Privacy Policy

Last updated: 9 August 2026

The short version: we collect what a chat app needs to work, we do not sell it, there are no ads, and most of what you share is only visible to the people you share it with.

What we collect

• Account: email address, username, display name, and a hash of your password (Argon2id — we never store the password itself).
• Content: the messages, media, reactions and profile details you create. Messages are stored so they can be delivered and so your history syncs across sessions.
• Technical: device platform and app version per session (shown to you in your session list), IP addresses in security logs, and push-notification tokens if you enable notifications.

We do not ask for your phone number or your contacts.

Who can see what

• Messages are visible to the members of the conversation they were sent to. Group avatars, titles and public-group listings are visible to anyone who can find the group.
• Your profile (name, avatar, bio, badges) is visible according to your privacy settings, which you control in the app — including who can DM you, add you to groups, call you, or see when you were last online.
• Bots in a conversation receive the messages sent in it, like any member. Bots are always labelled.
• Our staff can see reported content — a report freezes a copy of the reported message and its immediate context so moderation works even if the sender deletes it. Staff actions are audit-logged.

What we do with it

Run the service. That is the whole list: delivering messages, syncing devices, sending the notifications you asked for, preventing abuse, and keeping the service secure. We do not sell personal data, we do not share it with advertisers, and we do not use your messages to train anything.

Where it lives

Data is stored on our servers (currently in the EU). Traffic is TLS in transit. Passwords are hashed with Argon2id; bot credentials are stored only as hashes; access tokens are short-lived.

Retention and deletion

• Deleting a message removes it for everyone in the conversation; a tombstone keeps the slot so history stays coherent.
• Deleting your account removes your profile and personal details. Your username stays reserved so nobody can impersonate you afterwards.
• Security logs and moderation records are kept as long as needed for their purpose, then removed.

Children

yappy is not for children under 13, and we remove accounts we discover that belong to them.

Changes and contact

Material changes to this policy are announced in the app before they take effect. Questions, or a data request: privacy@yappy.gg.