Privacy Policy

Last updated: 18 May 2026

This Privacy Policy describes how yapsa ("we", "our", or "us") collects, uses, and protects information when you use the yapsa iOS application and associated services (collectively, the "Service").

1. Who We Are

yapsa is operated by Timotheus Scherer, based in Switzerland. If you have questions about this policy, contact us at privacy@yapsa.xyz.

2. The Core Privacy Principle

yapsa is designed around end-to-end encryption (E2EE). We cannot read, view, or access the photos and videos you share through the app. All media is encrypted on your device before it is transmitted to our servers, and can only be decrypted by the members of the specific Moment you share it with.

3. Information We Collect

3.1 Account Information

When you register, we collect:

Email address — used to identify your account and communicate with you.
User ID — a unique identifier assigned to your account.

3.2 Media Content

Photos and videos you upload are:

Encrypted on your device using AES-256-GCM before transmission.
Stored on our servers in encrypted form only.
Inaccessible to yapsa staff or the operator.
Associated with your account for the purpose of delivering them to Moment members.

3.3 Usage Analytics

We use PostHog (hosted in the EU at eu.i.posthog.com) to collect anonymous product interaction events, including:

Moment created
Gallery viewed
Photo upload completed
Photo deleted
Moment left
Invite created / joined

Analytics events include internal Moment IDs (UUIDs) but do not include your email address, your name, or any photo content. Analytics data is not linked to your identity.

3.4 Device and Technical Data

Standard server logs may include IP addresses and request timestamps for security and abuse prevention. These are retained for up to 90 days and are not used for advertising or tracking.

3.5 Data We Do Not Collect

Location data
Contacts
Browsing history
Device identifiers for advertising
Biometric data

4. How We Use Your Information

Purpose	Legal basis (EU/UK)
Providing the app and delivering your encrypted photos to Moment members	Performance of contract
Account authentication and security	Legitimate interest
Detecting and preventing abuse	Legitimate interest
Improving product functionality via anonymised analytics	Legitimate interest
Responding to legal obligations	Legal obligation

We do not sell your data, use it for advertising, or share it with third parties for marketing purposes.

5. Third-Party Services

Service	Purpose	Data shared	Privacy policy
Railway	Cloud hosting of the API backend	Encrypted media data, server logs	railway.app/legal/privacy
PostHog (EU)	Product analytics	Anonymous usage events	posthog.com/privacy

6. Data Retention

Account data: retained for the lifetime of your account. Deleted within 30 days of account deletion.
Encrypted media: retained until you or the Moment owner deletes it, or until your account is deleted.
Analytics events: retained for 12 months, then deleted or anonymised.
Server logs: retained for 90 days.

7. Your Rights

Depending on where you live, you may have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Delete your account and associated data.
Export your data in a portable format.
Object to processing based on legitimate interest.
Withdraw consent where processing is based on consent.

To exercise any of these rights, email privacy@yapsa.xyz. We will respond within 30 days.

8. Children

yapsa is not directed at children under the age of 13 (or 16 in the EU). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact privacy@yapsa.xyz and we will delete it promptly.

9. Data Security

All media is end-to-end encrypted before leaving your device.
Data in transit is protected by TLS 1.2 or higher.
Your encryption keys are stored in your device's secure enclave / iCloud Keychain and are never transmitted to our servers in unencrypted form.
We conduct periodic security reviews.

Despite these measures, no system is completely secure. We encourage you to use a strong passcode and keep your device software up to date.

10. International Transfers

yapsa is operated from Switzerland, which has received an adequacy decision from the European Commission. This means data transfers between the EU/EEA and Switzerland are permitted without additional safeguards.

Our API servers are hosted via Railway and may be located in the United States or the European Union. For transfers to the US, we rely on Standard Contractual Clauses (SCCs) or equivalent mechanisms where required.

11. Changes to This Policy

We may update this policy from time to time. If we make material changes, we will notify you via the app or by email at least 14 days before the changes take effect. The "Last updated" date at the top of this page indicates the most recent revision.

12. Contact

Email: privacy@yapsa.xyz

yapsa is subject to the Swiss Federal Act on Data Protection (revFADP/nDSG). If you are located in the EU/EEA, you also have rights under the GDPR. If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority. For Swiss residents, the supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch.