Privacy Policy

1. Information We Process

We may process Firebase UID, email when provided, phone number and verification time, nickname, date of birth, gender, voice card settings, interests, conversation metadata, reports, device tokens, purchase and ad reward data, and analytics events.

2. Voice Data

We process public voice cards and one-to-one voice conversation files uploaded by users. Voice files may be stored and transmitted through service infrastructure including Cloudflare R2/CDN and Firebase.

3. Purposes

We process data to identify users, verify phone numbers, show voice cards, provide one-to-one voice conversations, prevent abuse, review reports, enforce policies, process purchases and gems, send notifications, improve stability, comply with law, and handle disputes.

4. Retention and Deletion

General voice cards, voice conversations, and messages may be retained for up to 30 days from creation or deletion. If both participants leave a conversation room, voice and messages in that room may be retained for up to 7 days from the time both participants have left. Records related to reports, enforcement, disputes, or legal requests may be retained for up to 3 months as needed, and may be retained longer when required by law or by a lawful request from an investigative authority or court.

5. Public, Private, and Deleted Cards

Private voice cards are excluded from swipe and recommendation exposure, but may remain visible in conversations that already started from that card to preserve context. Deleted voice cards are restricted from app exposure and new access, then removed after the applicable retention period.

6. Processors and International Processing

We may use Google LLC (Firebase: authentication, database, push, analytics), Cloudflare, Inc. (object storage and CDN), RevenueCat, Inc. (purchase processing), Google AdMob (ad rewards), and Apple/Google (app store payments). Data may be processed on servers outside your country due to cloud infrastructure.

7. User Rights

Users may request access, correction, deletion, account withdrawal, or notification setting changes through in-app features or contact@hayo.dev.

8. Security Measures

We apply authentication-based access control, phone verification, report and enforcement operations, token management, and data minimization and retention minimization principles.

9. Advertising and Privacy Choices

Our advertising integration may include Google AdMob, Yandex, Liftoff Monetize, Unity Ads, InMobi, and DT Exchange (Digital Turbine). Applicable consent screens and partner notices identify the advertising partners and purposes in use. Depending on operating system settings and consent choices, advertising SDKs may process advertising identifiers, IP addresses and approximate location inferred from them, device, app and language information, ad impressions and interactions, and diagnostics for ad delivery, measurement, personalized advertising, and fraud prevention. We do not request precise location permission for advertising. We do not provide voice recordings, dates of birth, phone numbers, or email addresses to advertising networks as targeting data. Ad reward verification uses an app account identifier and a reward request identifier.

Where required, privacy choices are shown before requesting ads. When available, Ad privacy choices in Settings lets you change or withdraw consent. The iOS tracking permission is a separate operating system choice that can be changed in device settings. Refusing tracking does not stop all advertising or all data processing necessary to deliver ads. Users must meet our minimum sign-up age of 19. Privacy requests can be sent to contact@hayo.dev.