Privacy Policy

Effective and last updated: 23 September 2026.

This policy explains how personal information is handled when you use Yapaa. Yapaa is operated by Flowna Circuit Tech Limited ("Flowna", "we", "us", or "our"). For applicable data-protection laws, Flowna is the controller of personal information used to provide Yapaa unless this policy says otherwise.

1. Information we collect

• Account and profile: email address, authentication identifiers, username, display name, biography, profile photo, locale, timezone, and a private, self-declared birth date used to apply the 16+ eligibility requirement.
• Content and activity: daily answers, photos, reactions, mentions, Memories, streak activity, and the actions needed to provide answer-to-reveal.
• Connections: friend requests, accepted friendships, invitations, blocks, and related interaction history.
• Safety: reports, moderation records, the content snapshot associated with a report, and security or fraud signals.
• Device and service: platform, app version, push-notification token, notification preferences and quiet hours, coarse technical request data, reliability events, IP address, and product activity needed to operate and improve Yapaa.

2. Contact matching

Contact matching starts only when you choose to use it and grant device permission. Yapaa normalizes and one-way hashes email addresses on your device, then sends those hashes for matching. Your raw address book is not uploaded to Yapaa. You can remove contact permission in your device settings. Submitted matching values are used for the requested comparison and are not retained as an uploaded address book. Revoking permission prevents future matching; friendships already formed are unaffected.

3. How we use information

• create and secure accounts and provide authentication;
• deliver daily questions, mutual friendships, answer-to-reveal, reactions, mentions, streaks, and Memories;
• send communications according to your notification choices and quiet hours;
• provide support, enforce blocks, investigate reports, and prevent abuse or fraud;
• diagnose reliability issues and measure aggregated product performance; and
• comply with applicable law and protect people, rights, and the service.

4. Legal bases for EEA and UK users

Where these legal bases apply, we process information:

• to perform our contract, including authentication, friendships, answers, reveal eligibility, account functionality, and requested support;
• with consent, including device contact access and push-notification permission, where required;
• for legitimate interests, including service security, abuse prevention, safety, and proportionate first-party product analysis; and
• to meet legal obligations or, in exceptional cases, protect someone's vital interests.

5. How answers are shared

Yapaa is not a public social feed. Your current answer is available to you. An accepted, unblocked friend can see it only after answering the same canonical daily question. Before reveal, friends may see that you answered without seeing the answer itself. Blocking ends mutual access and notification eligibility.

Removing a friend prevents access to future answers but does not remove answers already revealed. If a person later deletes their account, their identifying profile and source content are deleted, while another person’s Memory may remain as a record of that other person’s own experience.

Yapaa administrators do not have a general browser for private answers. An authorised moderator can access the snapshot attached to a report when needed to review that report.

6. When information is shared

We share information only as needed in these circumstances:

• with the friends and recipients you choose, according to Yapaa's visibility rules;
• with service providers acting for us under appropriate contractual controls;
• to comply with law or a valid legal process;
• to protect a person, rights, safety, security, or the integrity of Yapaa; or
• as part of a corporate transaction, subject to appropriate confidentiality and notice where required.

7. Service providers

Yapaa currently relies on:

• Supabase for authentication, database, private media storage, and backend functions;
• Expo for app builds and push-notification delivery;
• Apple and Google for optional sign-in, device platform services, and push-notification delivery through APNs and Firebase Cloud Messaging;
• Resend for authentication and service email; and
• Vercel for Yapaa's website and restricted web administration service.

These providers process information only for the relevant service function and may publish their own privacy information. Supabase, Expo, Apple, Google, Resend, and Vercel may process information in the United States or other regions in which they operate.

8. No sale or behavioural advertising

We do not sell personal information. Yapaa does not currently show advertising or use personal information for cross-context behavioural advertising. We will update this policy and provide legally required choices before introducing such processing.

9. Age and teen privacy

Yapaa is for people aged 16 and older. Eligibility currently relies on the private birth date supplied during registration. Accounts do not have a public follower feed, and Yapaa does not publicly broadcast precise location. We use mutual connections, answer locks, blocking, reporting, and limited discovery to support a private-by-design service. See our Child & Teen Safety Policy.

10. International transfers

Our providers may process information outside your country. Where data-protection law requires safeguards for an international transfer, we use legally recognised mechanisms, which may include an adequacy decision, the EU Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, or the EU–US Data Privacy Framework for a certified recipient. We assess the circumstances and risks of restricted transfers.

11. Retention and deletion

• Account and profile information is kept while the account is active.
• Answers and photos are kept until you delete them or delete the account.
• Push tokens are removed when they expire, are revoked, or the account is deleted.
• A deletion request disables discovery, sessions, notifications, and protected content immediately. Covered personal profile and content data is purged within 30 days.
• Pseudonymised safety and audit records may be retained for up to 12 months where necessary and legally justified. Aggregated information that no longer identifies a person may be retained for longer.

See the Account & Data Deletion Policy for the exact request process.

12. Your choices and rights

You can manage notification settings, remove friends, block people, report content, delete answers, and request account deletion in Yapaa. A birth-date correction requires an audited support request.

Depending on your location, you may have rights to access, correct, delete, restrict, or object to processing; receive portable information; withdraw consent; and complain to your local data-protection authority. UK users may complain to the Information Commissioner’s Office, and EEA users may complain to their local supervisory authority. Email privacy@yapaa.co from the address associated with your account. We may verify your identity before completing a request. Where portability applies, you may request a machine-readable export by email and we aim to provide it within 30 days.

13. Security

We use safeguards designed to protect personal information, including encrypted transport, secure authentication, database access controls, restricted private-media access, least-privilege administration, secrets management, and security logging. No online service can guarantee absolute security. Where required, we will notify the relevant supervisory authority within 72 hours after becoming aware of a personal-data breach and will notify affected people when the breach is likely to create a high risk to their rights.

14. Changes to this policy

We may update this policy as Yapaa, our providers, or legal requirements change. We will identify the current effective date and provide appropriate notice of material changes.

15. Contact

Flowna Circuit Tech Limited is established in Nigeria. We are not presently required to appoint a Data Protection Officer; privacy matters are handled by our Data Protection Lead. For privacy questions or rights requests, contact us at privacy@yapaa.co or through yapaa.co.