YA PRIVACY POLICY

Effective date: October 13, 2026
Version: YA-2026-10-v4

1. Information collected

YA may collect account information, date of birth, profile information, content, messages, Activity participation, check-ins, device location, device and technical information, analytics events, safety reports, support requests, and transaction metadata.

2. Age eligibility

YA is an 18+ service. YA records a user's self-declared date of birth and age attestation. A self-declaration is not the same as verified identity. If YA later needs age assurance, YA may use a third-party verification provider and should retain only the minimum verification result necessary rather than copies of government identification.

3. Location

With your device permission, YA may receive precise or approximate location for Nearby and local discovery. Posts and Activity listings can include device-derived coordinates and venue addresses depending on the creation flow. Location information saved with content can be visible to viewers of that content; check location and audience before publishing.

4. User content and communications

YA processes Shares, Activities, photos, videos, comments, messages, mentions, check-ins, and related metadata to provide social, safety, marketplace, and moderation functionality.

5. Payments

Stripe or another payment provider may process payment credentials, identity verification, connected-account onboarding, banking information, payouts, refunds, disputes, and tax reporting. Payment and identity credentials are submitted to the payment provider; YA uses transaction references and account readiness information to operate payments. Do not send card numbers, banking credentials, SSNs or identity documents through YA posts, messages or support emails.

6. Analytics

YA may record product events such as app opens, feed engagement, Activity views, joins, content creation, check-ins, feedback, and transaction states to measure DAU, WAU, MAU, retention, conversion, safety, and business performance.

7. Safety and fraud prevention

YA may process account, transaction, device, IP/log, report, and behavioral information to identify spam, scams, payment abuse, multi-account abuse, underage use, and safety risks.

8. Service providers

YA may use Firebase, Google Cloud, Stripe, Apple, Google, mapping, media, translation, analytics, safety, and other service providers to operate the service.

9. Retention and deletion

YA retains information only as reasonably necessary for service operation, legal obligations, payment and tax records, fraud prevention, disputes, safety, and enforcement. Account deletion may not immediately delete records that YA or a payment provider must lawfully retain.

10. User rights

Depending on applicable law, users may have rights to access, correct, delete, or otherwise control personal information.

11. Security

YA uses reasonable safeguards, but no online system can guarantee absolute security.

12. Changes and contact

Material changes may be communicated in the App. For privacy questions, access, correction or deletion requests, contact privacy@ya-now.com. YA is individually operated by YA Founder. We may verify your identity before acting on a request.

13. Scope and who handles your information

This policy describes information processed for YA's app, website and related support, social and Activity services. YA is individually operated under the public designation YA Founder. Contact privacy@ya-now.com for privacy questions or rights requests. Independent Activity organizers, payment providers, social sign-in providers, venues and external websites have their own responsibilities and policies. This document describes YA's current services rather than every practice used by a large advertising platform.

14. Information you provide

Account information includes your email, account identifiers, date of birth, chosen name, language, profile image and any optional profile details such as gender, biography and interests. Social sign-in can provide the account identifier, email, name and profile image that the provider makes available through the sign-in flow. Content includes text, photos, videos, comments, messages, reactions, saved items and the metadata needed to display them. Activity information includes listings, participant records, times, venue details, check-ins, completion information and feedback. Support and safety information includes reports, correspondence, reported content references and information supplied to investigate an issue. Avoid posting identification documents, full payment credentials or another person's private details.

15. Information generated by use

YA records interactions such as app opens, views, content creation, joins and check-ins to operate features and understand engagement. Records can include an account ID, event time, platform and event-specific properties. Infrastructure and security services can process IP addresses, browser or device details, request times, errors and security signals. Session and local cache records can store sign-in state, preferences and previously loaded feed information on your device. Other users can provide information about you through mentions, messages, invitations or reports. These sources do not guarantee that a submitted allegation is accurate.

16. Location and permissions

When you use a location-dependent feature, YA requests the browser or operating-system location permission. The position supplied may be precise or approximate according to your device and settings; it should not be assumed to be anonymous merely because it is used for Nearby. Location can help calculate distance and discover local Activities. Posts and Activity listings can contain device-derived coordinates as well as addresses or map positions. These fields can be visible to the audience of the content, depending on the creation flow; location sharing is not limited to addresses you type yourself. Withdrawing location permission affects future device location access, but does not remove location you already published in content. You can edit or remove that content where the feature permits. Camera, microphone and photo-library permissions, when requested, support selecting or recording media; denying a permission can limit that feature.

17. Why YA uses information

YA uses account details to authenticate users, determine self-declared age eligibility and manage profiles; content and relationship records to provide feeds, messages and interactions; Activity and payment references to operate bookings, check-in, fees and refunds; support information to respond to requests; and technical, report and transaction information to protect accounts, enforce rules and investigate abuse. Product-event records help assess use, retention, reliability and conversion. Ranking may use interests, follows, location, language and interactions to make discovery useful. Requested translation can send the submitted content and language parameters to a translation provider. Information may also be used to meet legal duties and maintain evidence relating to a complaint or financial dispute. These purposes do not authorize publishing a private support message as promotional content.

18. What other people can see

Your display name, profile image, public profile details and content can be seen by the audience of the relevant feature. Comments and reactions can identify their author; organizers and participants can receive information needed for an Activity. Message recipients receive the messages you send and may retain, screenshot or forward them. A user profile's public data is distinct from the private account record containing email and date of birth. Required financial records are not ordinary public feed data. Visibility controls cannot prevent a recipient from retaining an independent copy, and anyone able to view a media URL may be able to copy or share it. Choose carefully what you publish; YA does not promise that every item visible in the service is confidential.

19. Service providers and disclosures

Firebase and Google Cloud support authentication, databases, storage, hosting, functions, logs and related infrastructure. Stripe handles payment credentials, organizer verification, banking, tax-related information and payment processing under its policies. YA receives transaction identifiers, status, amounts and account-readiness information needed for its features; card and banking details should be submitted through the payment provider's interface. Apple or Google can process social sign-in when you choose it. Google Cloud translation can process text submitted for translation. Embedded YouTube players and external media hosts receive requests from your device, which can expose IP addresses, browser details and their own cookie or storage signals. Applicable provider policies include https://policies.google.com/privacy and https://stripe.com/privacy.

Disclosures can also occur to an organizer for the Activity you join, to an authorized support or moderation operator for a request, or where reasonably necessary for a valid legal process, safety, fraud prevention or a financial dispute. If the service is transferred to another operator, user information may be part of that transfer subject to applicable law and notice of material changes. YA does not promise that a future transfer will occur.

20. Cookies, local storage and embedded services

Authentication and browser storage help maintain sessions and preferences. Local feed caches can improve loading performance. External media and embedded services may use their own storage and receive information when loaded or played. Blocking storage can interfere with login or playback. Browser privacy settings and clearing site data affect local storage; clearing a browser does not erase server-held account or payment records. A general browser Do Not Track signal is not a substitute for submitting a rights request and is not represented here as a universal YA privacy control. If a legally required opt-out signal applies to YA's actual processing, YA must assess and honor that obligation. Contact privacy@ya-now.com for a concern about such processing.

21. Retention and deletion

Account data remains while needed to provide an active account. Published content and relationships remain while used by their features and can be removed through applicable controls or account deletion. Payment, refund, dispute, fraud and audit records may remain for obligations or claims even after an account closes. Support and safety records can be kept while investigating, enforcing rules or documenting a matter. Service-provider logs and backups have separate retention arrangements. Retention is assessed by purpose, legal requirements, outstanding claims and whether information can instead be deleted or anonymized; this policy does not promise a single deletion deadline for every category.

Deletion requests are processed through a backend queue, may require retries and can be blocked by unresolved paid obligations. Some retained records are anonymized rather than erased where needed. Messages or content held by recipients and data processed independently by Stripe or another provider may require separate action with that provider. Local browser copies may remain until cleared. If a request appears stalled, contact privacy@ya-now.com; account deletion should not be interpreted as immediate deletion of every associated record.

22. Your choices and requests

You can edit available profile fields, control device permissions, use offered audience controls, report or block a user and request account deletion in Settings. You may contact privacy@ya-now.com to request access, correction, deletion or another right available under applicable law. Include your YA ID, the type of request and a way to respond; do not email passwords or identity documents unless a specific secure verification process has been agreed. YA may ask for proportionate verification to avoid disclosing information to an impostor. An authorized-agent request may require proof of authority and identity verification where the law permits.

Rights can vary with residence and whether a law applies to YA's activity. Where applicable, they can include information about processing, a copy of personal information, correction, deletion, portability, an opt-out of qualifying processing or an appeal of a decision. Some records may be exempt or retained for legal and security reasons. YA does not claim that all state-law rights or statutory deadlines apply universally, and does not claim a self-service data-export button exists. If you disagree with a response, reply to privacy@ya-now.com requesting review; you may also contact the competent regulator. These requests do not remove non-waivable protections against discrimination where applicable.

23. Backup email and account recovery

If you add a backup email, YA stores it privately and sends a verification message. A verified backup inbox can receive a Firebase password-reset link for your original sign-in account. YA's transactional email provider, Resend, processes delivery addresses and email content for these messages. You can change or remove the backup email after a recent sign-in. Pending or expired verification does not authorize password recovery. Google and Apple sign-in accounts use their provider's recovery process. This optional feature does not make your backup address a public profile field.

24. Sensitive information, children and security

A birthday, precise location, private communication, financial status or sensitive material in a report can require particular care. YA uses access restrictions and other reasonable safeguards and limits account email and birthday to private account records. Security is not absolute; protect your device and credentials and report suspected unauthorized access. YA is for adults 18 and older and does not offer a children's version. Self-declared age eligibility is not verified identity. If you believe an underage person has an account, report the account or contact support@ya-now.com so it can be reviewed. Do not send suspected illegal child-exploitation material through ordinary email.

25. International processing and changes

YA's initial community focus is the United States. Access from another country can involve processing by infrastructure or providers in the United States or elsewhere, where laws may differ. Mandatory rights under applicable law are not waived by this statement. This policy does not claim EU or UK representative arrangements or regulatory certifications that have not been established. Material changes to purposes, recipients or other practices will require appropriate notice and, where legally required, consent. The current version and date are shown at the top. Privacy: privacy@ya-now.com; general support: support@ya-now.com.