# Privacy Policy for YaSay **Last Updated: January 2025** ## Introduction YaSay ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application YaSay (the "App"), available on both iOS (Apple App Store) and Android (Google Play Store) platforms. Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the application. This Privacy Policy applies to all users of the YaSay app, regardless of which platform (iOS or Android) you use to access the App. ## Information We Collect ### How We Collect Information We collect information through the following methods: - **Directly from You**: When you create an account, create content, update your profile, or interact with the app - **Automatically**: Through app usage, device information, and error tracking systems - **From Device Permissions**: When you grant permissions for photo access, biometric authentication, or other device features - **From Third-Party Services**: Through our service providers (Supabase, Sentry) as part of app functionality ### Personal Information You Provide - **Account Information**: Email address, name, and profile bio - **Authentication Data**: Login credentials (email and password) and biometric authentication preferences - **User Content**: Stories, decisions, votes, comments, and any text or content you create and share - **Profile Data**: Avatar images, profile pictures, and privacy settings - **Community Participation**: Your participation in communities and story tags ### Information We Collect Automatically - **Device Information**: Device type, operating system version, app version, unique device identifiers, device model - **Usage Data**: How you interact with the app, features used, time spent, pages viewed, actions taken within the app - **Crash Reports**: Technical information, error logs, stack traces, and performance data to help us improve app performance - **Analytics Data**: App performance metrics and user behavior patterns (collected through Sentry for error monitoring and app improvement) - **Network Information**: IP address, network connection type, and network status - **App State Information**: App version, installation date, and session information ### Information from Device Permissions We request the following permissions to provide app functionality: - **Photo Library/Media Access**: - **iOS**: Photo Library access to allow you to select and upload profile pictures and story images - **Android**: Media Images access to allow you to select and upload profile pictures and story images - **How We Use It**: We only access photos you explicitly select for upload. We do not browse or scan your entire photo library. - **Biometric Authentication**: - **iOS**: Face ID or Touch ID for secure login (optional) - **Android**: Fingerprint or Face Unlock for secure login (optional) - **Privacy**: Biometric data is processed locally on your device only and never transmitted to our servers - **Storage Access**: - To save and retrieve your uploaded images and app preferences - To cache app data for offline functionality - **Internet Access**: - Required for app functionality, data synchronization, and cloud storage access - Used to connect to our servers and third-party services (Supabase, Sentry) ### Platform-Specific Identifiers **Android Devices:** - **Android Advertising ID (AD_ID)**: The app requests access to Android Advertising ID permission. Currently, this permission is requested but not actively used for advertising purposes. If we begin using advertising IDs in the future, we will update this privacy policy and provide you with controls to opt-out. You can also reset your advertising ID through your Android device settings. **iOS Devices:** - **Identifier for Advertisers (IDFA)**: Currently, the app does not use Apple's Identifier for Advertisers. If we begin using IDFA in the future, we will update this privacy policy and comply with Apple's App Tracking Transparency requirements, requesting your explicit consent. ## How We Use Your Information We use the information we collect to: ### Core App Functionality - **Account Management**: Create and maintain your user account, authenticate your identity - **Content Creation**: Enable you to create and share stories, decisions, and comments - **Authentication**: Provide secure login using email/password and optional biometric authentication - **Social Features**: Allow you to vote on stories, comment, interact with other users' content, and participate in communities - **Content Personalization**: Show you relevant stories, communities, and content based on your activity - **Notifications**: Send you push notifications about activity on your stories, comments, and other relevant updates (if enabled) ### App Improvement - **Performance Monitoring**: Identify and fix bugs, crashes, and technical issues (via Sentry) - **Feature Development**: Understand how users interact with features to improve the app experience - **Analytics**: Analyze usage patterns to enhance functionality and user experience - **Quality Assurance**: Ensure app stability and reliability ### Communication - **App Updates**: Notify you about important app updates and new features - **Support**: Respond to your inquiries and provide customer service - **Account Security**: Verify your identity and protect against unauthorized access ## Information Sharing and Disclosure ### We Do NOT Sell Your Data We do not sell, trade, or rent your personal information to third parties for marketing purposes. ### Limited Sharing We may share your information only in these circumstances: **Service Providers** - **Supabase**: Our database and cloud storage provider (hosts your account data, stories, comments, votes, and uploaded images). Supabase operates under their own privacy policy: https://supabase.com/privacy. Supabase is contractually obligated to provide the same or equal protection of user data as stated in this privacy policy. - **Sentry**: Our crash reporting and performance monitoring service (collects app usage, crash reports, device information, and error logs). Sentry operates under their own privacy policy: https://sentry.io/privacy/. Sentry is contractually obligated to provide the same or equal protection of user data as stated in this privacy policy. - **App Store Services**: - **Apple App Store** (iOS): For app distribution and updates through Apple App Store. Apple's privacy policy: https://www.apple.com/privacy/ - **Google Play Store** (Android): For app distribution and updates through Google Play Store. Google's privacy policy: https://policies.google.com/privacy **Third-Party SDKs and Libraries:** We use third-party SDKs and libraries in our app that may collect information. These include: - **Sentry SDK**: For error tracking and performance monitoring (applies to both iOS and Android) - **Supabase SDK**: For database and authentication services (applies to both iOS and Android) All third-party services we use are contractually required to protect your data in accordance with this privacy policy and applicable data protection laws. **Legal Requirements** - When required by law, legal process, or government request - To protect our rights, property, or safety, or that of our users - To prevent fraud, abuse, or illegal activity - To comply with a judicial proceeding, court order, or legal process **Business Transfers** - In connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction **With Your Consent** - We may share your information with third parties when you have explicitly consented to such sharing ## Data Storage and Security ### Where Your Data is Stored - **Primary Storage**: Supabase cloud database (your account information, stories, comments, votes, and user-generated content) - **Image Storage**: Supabase Storage service (your uploaded profile pictures and story images) - **Local Storage**: Device storage for app preferences, cached data, and session information - **Crash Reports**: Sentry service (technical error logs and performance data) ### Data Location Your data may be stored and processed in servers located in the United States and other countries where our service providers operate. By using the App, you consent to the transfer of your information to these locations. ### Security Measures - **Encryption**: All data transmission is encrypted using industry-standard protocols (HTTPS/TLS) - **Authentication**: Secure login with password hashing and optional biometric authentication - **Access Controls**: Limited access to your data by authorized personnel only - **Regular Updates**: We regularly update our security measures and app to address security vulnerabilities - **Database Security**: Supabase provides enterprise-grade security with encryption at rest and in transit ## Your Rights and Choices ### Account Control - **Access**: View and update your profile information at any time through the app settings - **Deletion**: Delete your account and associated data through the app settings or by contacting us at yasayllc@gmail.com - **Privacy Settings**: Control who can see your profile and content (private profile settings) - **Notifications**: - **Opt-Out**: You can opt-out of push notifications at any time through: - **iOS**: Settings > Notifications > YaSay, or through in-app notification settings - **Android**: Settings > Apps > YaSay > Notifications, or through in-app notification settings - **Opt-In**: Push notifications are opt-in and can be enabled/disabled at any time - **Content Control**: Edit or delete your stories, comments, and other content you've created - **Data Access**: Request a copy of your data by contacting us at yasayllc@gmail.com ### Data Management - **Photo Access**: You can choose which photos to upload; you control what images are shared - **Biometric Authentication**: You can enable/disable biometric authentication (Face ID/Touch ID on iOS, Fingerprint/Face Unlock on Android) at any time in app settings - **Anonymous Posting**: Option to post stories anonymously (when available) - **Profile Visibility**: Control whether your profile is public or private ### Right to Delete You have the right to request deletion of your account and all associated data. You can do so by: 1. Using the delete account feature in app settings (if available) 2. Contacting us directly at: yasayllc@gmail.com **Deletion Process:** - We will process your deletion request within 30 days of receipt - We will delete your personal information, including: - Account information (email, name, profile bio) - User-generated content (stories, comments, votes) - Profile pictures and uploaded images - App preferences and settings - **Exceptions**: We may retain certain information where required by law, including: - Information needed for legal compliance - Information needed to resolve disputes - Information needed to enforce our terms of service - Anonymized, aggregated data that cannot identify you **Revoking Consent:** - You can revoke your consent for data processing at any time by deleting your account or contacting us - Revoking consent will result in the deletion of your data as described above ### Data Portability You may request a copy of your personal data in a structured, machine-readable format. Contact us at yasayllc@gmail.com to make such a request. ## Third-Party Services Our app uses third-party services to provide functionality and improve user experience. These services may collect, store, and process your information as described below. ### Supabase - **Purpose**: Database, authentication, and file storage services - **Data Shared**: Your account information (email, name, profile data), stories, comments, votes, uploaded images, and all user-generated content - **Data Location**: Data may be stored in Supabase servers located in various regions (primarily United States) - **Privacy Policy**: https://supabase.com/privacy - **Data Protection**: Supabase is contractually obligated to protect your data in accordance with this privacy policy and applicable data protection laws ### Sentry - **Purpose**: Crash reporting, error tracking, and performance monitoring - **Data Shared**: App usage data, crash reports, device information, error logs, performance metrics, user interactions that lead to errors, IP addresses, and device identifiers - **Data Collection Method**: Automatically collected when errors occur or for performance monitoring - **Privacy Policy**: https://sentry.io/privacy/ - **Data Protection**: Sentry is contractually obligated to protect your data in accordance with this privacy policy and applicable data protection laws - **Opt-Out**: You cannot opt-out of Sentry's error tracking as it is essential for app stability and security ### App Store Services - **Apple App Store (iOS)** - **Purpose**: App distribution, updates, and App Store services - **Data Shared**: App usage data, device information, and installation information - **Privacy Policy**: https://www.apple.com/privacy/ - **Google Play Store (Android)** - **Purpose**: App distribution, updates, and Google Play Store services - **Data Shared**: App usage data, device information, and installation information - **Privacy Policy**: https://policies.google.com/privacy ## Children's Privacy YaSay is not intended for children under 13 years of age (or under 16 in the European Economic Area). We do not knowingly collect personal information from children under these ages. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at yasayllc@gmail.com, and we will delete such information from our records. If we become aware that we have collected personal information from a child under the applicable age without parental consent, we will take steps to delete that information promptly. ## International Users ### Data Transfers If you are using our app from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States and other countries where our service providers operate. These countries may have data protection laws that differ from those in your country. ### European Economic Area (EEA) Users If you are located in the EEA, you have certain data protection rights under the General Data Protection Regulation (GDPR), including: - The right to access your personal data - The right to rectify inaccurate data - The right to erasure ("right to be forgotten") - The right to restrict processing - The right to data portability - The right to object to processing - The right to withdraw consent To exercise these rights, please contact us at yasayllc@gmail.com. ## California Privacy Rights If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA): - The right to know what personal information is collected, used, shared, or sold - The right to delete personal information - The right to opt-out of the sale of personal information (we do not sell your personal information) - The right to non-discrimination for exercising your privacy rights To exercise these rights, please contact us at yasayllc@gmail.com. ## Biometric Data When you enable biometric authentication: - **iOS**: Face ID or Touch ID authentication - **Android**: Fingerprint or Face Unlock authentication **Important Privacy Information:** - **Local Processing Only**: Biometric data is processed locally on your device and never transmitted to our servers - **No Storage**: We do not store your biometric data; it remains on your device's secure hardware - **Secure Hardware**: - **iOS**: Uses Secure Enclave (Apple's secure hardware) - **Android**: Uses Hardware Security Module (device-specific secure hardware) - **Optional**: You can enable or disable biometric authentication at any time in app settings - **Device Control**: Your biometric data is managed entirely by your device's operating system (iOS or Android) - **Privacy**: We never have access to your actual biometric data (fingerprint patterns, face scans, etc.) ## Photo and Media Access When you grant photo library/media access: - **iOS**: Access to your Photo Library to select images for upload - **Android**: Access to your device's media images (photos) to select images for upload **How We Use Photo Access:** - **Purpose**: To allow you to upload profile pictures and story images - **Control**: You choose which specific photos to upload; we do not access your entire photo library or media gallery - **Limited Access**: The app only accesses photos you explicitly select for upload - **Storage**: Uploaded images are stored securely in our cloud storage (Supabase Storage) - **Deletion**: You can delete uploaded images at any time through the app - **Permissions**: - **iOS**: You can revoke photo library access at any time through Settings > Privacy & Security > Photos > YaSay - **Android**: You can revoke media access at any time through Settings > Apps > YaSay > Permissions > Photos and media ## Data Retention We retain your information for as long as your account is active or as needed to provide you services. Specifically: - **Active Accounts**: We retain your data while your account is active - **Deleted Accounts**: When you delete your account, we will delete your personal information within 30 days, except where we are required to retain it for: - Legal compliance purposes - Resolving disputes - Enforcing our agreements - Preventing fraud or abuse - **Aggregated Data**: We may retain anonymized, aggregated data for analytics and improvement purposes - **Backup Data**: Deleted data may persist in backups for a limited time before being permanently deleted ## Cookies and Tracking Technologies Currently, the App does not use cookies or web tracking technologies. However, we use: **Local Device Storage:** - **iOS**: Keychain (for secure credential storage) and UserDefaults (for app preferences and cached data) - **Android**: SharedPreferences and encrypted storage (for app preferences and cached data) - **All Platforms**: Local storage to maintain your login session and app preferences - **Purpose**: Local storage is used to improve app performance and user experience **Analytics and Monitoring:** - **Sentry**: Collects technical data for error monitoring and performance improvement (applicable to both iOS and Android) - **Data Collected**: Error logs, crash reports, device information, performance metrics - **Purpose**: To identify and fix bugs, improve app stability, and enhance user experience - **Cannot Opt-Out**: Error tracking is essential for app functionality and cannot be disabled **Tracking and Advertising:** - **No Cross-App Tracking**: We do not track your activity across other apps or websites - **No Behavioral Advertising**: We do not use your data for behavioral advertising or ad targeting - **No Third-Party Advertising Networks**: We do not share your data with advertising networks ## Changes to This Privacy Policy We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by: - Posting the new Privacy Policy in the app - Updating the "Last Updated" date at the top of this policy - Sending you an email notification (if you have provided an email) - Displaying a prominent notice in the app Your continued use of the App after any changes to this Privacy Policy constitutes your acceptance of the updated policy. ## Contact Information If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at: **Email**: yasayllc@gmail.com **Response Time**: We will respond to your inquiry within a reasonable timeframe, typically within 30 days. For deletion requests, we will process them within 30 days as required by law. **Data Protection Officer**: For users in the European Economic Area, you may contact us at the email above for any data protection inquiries. **App Store Compliance**: This privacy policy is designed to comply with: - **Apple App Store Guidelines**: Including App Privacy requirements and data collection disclosures - **Google Play Store Guidelines**: Including Data Safety section requirements and privacy policy requirements ## Consent By using the YaSay app, you consent to the collection and use of your information as described in this Privacy Policy. **How Consent Works:** - **Initial Consent**: By downloading and using the app, you consent to this privacy policy - **Explicit Consent**: For certain features (like photo access, biometric authentication, push notifications), we request explicit permission through your device's permission system - **Ongoing Consent**: Continued use of the app constitutes ongoing consent to this privacy policy - **Withdrawing Consent**: You can withdraw your consent at any time by: - Deleting your account - Revoking permissions through your device settings - Contacting us at yasayllc@gmail.com If you do not agree with any part of this policy, please do not use the App. --- *This Privacy Policy is effective as of the date listed above and will remain in effect except with respect to any changes in its provisions in the future, which will be in effect immediately after being posted in the app.* **Version**: 1.0 **Last Updated**: January 2025