Privacy Policy

This Privacy Policy explains what information YO Voice ("we", "us") collects when you use yovoice.app and the YO Voice apps, why we collect it, and the choices you have. YO Voice is the controller of the personal data described here.

The way to reach us about privacy — including any request about your data — is privacy@yovoice.app.

This policy describes what the product actually does today. Where a feature does not exist yet, or exists only in part, we say so instead of describing it as if it were finished.

YO Voice is a voice-first social product built around Servers — persistent spaces that hold live voice and video conversations alongside text channels. A Server is created from one of five templates: Friends, Community, Podcast, Family or Company.

The other parts of the product are Home, Chats (direct messages), Friends, YO Moments, your Profile, creator tools and Settings. YO Moments holds two content formats: Voice Moments, which are audio posts, and Yeels, which are media-first video or photo posts.

Anyone signed in can join a public Community or Podcast Server without an invitation and talk to people they don't know there. Friends and Company Servers cannot be public, and Family Servers are always invite-only.

Earlier versions of this policy described standalone Rooms and Clubs. Those are retired surfaces — Servers are the only shared space in the product today. Some of the older names survive inside our database as compatibility contracts, but they are not separate products and are not described here as such.

Account and profile. An email address, and a password held by Firebase Authentication — we never see or store your plaintext password. You can instead sign in with Google or with Apple. Google returns your name and email address, and a link to your Google profile photo, which Firebase Authentication stores on your sign-in record. Apple returns only your name and an email address — which may be a private relay address if you choose that — and no photo. Neither provider's photo becomes your YO Voice profile picture; you upload that yourself. Verifying your email address is a real gate, not a banner: our servers check it before letting an account create content. Two-factor authentication using an authenticator app is optional; the enrollment secret is discarded once the first code is accepted.

When you create an account, we record which version of our Terms of Service you accepted and when. Nothing else is stored with it — no email address, device or IP address. We keep this record so we can show which Terms apply to your account; if you accept a newer version, it replaces the older one, and the record is deleted together with your account.

Your profile holds a display name and a username. You choose the username when you register with an email address; for a Google or Apple sign-in we derive a starting one from the name or email address that provider gives us. The fields you may add if you want them are a bio, status line, country, native, spoken and learning languages, a website link and a profile photo. Country and languages are text you type about yourself — they are not read from your device. We also keep counters produced by using the product: messages sent, voice and hosting minutes, active days, reactions, Moments posted and the achievement titles you have unlocked.

If you turn on the Creator audience, we ask for your date of birth to confirm you are an adult. That date is used for the calculation and is never written to our database, to a log or to any public profile. All that is kept is the fact that the check passed, when it passed, and that the method was a self-declared birth date.

Content you create. Depending on what you use, this can include:

• Photos — profile artwork, Server and session covers, Family memories, images in a Yeel, and photos you attach to a direct message (JPEG, PNG or WebP).
• Videos — Yeel videos, Family memories and videos you attach to a direct message (MP4, QuickTime or WebM).
• Voice and sound recordings — Voice Moments, voice replies, voice comments on a Yeel, and voice notes in a direct message.
• Music and other audio files — when you compose a Yeel you can pick an audio file from your device to use as backing audio. That file is uploaded and stored with the Yeel.
• Files and documents — on a Company Server, members can upload files to a channel: PDFs, plain-text files and images.
• Other text you write — your bio and status line, the name and description of a Server you create, Yeel captions, and the reason and any note you add when you report content.

Messages. We store the messages you send: direct messages, including reactions, edits and read state; messages in Server and channel conversations; session chat; and comments on Voice Moments and Yeels. Direct messages are written by our servers rather than directly by the app.

Live voice, video and screen share. When you join a live session, your device streams audio, video, screen share and related data through our real-time infrastructure to the other participants. We do not record or store those live streams. The access token our server issues never carries a recording permission, and no recording service is deployed. To route the session, your account identifier travels as the participant identity, together with your display name and your role in that session.

Activity and viewing history. Friends, follows, blocks and mutes, Server memberships, likes, achievements, presence and last-seen, participation in live sessions, hand raises, event responses, Family check-ins and poll votes. We also keep a record of the calls you place or receive in Chats — who was on the call, when it started and ended, and whether it was answered or missed. We do not record the call itself. And we record which Voice Moments and Yeels your account has played, so the feed can avoid showing you the same thing again. That viewing history is readable only by your own account.

Search is handled differently: what you type into GIF or profile search is not stored against your identity. GIF results are cached under a hash of the search text with no account identifier attached, and rate-limit counters are kept under a hash of your account identifier.

Device and push identifiers. Once you allow notifications, we store one record per device holding a push notification token, the platform it belongs to and a timestamp. Notification text is built from the name of the person who acted plus, where relevant, the name of the space or channel — the body of your message is never put into a push notification. The one exception is a post by a Page you follow: a Page post is public to every signed-in member, so that notification shows the post's first line (at most 120 characters). It is removed from your notifications in the app when the post is deleted or taken down; a push your device has already shown is not withdrawn. To write notifications in your language, we store the language your app is shown in on your account; it is not shown to other people. The apps also run Firebase App Check, which produces a device attestation and a Firebase installation identifier: on Android the attestation comes from Google Play Integrity, and on iPhone, iPad and Mac from Apple's App Attest with a DeviceCheck fallback. On the web app this check is not enabled.

Crash logs and diagnostics. The app uses Firebase Crashlytics. In every released build, an uncaught error sends a stack trace together with your device model and operating system version to Google so we can find and fix it. There is currently no in-app switch to turn crash reporting off. Crashlytics does not run on the web app or in development builds. Separately, when a server call is refused, the app reports that refusal as a non-fatal diagnostic event, and our servers log identifiers such as a conversation, message, sender or recipient id together with the outcome — never the contents of a message.

Bug reports. If you choose "Report a bug" in the app, we receive the description you write, your YO Voice account ID, and technical details about the app and device: app version and build, platform and operating-system version, language, theme, screen size and text size, and the name of the screen you were on. If you choose to attach a screenshot, we also receive that image, which may show anything that was on your screen, including other people's names, photos or messages; you see it full size and decide before it is sent. A bug report never collects your messages or calls, except what is visible in a screenshot you choose to attach.

What we do not collect. YO Voice contains no advertising and no ads SDK, and does not use the Android advertising identifier — the permission needed to read it is not in the app. There is no analytics SDK of any kind. We do not collect your location: the app requests no location permission and contains no location library, and the one feature that could plausibly carry coordinates — a Family check-in — is refused by our servers if it contains any. We do not collect your contacts, phone number, SMS, calendar, health or fitness data.

• To create and operate your account, sign you in, and confirm your email address before an account can post.
• To run the product itself: Servers, channels, live voice and video, chats and YO Moments.
• To send transactional email — address verification and password resets.
• To deliver the push notifications you have opted into, by type.
• To rank the YO Moments feed, so something you have already watched is not shown to you again.
• To detect and prevent abuse: rate limits, reports, blocks and mutes, and moderation of content that breaks our Terms.
• To keep the service reliable and to debug failures, using crash logs and diagnostics.
• To investigate and fix problems you report to us.

We do not sell your personal information, we do not show advertising, and we run no analytics SDK. We share data only with the providers that operate YO Voice for us, acting on our instructions:

• Google Firebase — authentication, database (Firestore), file storage, backend functions, push delivery (Cloud Messaging), crash reporting (Crashlytics) and app attestation (App Check).
• LiveKit Cloud — real-time infrastructure carrying live audio, video, screen share and session data. It receives your account identifier as the participant identity, your display name, and your role in the session. It also sends signed session events back to us so voice and hosting minutes can be credited.
• Resend — delivery of transactional email. It receives the recipient address and the verification or password-reset link.
• Vercel — hosting for yovoice.app, which means website request metadata.
• Apple — Sign in with Apple, if you use it, and the device-attestation check on iPhone, iPad and Mac.

Bug reports are stored in Google Firebase and read only by the YO Voice owner in our internal tools. No notification about a report is sent to any other service today. If we switch on report notifications, Resend may send our team a short notice containing only the report's reference number, the app version, the platform and the name of the screen — never your description, your screenshot or your account ID.

GIFs offered in the app today are first-party animations that ship inside the app itself — searching for one never sends your search text to an outside GIF service. Older messages may still contain a GIF hosted by an external provider; opening such a message loads the image from that provider, which sees your IP address. You can stop that by turning GIF auto-loading off in settings.

We may also disclose information where we are required to by law, or where we believe it is necessary to protect the safety of our community.

Other members see what you choose to make visible: your profile, the messages you post in the spaces you join, and your presence status. Anyone who can open a public Community or Podcast Server can see what is posted in it.

Who liked. Everyone who can see a Voice Moment, Yeel, comment or Server message can see how many likes or reactions it has, and anyone who can open a Voice Moment also sees up to three recent likers under it. Members with YO Voice Premium, or with a VIP status we have granted, can open a list of people who liked or reacted to content they are able to see. These lists never include people they have blocked or who have blocked them, accounts whose profile is private or limited to friends they are not friends with, restricted, suspended or deleted accounts, or anyone who has turned on Hide my likes in Settings; the counts do not change. Reactions in Server channels are stored with the message, so the apps of members who can read that channel receive which account reacted with which emoji, whatever these settings say.

Optional public website showcase. If you explicitly opt in from YO Voice settings, we may publish your display name, profile type and a short "Active recently" label on yovoice.app. We do not publish your user ID, username, last-seen time, email, avatar URL, staff role or social graph. Separately, the owner of an eligible public community space can opt that space into showing its name and current member count; private, invite-only and Family spaces are never eligible. It is off by default, and it can be switched off again from settings, which records the withdrawal — we keep a small record that says the setting is off, with the time it changed, and it is deleted when the account itself is deleted. While the showcase is on, it is visible to the public internet, including signed-out visitors and people whose accounts you have blocked.

Staff and moderation. Inside YO Voice, a small number of people holding a moderator or administrator role can open a report and the content it points at, and can see account state — such as whether an account is banned — in order to act on it. Those actions are written to an internal audit log. Reports keep a copy of the reported message's text as it was when it was reported, so a moderator can still judge it after the message is deleted.

Premium is not available for purchase yet — not in the apps and not on the website. There is no store billing on either platform and no checkout is deployed, so YO Voice collects and processes no payment data at all: no card number, no bank or payment-method details, no billing address. If that changes, we will update this policy before any payment can be taken, and describe exactly what the payment provider receives.

Your account information, profile, messages, uploaded media and activity history are kept for as long as your account exists. We do not currently enforce a fixed deletion period for them, and we would rather say that plainly than quote a period we do not apply.

One exception. The record of which Yeels you have watched carries a built-in expiry, and our database deletes each row automatically about 90 days after that view. The equivalent record for Voice Moments has no expiry and is kept while your account exists.

Reports keep a copy of the reported message's text as it was when it was reported, so a moderator can still judge it after the message is deleted.

Crash logs and diagnostics sit in Firebase Crashlytics and Google Cloud Logging and are kept under those services' own retention settings.

Bug reports are kept for up to 180 days and screenshots attached to them for up to 90 days, then deleted automatically. We can delete a report or its screenshot sooner if you ask at privacy@yovoice.app. If we switch on the report notifications described in section 5, those short notices stay in our team mailbox under its own retention; they contain no description, screenshot or account ID.

What happens when an account is deleted — what goes, what we keep and why — is described in the next section and on our account deletion page. The next section also covers deleting a Page, which has its own 30-day, 90-day and 7-day periods.

There is no self-service account deletion in the app yet: you ask us by email, and we carry the deletion out by hand. The same lists, written for someone who is not signed in, are on our account deletion page.

How to ask.

• In the YO Voice app. Open Settings, then Delete account. The screen sets out what is removed and what we keep. While self-service deletion is being switched on it does not delete the account by itself — it offers the email route to privacy@yovoice.app with the subject "Delete my YO Voice account", which reaches us the same way as the address below. support@yovoice.app still reaches a human too.
• On this website. Sign in and open /account/delete. The page sets out what deleting your account removes and what we keep, and sends your request to us. It cannot delete the account on its own yet. If your account signs in only with Google or Apple, you can still sign in here and send the request by email.
• By email. Write to privacy@yovoice.app from the address on the account, with the subject "Delete my YO Voice account". This route works for every account, including one created with Google or Apple sign-in. We may need to verify that the account is yours before we act.

Mail sent to support@yovoice.app reaches a person too, so a request you have already sent there is not lost. We may need to verify that the account is yours before we act, and deletion is permanent — we cannot restore an account or its content afterwards.

Every request is carried out by hand. One step is automatic: deleting the sign-in account immediately removes the public profile, presence, public badges, member-directory entry and website-showcase consent. Everything else on the list above — messages, uploaded media, push tokens, notifications, friends and followers, viewing history, Voice Moments, Yeels and Server content — is removed by a person, after we have checked that the account is yours. We aim to finish within 30 days of that check, and it is normally much sooner. Tell us in your email if there is anything in particular you want removed first.

We are not going to promise you an erasure that our systems do not currently perform. The one automatic step is this: when a sign-in account is deleted, our servers remove the public profile, the presence record, the public badges, the member-directory entry and the website-showcase consent, and clear premium messaging-privacy state. Everything else on the list below is done by a person, which is why a request can take days rather than minutes.

What deletion removes.

• Your sign-in account itself — the email address, the password, any Google or Apple link, and any authenticator app you enrolled.
• Your profile: display name, username, bio, status line, country, languages, website link and profile photo, and your entry in the member directory.
• The Voice Moments and Yeels you posted: their captions, the comments, likes and reactions people left on them, and the photos, videos, audio and files behind them.
• What you uploaded into your own account: profile artwork, the Server and session covers you own, and the media you attached to a message.
• Your friends, followers, the people you follow, your blocks and mutes — including the matching entry held on the other person's side.
• Your record of which Voice Moments and Yeels you played, your notifications, your push notification tokens and your device records.
• Your achievement progress and titles, your counters, your presence and last-seen, and your public website showcase consent.
• The bug reports you sent from the app, and any screenshots attached to them.
• Your name and photo inside every Server you were a member of, so the membership that remains carries nothing about you.
• The name shown on a Server you own. The Server itself keeps running under an anonymous owner until we transfer or close it — tell us in your request if you want it closed.

What we keep, and why. Some records are not ours alone to erase — they are another person's safety history, or an obligation we carry. This is the whole list, and each entry says why it is kept:

• Until your request has been carried out, your private account record stays in our database, marked deleted and disabled. It still contains your email address, display name, username, bio, country, languages, notification preferences and your counters. This is the one automatic step that runs the moment a sign-in account is deleted: it removes your public profile, presence, public badges, member-directory entry and website-showcase consent, and deliberately keeps the private record so that the rest can be finished by hand. It is deleted when your request is complete.
• Reports you filed about someone else, with the reporting account replaced by an anonymous marker. They are the record of something that happened to another person. If deleting an account erased the reports it filed, deletion would become a way to destroy the evidence of harassment against somebody else.
• Reports other people filed about you, and any moderation decision taken on your account. Safety history, and our ability to defend a decision that was challenged. Once your profile and directory entry are gone, what remains is an account identifier that no longer resolves to a person. Reports keep a copy of the reported message's text as it was when it was reported, so a moderator can still judge it after the message is deleted.
• Our internal staff audit log of moderation actions. An audit trail that the person it concerns can erase is not an audit trail. It records what our staff did, not what you posted.
• Server-side logs and crash diagnostics held by Firebase Crashlytics and Google Cloud Logging. Security and debugging. These lines hold identifiers and error traces, never the contents of a message, and they expire under those services' own retention settings rather than ours.
• Messages you sent in a one-to-one conversation stay in the other person's copy of that thread. The photos, videos, voice notes and files you sent are deleted. A conversation is also the other person's record of something they took part in. We do not rewrite their history, and we do not keep your uploaded media after you leave.

What deletion does not do.

• We have no export tool. If you want a copy of your data before it goes, ask in the same email and it is put together by hand.
• Deleting a chat only for yourself is a separate control inside the app. It does not delete your account.
• Deleting your account does not delete a message someone else wrote, or a Server that somebody else owns.
• A comment or a reaction you left on somebody else's Voice Moment or Yeel stays under their post. Ask us in the same email and we remove those by hand.
• A file you uploaded into a Server that somebody else owns — a Family memory, or a file in a Company channel — stays with that Server. Ask us and we remove it by hand.
• A cover image you set on a live voice session, and a podcast episode published on a Server, stay where they are: neither is filed under your account, so the automatic deletion cannot find them. Ask us in the same email and we remove them by hand.
• A call record in a chat — who was on the call, when it started and ended — stays in the other person's chat.

Deleting a Page. If you run a Page, you can delete it from the Page's settings without deleting your account. The Page is paused and hidden from other people straight away, and kept for 30 days, during which you can restore it. You can also end the wait and delete it at once, after signing in again. When the Page is deleted, its posts, its followers and the contact details on it are removed; your account, profile, friends, chats, Servers, Voice Moments and Yeels stay. Posts that were reported, or held or removed by our moderators, may be kept for up to 90 days, not publicly visible, so that open reports can still be handled. We keep a small record of the deletion, and you cannot create a new Page for 7 days; if the Page had been suspended, that record is kept until you next create a Page, so that deleting and re-creating a Page does not lift a suspension. You can also delete all of a Page's posts and keep the Page and its followers.

Inside the product you can, at any time:

• Edit your profile information from your account settings.
• Set your profile visibility to public, friends only or private. Choosing anything other than public also withdraws the public website showcase consent described in section 6, in the same step.
• Turn on Hide my likes to be left out of the lists of who liked or reacted that YO Voice shows; counts do not change, and reactions in Server channels still reach the apps of members who can read that channel (see "What other people can see").
• Set your availability — available, be right back, do not disturb, or invisible. Invisible is published to everyone else as plain offline, so it cannot be told apart from being signed out.
• Change or disable individual notification types.
• Choose who may send you a direct message — everyone, people you follow, friends, or nobody.
• Block or mute another member.
• Turn the optional public website showcase on or off.
• Turn GIF auto-loading off, so a GIF hosted outside the app is not fetched from its provider until you tap it.
• Review the device you are signed in on, and sign out everywhere, from Devices & sessions.
• Turn on two-factor authentication with an authenticator app.
• Report content or behaviour to us.

Under the GDPR you also have the right to access your personal data, to have it corrected or erased, to restrict or object to how we use it, and to data portability. To exercise any of these, email privacy@yovoice.app. We may need to verify your identity first. These requests are handled by hand: as noted above, we have no automated export or erasure pipeline, and the limits described in section 9 apply to erasure.

You must be at least 13 to use YO Voice, or older where your country requires it — see our Terms of Service. YO Voice is not directed at children under 13, and we don't knowingly collect personal information from children under 13. If you believe a child has created an account, contact us at privacy@yovoice.app and we'll remove it.

Data is encrypted in transit. The Android app refuses cleartext traffic outright, and the app connects only to the exact production address of our real-time infrastructure, with no credentials, custom port, path or query accepted in its place. Live audio and video travel over WebRTC's own encrypted transport. This is not end-to-end encryption — our infrastructure carries the media, and we do not claim otherwise.

Access to your data in our database is governed by server-enforced security rules scoped to your account: your private records are readable only by you, uploads must match a server-issued reservation, and the fields a client may write are fixed by an explicit allowlist rather than left open. Sensitive operations run through bounded server endpoints with validation and rate limiting.

No system is perfectly secure, but we design defaults conservatively and review access rules as the product changes.

We'll update this page when our practices change and update the "last updated" date above. For material changes, we'll make a reasonable effort to notify you by email or in-app notice.

Questions about this policy or your data? Email privacy@yovoice.app. See also our Cookies Policy and Terms of Service.