Privacy Policy
Yaply is a questions game you play with people you know. You send someone a card, you both answer, and the two answers open together. To make that work we have to keep some of what you write and record on our servers until the other person has seen it, and for as long as you want to look back at it. This page says what we keep, why, who helps us run it and how you get rid of it.
Yaply is made by Lumira Labs Ltd, a company registered in England and Wales (company number 17138788). We're the controller of your personal data under UK data protection law. You can reach us at yaply@lumiralabs.co.uk.
What we collect
When you sign in with Apple, Apple gives us a private account ID for you and, if you choose to share it, an email address. Many people pick Apple's "Hide My Email" option, in which case we only ever see a relay address. We also keep the name you choose to show in the app and the age range you confirm when you start (we ask for a range, never a date of birth).
Then there's what you make in the app. That means the questions you send, your written answers, voice recordings, the short notes and finger drawings you send to someone's widget, reactions, decks you write yourself, and what you answer in a room. If you record an answer, the words are turned into text on your phone by Apple's speech recognition, and that text travels with the recording so the other person can read along.
We keep a record of who you're connected with (the people who used your code, or whose code you used), anyone you've blocked, and any report you make. To send notifications and update widgets we store your device's push token.
Some things never leave your phone: photos you add for people, people you ask in person and whose answers you write down yourself, how you've organised your Shelf, and your settings.
What we don't do
There are no ads in Yaply and no advertising or analytics companies inside the app. We don't track you across other apps or websites, we don't sell your data, we don't use your answers or your voice to train AI models, and we don't clone voices.
Payments
Yaply Plus is bought through the App Store. Apple takes the payment, so we never see your card or bank details. The app asks Apple whether you have an active subscription so it can open the Plus decks, and Apple tells us about the purchase itself (product, date, renewal), not about you.
How we use it, and why we're allowed to
Almost everything above is used for one reason: to run the game you've asked to play. We deliver your card to the person you chose, hold both answers until they open, keep them on your Shelf, send the notifications you've switched on and put notes on the widgets they're meant for. The legal basis for that is our contract with you, which is the Terms of Use.
We use reports, blocks and limited logs to keep people safe, stop abuse and fix things that break. That's our legitimate interest in keeping Yaply working and safe, and we keep it to what we need. Microphone, speech recognition, camera (for scanning a code) and notifications are only used once you've allowed them on your phone, and you can turn any of them off in Settings. If the law requires us to keep or share something, we will, and only that.
Who can see your answers
Only the people you play with. A card you send can be read by you and the person you sent it to. Answers in a room can be seen by the people in that room. A note goes to the one person you sent it to. Nobody can browse Yaply for strangers, and nobody hears from you unless you've shared a code with them or used theirs.
Who helps us run Yaply
Supabase stores accounts, cards, answers, recordings and notes for us. Our Supabase project is hosted in Ireland, in the EU. Supabase is a US company, so its data processing agreement includes the international transfer terms UK law asks for. Apple handles Sign in with Apple, App Store payments and the push notifications that reach your phone. Cloudflare hosts this website. It doesn't hold your account or anything you've made in the app. Each of them only processes data to provide their service to us.
How long we keep it
Your account and what you've made stay until you delete them. You can delete an answer, unsend a note or block someone at any time. Delete Everything in Settings removes your account and the cards, answers, recordings and notes that belong to it, including copies the other person could still see. If you've reported someone, the report stays so we can act on it, but without your name on it. Deleted data can take up to 30 days to leave our backups.
Your rights
You can ask for a copy of your data, ask us to correct it or delete it, object to how we use it, or ask us to limit it. The quickest copy is Download Everything in Settings, which saves your answers and recordings to your phone. For anything else, email yaply@lumiralabs.co.uk and we'll reply within a month. If you're unhappy with how we've handled your data you can complain to the Information Commissioner's Office at ico.org.uk, or to the data protection authority where you live.
Age
Yaply is for adults aged 18 and over. Some decks are explicit and stay off until you switch them on. If we learn that someone under 18 has an account, we'll delete it.
Security
Everything travels between the app and our servers over encrypted connections. Each account can only read the cards, answers and notes it's part of, and recordings are kept in private storage that needs a signed, short-lived link to play. No system is perfect, and if something went wrong that affected you, we'd tell you.
Changes
If we change this policy we'll update the date at the top, and if the change matters to how your data is used we'll tell you in the app first.