Privacy

Summary

• We collect the email you sign in with, plus the profile and content you create. That's it.
• Direct messages are end-to-end encrypted via MLS — the operator cannot read DM contents on the server.
• No advertising, no third-party trackers, no analytics scripts.
• Data lives on servers in Germany (Hetzner). OTP sign-in emails are delivered via Mailjet. Push notifications go through your browser's push service (Apple / Google / Mozilla).
• You can request a copy of your data or full account deletion at any time by emailing abuse@madmin.app.

Who's responsible

The data controller is the operator of yay, reachable at abuse@madmin.app. The service is provided as a personal project, not a company. The supervisory authority is your local EU data-protection authority; complaints about how your data is handled can be lodged with them.

What we collect, and why

Email address

Used as your primary credential and to send sign-in codes. Required. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

Phone number (optional)

Only if you choose to link one. Used to help people you actually know find you. Stored as both the value and a hashed form for blocked-number lookups. Removable from settings; no SMS is currently sent.

Profile: display name, handle, avatar, bio

What you choose to show other users. Visible to people you've connected with on the platform.

Your social graph

Circles you've created, who you've added to them, who follows whom. Per the project's privacy invariant, queries about state never consult the other party's graph — only your own.

Posts and media you publish

Stored encrypted at rest on disk. Visible to the audiences you choose (a circle, or your subscribers).

Direct messages (DMs)

Encrypted client-side via MLS (RFC 9420) before they reach the server. The server only sees ciphertext, MLS group IDs, sender device IDs, and timestamps; it cannot decrypt message bodies or attachments. DM media attachments are encrypted with ChaCha20-Poly1305 and content-addressed.

Devices and passkeys

For each device you sign in from, we keep a device identifier, a public signing key (used by MLS to authenticate your messages), a "last seen" timestamp, and — if you registered a passkey — its public key and credential ID. Used to sign you in and to route MLS messages.

Push notification subscriptions (optional)

If you enable browser notifications, we store the push endpoint URL plus its two cryptographic keys so we can deliver notifications. Used only to tell you about incoming DMs. Remove by disabling notifications in your browser.

Sessions

A hashed session token, a hashed refresh token, a device label, and access/refresh expiry times. No IP address is stored against the session. Used to keep you signed in across page reloads.

Reports

If you report a post, we keep the report text, the reporter's identity, the reported post, and the resolution outcome. Used to moderate the platform.

Invite links you issue

When you mint an invite, we record the random code, your user id as the issuer, the expiry, the use count, and a record of every account that signed up via the link. Used for accountability if a link is abused.

Request logs

The server logs HTTP method, path, status, and response time. IP addresses are seen in the proxy layer and used transiently for rate-limiting (kept in Redis with a one-hour TTL); they are not written to any long-lived database table. Legal basis: legitimate interest in keeping the service available and abuse-free (Art. 6(1)(f) GDPR).

Cookies

We use two strictly-necessary cookies, both httpOnly and same-site: a short-lived session cookie and a longer-lived refresh cookie. They exist solely to keep you signed in. No tracking cookies, no advertising cookies, no third-party cookies — so no consent banner is shown.

Who we share data with

yay relies on a small set of processors:

• Hetzner Online GmbH (Germany) — hosting for the application, database, and media files. All user data lives here.
• Mailjet (France / EU) — delivers your sign-in codes by email. Receives your email address and the OTP at send time only.
• Your browser's push service — Apple, Google, or Mozilla. If you enable notifications, the encrypted notification payload is routed via your browser vendor's push gateway. This involves transfer to non-EU infrastructure (United States) for the Apple and Google paths; covered by the Art. 49(1)(b) GDPR derogation (necessary for performance of the contract: delivering the notification you opted into).

We do not sell or rent personal data, and there are no advertising partners.

How long we keep it

• Account data — until you ask us to delete it.
• OTP sign-in codes — five minutes, then automatically purged.
• Rate-limit counters in Redis — one hour.
• Application logs (path, status, timing) — short-term operational logs, typically a few days, depending on rotation.
• Invite-redemption records and moderation reports — kept for the lifetime of the account so the audit trail survives unrelated post deletions.

Your rights

Under GDPR you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct anything that's wrong. Most profile fields are editable in settings; for the rest, email the operator.
• Erasure — ask us to delete your account and the associated data. Soft-delete is immediate; the database row is purged on a delayed schedule so reversal is possible if you change your mind within a short window.
• Restriction and objection — limit or object to particular processing.
• Portability — receive your data in a machine-readable form.
• Complaint — lodge a complaint with your local EU data-protection supervisory authority.

Exercise any of these by emailing abuse@madmin.app. We aim to respond within thirty days. There's no fee unless the request is manifestly unfounded or excessive.

Security

Traffic is served over HTTPS. Sign-in tokens are stored hashed. DM contents are end-to-end encrypted via MLS, so even a compromise of the server would not expose DM bodies. Posts and uploaded media are encrypted at rest on disk. We will notify affected users within 72 hours of becoming aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, as required by Art. 33–34 GDPR.

Children

yay is not directed at children under 16. If you become aware that a child has signed up, please contact the operator and the account will be removed.

Changes to this page

Material changes will be announced inside the app and re-dated above. The current version is whatever you're reading; older versions can be requested from the operator.