1. Introduction
Y ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our social media platform. We handle personal data in line with the GDPR, the CCPA and other applicable data protection laws.
2. Information We Collect
2.1 Information You Provide
- Account Information: Username, email address, password (stored only as a one-way hash), bio, profile picture, cover photo
- Content: Posts, comments, messages, images, documents, videos you share
- Profile Data: Bio, location (if provided), website links
- Communications: Messages sent through our Service, support requests
- Identity verification (optional): legal name, country, date of birth, ID document and selfie, entity details — only if you choose to verify
2.2 Automatically Collected Information
- Usage Data: Pages viewed, features used, time spent, clicks, interactions
- Device Information: IP address, browser type, operating system, device identifiers
- Browser storage: a sign-in cookie and display preferences (no analytics or advertising cookies; see section 9)
- Security log: sign-ins, failed sign-ins, password changes and similar security events, with IP address and browser type
- Location: only if you choose to share a location in a message
2.3 Information from Third Parties
- Payment processors (transaction data, not full card details)
- Email delivery providers (to send you account emails such as password resets)
- If you connect an AI agent or use GIFs or calls, the providers listed in section 5.2
3. How We Use Your Information
We use your information to:
- Provide the Service: Create and manage your account, enable features, display content
- Improve the Service: Analyze usage, fix bugs, develop new features
- Personalize Experience: Show relevant content, recommendations, ads
- Communicate: Send notifications, updates, promotional messages (with consent)
- Safety & Security: Detect fraud, prevent abuse, enforce policies, moderate content
- Legal Compliance: Comply with laws, respond to legal requests, protect rights
- Analytics: Understand user behavior, measure engagement, improve performance
4. Legal Basis for Processing (GDPR)
We process your data based on:
- Consent: You explicitly agree to data processing (e.g., cookies, marketing)
- Contract: Processing necessary to provide the Service you signed up for
- Legitimate Interest: Fraud prevention, security, improving the Service
- Legal Obligation: Compliance with laws, court orders, regulatory requirements
5. How We Share Your Information
We share information with:
5.1 Public Information
Your public profile, posts, comments, and interactions are visible to other users based on your privacy settings.
5.2 Service Providers
These companies process data for us, and only what is needed for the feature named:
- Hosting provider (virtual server): everything the Service stores, including backups and identity-verification files
- Resend: sends account and notification emails; receives your email address, name and the message
- Stripe: payments for Premium and Trust Desk, only when you make a purchase; receives your email and purchase details, and your card details directly (we never see them)
- GIPHY: GIF search; receives your search terms from our server, not your identity
- Cloudflare: relays audio and video calls (it sees your IP address and the encrypted-in-transit media stream, and stores neither), and may provide aggregate website analytics for our domain
- AI model provider: only when you use an AI agent feature (for example drafting a reply or summarizing a chat). The text you ask the agent to work on, which can include your own posts, comments or messages, is sent to the provider. Nothing is sent unless you turn an agent on
- Let's Encrypt: issues our HTTPS certificates; sees our hostname only
We do not sell personal data and do not share it with advertisers.
5.3 Legal Requirements
We may disclose information if required by law, court order, or to protect rights, property, or safety.
5.4 Business Transfers
In the event of a merger, acquisition, or sale of assets, your data may be transferred to the new entity.
6. Your Privacy Rights
6.1 GDPR Rights (EU Users)
- Right to Access: Request a copy of your personal data
- Right to Rectification: Correct inaccurate or incomplete data
- Right to Erasure: Request deletion of your data ("right to be forgotten")
- Right to Restrict Processing: Limit how we use your data
- Right to Data Portability: Receive your data in a structured, machine-readable format
- Right to Object: Object to processing based on legitimate interests
- Right to Withdraw Consent: Withdraw consent for data processing at any time
6.2 CCPA Rights (California Users)
- Right to Know: Request disclosure of collected data
- Right to Delete: Request deletion of personal information
- Right to Opt-Out: Opt-out of the sale of personal information (we don't sell data)
- Right to Non-Discrimination: Not be discriminated against for exercising rights
6.3 Exercising Your Rights
You can download a copy of your data (a JSON file) under Settings → Data & Contacts → Export Your Data and delete your account and its data under Settings → Account → Delete Account. For anything else, including rectification, objection or restriction, contact us at privacy@safegram.io. We will respond within 30 days (GDPR) or 45 days (CCPA).
7. Data Retention
We retain your data for as long as your account is active or as needed to provide services. When you delete your account, we will delete or anonymize your data within 90 days, except where retention is required by law or for legitimate business purposes (e.g., fraud prevention, resolving disputes). Specific periods:
- Sign-in sessions: 30 days since you last used them, and at most 90 days in total
- Email delivery records: 30 days
- Security log: 180 days
- Backups: 14 days, so deleted data can remain in a backup for up to 14 days
- Identity-verification data and files: until you delete your account
8. Data Security
We implement security measures including:
- HTTPS (TLS) encryption for all communications
- Password hashing (bcrypt); passwords are never stored in readable form
- Access controls, so conversations can only be opened by their members
- Identity-verification documents kept in a separate private store, never cached, and deleted with your account
- Rate limiting and account-lockout protection against password guessing and abuse
Messages are not end-to-end encrypted today: they are encrypted in transit and stored on our servers, where access is restricted. End-to-end encryption is on our roadmap. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security. More detail is on our security page.
9. Cookies, Local Storage and Tracking
Y adds no advertising trackers and no analytics scripts of its own. Our network provider, Cloudflare, can offer cookie-free aggregate traffic statistics for our domain. We store a small amount of data in your browser:
- Sign-in: a strictly necessary cookie (HttpOnly, so page scripts cannot read it) holding a random session identifier; only a hash of it is stored on our servers. Your browser's local storage keeps a signed-in flag and a copy of your basic profile, not the session credential
- Preferences: your light/dark theme and display style
Ads on Y are selected on our own servers from the content of your profile; no advertising cookies are set and no data is shared with ad networks. You can clear this stored data at any time by signing out or clearing your browser's site data.
10. Children's Privacy (COPPA)
Y is not intended for children under 13. We do not knowingly collect data from children under 13. If we learn we have collected such data, we will delete it immediately. Users aged 13-17 require parental consent. If you believe a child under 13 has provided data, contact us at privacy@safegram.io.
11. International Data Transfers
Your data may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place (e.g., Standard Contractual Clauses) to protect your data in accordance with GDPR and other regulations.
12. Do Not Track (DNT)
Because Y does not track you across other websites or run advertising or cross-site analytics, there is no tracking for a Do Not Track signal to switch off.
13. Third-Party Links
Our Service may contain links to third-party websites. We are not responsible for the privacy practices of these sites. Please review their privacy policies.
14. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or prominent notice on the Service. Continued use after changes constitutes acceptance of the updated policy.
15. Contact Us
Y is operated by RWA Global Inc.. For privacy questions or to exercise your rights, email privacy@safegram.io.
Your Privacy Matters: We are committed to transparency and protecting your personal data. You have full control over your information.