Privacy Policy

Last updated: [DATE]

1. Who we are

Y (store name "Y: Friends, Dating & Chat", "Y" here) is an app for making friends, dating, private chats and spaces. It is run by WAALYX LLC, a limited liability company in Texas, USA ("we", "us"). We are the "controller" of the personal data described here.

Questions or requests: privacy@y.waalyx.com. [EU REPRESENTATIVE, if needed] · [UK REPRESENTATIVE, if needed] · [DATA PROTECTION OFFICER, if needed]

This policy covers the Y app for iOS and Android and our website at y.waalyx.com.

2. The short version

• We can't read your private messages. Personal chats, message requests, match chats, business chats and private spaces are end-to-end encrypted. Only the people in them can read them. Our servers only pass along scrambled data, and delete it once it's delivered (30 days at most).
• Public spaces are not end-to-end encrypted. We store them in a readable form, and the app says "Public space · visible to anyone who joins".
• Nobody sees your phone number, username, birthday or exact location. We store your phone number only as a scrambled code (a keyed hash) plus an encrypted copy. Your phone sends us only a rough area of about 5 km, never your exact position.
• Your Discover card shows your first name, age, photos, bio, interests, what you're looking for (Date, Friends or Both), and a rough distance (in 5 km steps, never closer than 5 km) or the city you picked. It never shows your gender or who you want to see.
• Photos and shorts are cleaned of location and other hidden data before anyone sees them.
• No ads, no tracking, no selling. We don't sell your data, share it for advertising, or track you across other apps and websites. There are no analytics or advertising tools in the app.
• You're in control. You can hide parts of your profile, turn things off, download your data by asking us, and delete your account.

3. What we collect, and why

3.1 Your account

3.2 Your profile

Photos and shorts are cleaned on our servers. When you upload a photo, we re-encode it, which removes all hidden data such as GPS location, camera model and date. Shorts are re-packaged so that all metadata (location, device, times, extra tracks) is removed, and we make a cleaned preview picture. The original upload is overwritten with the clean copy. Uploads you never finish are deleted after 24 hours.

3.3 Discover (meeting people for friends or dates)

Discover shows one person at a time. Everyone on Y is 18 or older. There is no separate dating mode: you choose what you're looking for, and it's on your card.

What a card shows: first name, age, photos and shorts, "Looking for", bio, interests, and a rough distance or city (§3.4). What it never shows: your username, phone number, birthday, last name, gender, "Show me", or where you are.

Dates are matched both ways. You and the other person must both be looking for Date or Both, each person's "Show me" must include the other's gender, and the person who likes must be inside the other's age range.

"I am" and "Show me" can reveal your gender identity and sexual orientation, which the law treats as sensitive data. We use them only to decide who can meet whom for dates, never for anything else, and never show them to anyone. "Looking for: Date" is on your card, so people who see your card know you're open to dates.

3.4 Location (optional)

• We ask for location only from the "See people near you" note in Discover, or when you choose "Near me" in Discover filters. Never at sign-up. You can pick a city or "Anywhere" instead.

• Your phone works out a rough area (a "geohash" cell about 5 km across) from a low-accuracy reading, and sends us only that area. Your exact location never leaves your phone.

• We store your current area and when it was set. We keep no history: a new area replaces the old one, at most once a day. An area older than 30 days is ignored.

• We use it to suggest people near you, for the "Near me" filter, and to show a rough distance on cards. Your area itself is never sent to other users.

• What others see: a distance worked out from the centres of the two areas, rounded in 5 km steps and never less than 5 km ("10 km away"), and only up to 50 km. Further away, your card shows the city you picked, if any. Your area changes at most once a day, so the distance can't be used to find where you are.

• Turn it off any time with "Stop using my area" (we delete it at once) or in your phone's settings.

• On Android the app asks only for approximate location.

3.5 Your phone contacts (optional)

• Only if you allow it, the app reads the phone numbers in your contacts (not names, emails or anything else) to show which of your contacts are on Y.
• Your phone sends the numbers as they are to our server, over an encrypted (HTTPS) connection. The server turns each one into the same keyed hash we use for phone numbers, compares the hashes, and throws the numbers away straight after. We never store your contacts' phone numbers, and contacts who aren't on Y leave no trace.
• We do store which Y users are in your contacts (a list of "you have this Y user in your contacts"). Each time the app checks your contacts again, the list is replaced by the new result, so people you removed from your contacts drop off. Turning off contacts access in the app deletes the list. We use it to show them in New Message and to put them first in Discover when you're looking for friends. It counts for nothing when you're looking only for a date. It is never shown to anyone, and the other person is never told.
• Only people who have "Find me by phone number" on can be matched.

3.6 Chats and private spaces (end-to-end encrypted)

What end-to-end encrypted means: your phone locks each message with keys that exist only on the phones in the chat. We never have those keys. We use MLS (Messaging Layer Security, the internet standard RFC 9420), through the open-source OpenMLS library.

This covers personal chats, message requests, match chats, business chats and private spaces, including their photos, voice notes, posts, comments, reactions, and a private space's name, description, photo and topic names.

• We can't read any of it. Our servers only store the scrambled data until every device in the chat has received it, then delete it. Anything not delivered is deleted after 30 days at most. If disappearing messages are on, it is deleted at the set time even if not delivered.
• Encrypted photos and voice notes are deleted from our storage 30 days after upload.
• Your chat history is kept only on your phone, in an encrypted database. If you lose your phone, we can't give it back.
• Notifications for these chats are fixed texts: "New message", "New message request", "New post", "Someone wants to connect" or "You both liked each other". They never contain the text or the sender's name. Our servers write them, not your phone.

What our servers still see (metadata). To deliver messages we have to see some information about them, but not what they say:

• who chats with whom, and whether a chat is a request, an active chat, a match, or a business chat;
• when each message is sent, its size, and which device sent it;
• which devices are in each chat or private space;
• delivery, read and typing signals (read ticks follow your settings), and when you are online;
• the disappearing-message setting of each chat;
• for private spaces: that the space exists, its type, owner, members and their roles, its topics (but not their names), and for each item, whether it's a post, comment, reaction or removal, and its topic (but not its content, which post it belongs to, or which emoji);
• for business chats: which customer is talking to which business, which team devices are in the chat, the chat's inbox status (New, Open or Done), who on the team is handling it, and when that changed (§3.12).

We keep the list of your chats (who, when started, when last active) for as long as your account exists.

3.7 Public spaces (not end-to-end encrypted)

Public spaces (broadcast or community) are not end-to-end encrypted. The app shows "Public space · visible to anyone who joins". They are encrypted on the way to us and stored on encrypted disks, but we can read them, and so can anyone on Y who opens the space.

We store: the space's name, description, photo and topics; posts, comments and reactions (with who wrote them and when); photos (cleaned as in §3.2); members and their roles; and what you've read (for unread dots). Notifications never include a space's name: they say only "New post" or "New comment on your post".

When a post or comment is removed, it's hidden at once and fully deleted 30 days later (kept that long in case it's reported).

3.8 Your devices and notifications

We don't collect your advertising ID, phone model, operating system version or IMEI.

A device that hasn't connected for 30 days is signed out automatically. A signed-out device's record is deleted 30 days after sign-out.

3.9 How you use Y

• Connections: friend requests, friends, and matches from a date like. Likes, passes and your last swipe in Discover (§3.3).
• Last seen: only if you turn "Last seen" on do we record when you were last online. Others see it only if both of you have it on. Turning it off deletes it.
• Active day: we keep the date (not the time) you last used the app, to put recently active people first in Discover.
• Blocks and reports you make (§9).
• Searches: what you type in search is used to answer the search and is not stored.

3.10 Technical data

• IP address: used only to protect sign-in and username checks from abuse (rate limits). We keep it for at most 1 hour for that and don't log it. Our hosting and network providers (§6) see IP addresses as part of running the service.
• Error reports: when the app crashes or hits an error, it sends a report to Sentry (§6): what went wrong, the screen, the app version, and the phone's model and operating system. Before it leaves the phone, we remove phone numbers, emails, ids, tokens and the private parts of web addresses. Reports never include your account, your IP address, what you typed or any message text, so we can't connect a report to you.

3.11 When you contact us

If you email us, we keep the email and our reply to help you, for [2 years].

3.12 Businesses and their teams

A creator, shop or company can turn a public space into a business, with an inbox for customer chats and a team.

Inviting someone to a team:

• By username: we store the invite and who sent it.
• By phone number: we store only a keyed hash of the number (the same kind as in §3.1), never the number itself. If that number has, or later gets, a Y account, the invite shows up for them. The team list shows "Phone number", never the digits.
• By invite link: we store who asked to join, and whether an owner or admin approved them.
• The invited person gets a notification that doesn't name the business ("You're invited to join a business team"); the app shows the name.
• An invite stops working after 14 days, or when it's accepted, declined or cancelled.

4. Our legal reasons (for people in the EU and UK)

5. How we use your data, and how we don't

We use it to: run Y and its features; choose and order Discover cards; send codes and notifications; keep Y safe (rate limits, reports, bans, child abuse checks); answer your questions; and follow the law.

We don't:

• sell or rent your personal data, or "share" it for cross-context behavioural advertising;
• show ads, or use advertising or analytics tools in the app;
• track you across other companies' apps or websites;
• use your messages, photos or posts to train AI models;
• make decisions about you with legal or similarly significant effects by automated means only. (Discover's ordering is automatic, but it only decides who you see first.)

6. Who we share it with

Other users see what §3 says they can see.

Service providers process data for us, under contract, only to run Y:

For safety and the law. We report child sexual abuse material to the US National Center for Missing & Exploited Children (NCMEC), as US law requires, with the information the law asks for (which may include the uploader's account details and IP address). We may also share information with police or other authorities when the law requires it, or when we believe in good faith that it's needed to prevent death or serious harm. We can only share what we have: we can't hand over end-to-end encrypted messages.

If Y is sold or merges with another company, your data may move to the new owner, who must keep this policy's promises. We'll tell you first.

7. Moving data between countries

Our providers may store or process data in the United States and other countries. When data leaves the EU or UK, we use the European Commission's Standard Contractual Clauses (and the UK addendum), or the EU–US Data Privacy Framework where the provider is certified.

8. Child safety checks

• Profile photos (including the photos shown on Discover cards), photos in public spaces and on business pages, and shorts are checked against known child sexual abuse material when you upload them, before anyone can see them. The check runs on our own servers: we compute a fingerprint of the image (and of the file) and compare it with lists of fingerprints of known material from child-protection organisations such as NCMEC. The image itself isn't sent to anyone for this. For shorts we check the preview picture and frames taken every 2 seconds. A match is blocked, the account is frozen, we keep the file and account details as the law requires, and we report it to NCMEC.
• Photos sent with a report are checked too. When you report something, any photo you send with it (§9) is checked the same way before our safety team sees it. A match never counts against the person who reported it.
• End-to-end encrypted chats and private spaces are never scanned, because our servers can't see them. The only exception is a photo someone chooses to report: their phone sends us a readable copy of that one photo with the report, and we check it the same way. Otherwise we rely on reports from the people in them (§9).

9. Reports and blocks

• When you report something in an end-to-end encrypted chat or private space, your phone sends us a copy of only the item you report (for example the message, who sent it and when), and the reason you picked. The app tells you before it sends. We never get the keys to the chat. If the item is a photo, the copy is checked for child sexual abuse material like any other upload (§8).
• For reports in public spaces or about a profile, we look at the content we already have.
• The person reported is never told who reported them.
• We keep reports and what we decided for 1 year after the case is closed, to handle appeals and repeat abuse. When we ban an account, we keep the banned phone number as a keyed hash so the person can't sign up again, for 2 years.
• When you block someone, we store that you blocked them until you unblock them or one of you deletes their account. They aren't told. Neither of you can see or find the other, and messages between you stop.
• If we warn you, we tell you in the app. We never say who reported it.

10. How long we keep it

11. Deleting your account

• In the app: Settings › Delete account, confirmed with an SMS code. Without the app: y.waalyx.com/delete-account (your phone number or email, and a code we send there).
• Spaces you own pass to the space's longest-standing admin. A space with no admin is deleted.
• Chats with you are closed for the other people, who see "Deleted account". Once nobody is left in a chat, we delete it completely.
• You're signed out on every device at once, and nobody can see or find you.
• Within 30 days we delete your profile, photos, shorts, phone number, email, birthday, "Looking for", "I am", city, Discover filters, likes and passes, location area, settings, team memberships and invites to you, devices, keys and push tokens, your public posts, comments and reactions, public spaces you own that had no admin to take them over, your contact matches (and other people's matches of you) and connections, and any scrambled messages still waiting for delivery.
• What stays: messages already delivered stay on the phones of the people you sent them to (we can't reach them). We keep what §9 says about reports and bans, and anything the law requires us to keep (for example an NCMEC report), for as long as required.
• Backups: our database provider keeps point-in-time backups for [7–35] days. Deleted data disappears from them when they roll over.

12. How we protect your data

• End-to-end encryption (MLS) for private chats and private spaces; keys stay on your phone in its secure storage (Keychain / Keystore).
• HTTPS for everything between the app and our servers.
• Phone numbers stored only as keyed hashes plus an encrypted copy; sign-in tokens stored only as hashes.
• Encrypted databases and storage at rest; daily backups.
• Private file storage; photo links expire after 1 hour.
• The API is tested so it never sends anyone's username, phone number, email, birthday, location or age to other users.
• Rate limits on sign-in and other actions.

No system is perfectly secure. If a breach affects your personal data, we'll tell you and the authorities as the law requires.

13. Your rights

You can, any time:

• see and change your profile and settings in the app;
• change what you're looking for (Date, Friends or Both), or remove "I am" and your city;
• turn off location, contacts, notifications, "Find me by phone number" and "Show me in Discover";
• delete your account (§11).

You can also email privacy@y.waalyx.com to ask us to:

• give you a copy of your personal data (we can't give you your encrypted messages: only your phone has them);
• correct or delete it;
• limit or object to how we use it;
• move it to another service (portability);
• withdraw consent where we rely on it (this doesn't affect what we did before).

We answer within one month (GDPR / UK) or 45 days (California). We may need to check it's you first, for example by sending a code to your phone number.

EU and UK: you can also complain to your local data protection authority (for example the ICO in the UK).

California and other US states: you have the right to know, delete, correct, and opt out of the sale or sharing of personal information, and to limit the use of sensitive personal information. We don't sell or share personal information (as those laws define it), and we use sensitive personal information (your account sign-in details, and "I am" and "Show me", which may reveal your gender identity or sexual orientation) only to provide the service. We won't treat you differently for using your rights. You can use an authorised agent.

14. Children and teenagers

• Y is only for adults (18 and older). We ask for your birthday at sign-up and don't let anyone under 18 create an account. If we learn that someone under 18 has an account, we close it.
• If you think someone under 18 is using Y, tell us at safety@y.waalyx.com, or report their profile in the app.

15. Changes to this policy

We'll update this policy when Y changes. If a change is important, we'll tell you in the app before it applies. The date at the top shows the latest version.

16. Contact

WAALYX LLC (Texas, USA) Privacy: privacy@y.waalyx.com · Help: support@y.waalyx.com · Safety: safety@y.waalyx.com

In the app: report a person, message, post or space from its ⋮ menu › Report. Help pages: y.waalyx.com/support.