safety tools; and sensitive information (age check data including biometric information for a few minutes, account sign-in, the content of your messages, and information about users under 16 or 18).
• Sources, purposes and recipients: as described in sections 2, 3 and 7.
• Sensitive information: we use it only for the purposes the law allows without an opt-out, such as providing the service you asked for, security, and preventing fraud and crime. We don’t use it to infer things about you.
• Sale, sharing and targeted advertising: we don’t sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising, and haven’t done so in the past 12 months. That includes users under 18. We honor Global Privacy Control signals.
• Retention: section 8.
• Your rights: to know and access, correct, delete, get a portable copy, and opt out of sale, sharing, targeted advertising and profiling that has legal or similarly significant effects (we don’t do any of these). How to use them: section 11.

California “Shine the Light”: we don’t share personal information with third parties for their own direct marketing.

Washington and Nevada consumer health data: see our separate Consumer Health Data Privacy Policy.

From section 11 of the Privacy Policy.