What we collect, and why.

01Who we are

Yapp is an independent product currently operated by an individual founder based in India. The service is delivered through the Android app (package id io.yapp.app) and the website yapp.co.in. When this policy says "we" or "Yapp", it means that founder acting as the operator of the service. Once a legal entity is registered, this section will be updated.

02Information we collect

We try to keep this list short. It is what it is — running the app needs the items below.

Account information

• Email address — used as your login, whether you sign up with email and password or with Google. We do not display it to other users. You choose your own @handle and an identity colour at signup; we never ask you for, or show other users, your real name.
• Password — only if you sign up with email and password. Stored solely as a salted hash by our authentication provider (Supabase). We cannot read it.
• Google Sign-In (optional) — if you choose to sign in with Google, your device sends us a Google identity token. It contains your email address, a Google account identifier, and the name and profile picture on your Google account. We use the email as your login; we do not show your Google name or photo to other users — your in-app identity stays the @handle and colour you chose at signup.

Voice and post content

• Audio recordings (yaps and voice posts, up to 30 seconds each) — stored on our media bucket and played back to other users.
• Automatic transcripts of those recordings — generated by our transcription provider so that listeners can opt to read what's said. Stored alongside the audio.
• AI-generated context summaries of voice threads — short text generated from the transcripts above to help users decide whether to listen to a conversation.
• Images and videos you attach to a post.
• Captions and other text you choose to add to a post.

Activity on the service

• Likes, dislikes, and replies you make to other users' content.
• Blocks and reports you submit (used to keep the platform safe and to enforce our terms).
• Impression, play, and completion counts on posts and yaps you create (so we can show you how your content is doing).

Location (optional, city-level only)

• If you grant the location permission to use Yapp's local features (the "around you" feed, posting to a city, visiting a city's feed), your device's coordinates are used momentarily to snap to the nearest city from our list of Indian cities — within 100 km, or not at all.
• We store the resolved city (e.g. "Ahmedabad"), not your GPS coordinates. Your precise location is never saved, never shown to other users, and never used for advertising.
• The permission is optional. Deny or revoke it any time in Android settings — the rest of Yapp keeps working; only the local features need it.

Device and technical information

• Android version and device model, app version, locale, time zone.
• IP address, captured by our backend when your device makes a request. Used for spam / abuse prevention and the safety signals below — not for advertising.
• Crash reports and diagnostic logs when the app misbehaves, so we can fix it.

Permissions you grant on Android

• Microphone — to record voice notes. The app only records while you are actively holding the record button. We do not listen passively or in the background.
• Storage / Photos & Media — only when you choose to attach an image or video to a post.
• Notifications — to alert you when someone replies to your yap, or when a moderation decision affects you. You can turn these off in your device settings at any time.
• Location (optional) — only if you use the local / "around you" features. Used momentarily to resolve your nearest city (see the Location section above). Deny or revoke any time; the rest of the app keeps working.
• Internet — required for the service to function.

What we do NOT collect

• Your phone number, contacts, or calendar.
• Your precise GPS coordinates — location, when you opt in, is resolved to a city and only the city is stored (see the Location section above).
• Advertising identifiers (we don't run ads).
• Biometrics, fingerprints, or face data.

03Why we collect it

• To run the service — store and play back your voice notes, deliver replies to the right user, keep your account signed in.
• To make voice content accessible — auto- generated transcripts let people read what was said, and AI-generated thread summaries help them decide whether to listen.
• To keep the platform safe — process the reports and blocks you submit, automatically scan voice transcripts and text comments for threats and other content that violates our Community Guidelines, screen uploaded media, and retain enough signal to detect users evading bans.
• To power local features — resolve your nearest city (if you opt in) so we can show you posts from around you and let you post to a city's feed.
• To improve the app — read crash reports, fix bugs, understand what features are actually used.
• To comply with the law — respond to valid legal requests, defend against fraud and abuse.

We do not use your data for advertising, sell it, share it with brokers, or use it to train large language models outside the scope described in section 4.

04Who we share it with

Yapp uses a small number of trusted infrastructure providers to run. Each one only sees the slice of data needed for its job. We do not share your data with anyone else for marketing or profiling.

We may also disclose information to law enforcement when compelled by a valid legal order in India. We will push back on requests that look overbroad.

05How long we keep it

• Account row — until you delete your account.
• Posts, yaps, audio, transcripts, images, video — until you delete them, or until our moderators remove them for breaking the Terms. Soft-deleted items are purged from active storage within 30 days.
• Backups — encrypted backups of the database are retained for up to 30 days for disaster recovery and then rotated out.
• Moderation records — reports and moderator actions are retained for 12 months after the related content is removed, so we can defend the decision if questioned.
• Ban-evasion signals — limited device and IP signals tied to banned accounts are retained for 24 months to prevent ban evasion.
• Server logs and crash data — up to 90 days.

06Your rights

Under India's Digital Personal Data Protection Act, 2023 (DPDPA), and as a matter of how we'd like to run this app regardless, you have the following rights over your data:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to fix data that's wrong. (Most of what we store is content you've created yourself, which you can edit or delete from inside the app.)
• Erasure — ask us to delete your account and the data associated with it. See the Account Deletion page for the exact process and what it does and doesn't remove.
• Portability — request a machine-readable export of your content (audio, transcripts, posts).
• Withdraw consent — stop using the service and delete your account at any time.
• Lodge a grievance — see section 11.

We will respond to verified requests within 30 days (often much faster). For account deletion, the standard processing window is documented on the deletion page.

07Security

• All traffic between the app and our servers uses HTTPS.
• The media bucket is private — audio, images, and video are only accessible through short-lived signed URLs issued by our backend after an auth check.
• Passwords are stored as salted hashes by Supabase and are never visible to us.
• Encrypted backups, restricted admin access, audit logs on moderator actions.

No system is perfectly secure. If a breach affects you, we will notify you and the relevant regulator as required by the DPDPA.

08Age & parental consent

Yapp is rated 12+ on Google Play. If you are under 18, you may use Yapp only with the consent of your parent or legal guardian — by creating an account you confirm that you are 18 or older, or that your parent or guardian has agreed to your use of the service. We do not knowingly allow anyone under 12 to use Yapp; if we learn of such an account, we will delete it.

India's DPDP Act treats everyone under 18 as a child and, once the DPDP Rules 2025 provisions on children's data take effect, will require verifiable parental consent (for example via DigiLocker). We are building toward those mechanisms ahead of that deadline; until then, the parent/guardian confirmation above is how consent is given. We do not serve advertising to anyone, and we do not behaviourally target children.

09Cross-border data transfer

Most Yapp data is processed and stored in India — auth, database, and media are all hosted in Mumbai (ap-south-1). A small number of narrow exceptions:

• Gemini (Google) — United States. Only transcript text and short prompts are sent. No audio, no identity information.
• Vercel / Firebase / Play / Google Sign-In infrastructure — United States. Standard web hosting, notification delivery, and Google account sign-in.
• Sentry — European Union. Only crash reports + diagnostic context (stack traces, device model, app version, current screen). Deliberately chosen in the EU rather than US for stronger data-protection guarantees on the bit of telemetry that does leave India.
• PostHog — European Union. Anonymous product-event pings (which screens get used, which features get tapped). No audio, no transcripts, no identity. Also deliberately EU.

By using Yapp you consent to this limited cross-border transfer for the purposes described above. We do not transfer data to any country the Indian government has notified as restricted under the DPDPA.

10Changes to this policy

We may update this policy as the service evolves. If a change is material — for example, adding a new processor or a new category of data — we'll surface it inside the app and update the "Last updated" date at the top of this page. The change will only take effect once you have had a chance to review it.

When you accept this notice inside the app, we record the version you accepted and when — that record is how we (and you) can prove what you agreed to, and it is kept even if you later withdraw consent.

11Contact & grievance officer