This Privacy Policy explains what information OYLA ("OYLA", "we", "us") collects when you use the OYLA mobile app and the oylavote.com website (the "Service"), how we use it, who we share it with, and the choices you have.
1. Information we collect
A. Information you give us
- Account information. When you sign in with Google we receive your name and email address. Google also sends your profile photo; we do not store or show it. When you sign in with Apple we receive your name and email address; if you choose "Hide My Email" we receive Apple's private relay address instead of your real one.
- Age check. We ask for your date of birth once to confirm that you are 13 or older. We keep only your birth year, in a part of your account that other users cannot read.
- Profile information. Username, display name, the avatar you pick from our built-in set, bio and whether your account is private. OYLA does not currently accept profile photo uploads.
- Content you create. Polls, poll options, photos and videos you upload, comments, and remixes.
- Activity. The votes you cast, the accounts you follow or block, and your notification preferences.
- Messages to us. Feedback, support requests, and reports you file about content or accounts.
B. Information collected automatically
- Device and app information, such as device type, operating system version and app version.
- Language and country signals taken from your device settings. We use them to decide which languages to support; other users cannot see them.
- A push notification token, if you allow notifications.
- Usage data and crash reports (Firebase Analytics and Firebase Crashlytics): which screens and features are used, and technical details of crashes. We use this to understand how the app is used and to fix problems; by using OYLA you agree to this collection as described in this Policy.
- Security signals. We use Firebase App Check (Google Play Integrity on Android, App Attest / DeviceCheck on iOS) to confirm that requests come from a genuine copy of the app, and we keep rate-limit counters to prevent abuse.
- Information stored on your device, such as which polls you have already seen, so the feed does not repeat itself.
We do not collect your precise location, your contacts, or your photo library. The app only receives the photos and videos you pick yourself.
C. Browsing as a guest
You can browse and vote without an account. In that case the app creates an anonymous identifier for your device so that your votes can be counted once. Guest votes count toward poll results. If you later sign in, your guest votes move to your account. Guest identifiers that have been inactive for 30 days are deleted automatically, together with the votes recorded under them; the poll totals they contributed to are not changed.
2. How we use information
- To create and secure your account and keep you signed in.
- To run the core features: creating polls, voting, commenting, following, search and notifications.
- To build your feed and show results.
- To keep the community safe: filtering prohibited words, automatically screening uploaded images for explicit content, reviewing reports, and enforcing our Terms.
- To understand how the app is used, fix bugs and improve it.
- To show ads (see section 4).
- To comply with the law and protect the rights and safety of users and OYLA.
3. What other people can see
- Public by design: your username, display name, avatar, bio, the polls you post publicly, your comments, and your follower and following counts.
- If your account is private, only followers you approve can see your polls and profile details.
- Polls posted anonymously do not show your name or profile to other users. We still know which account created them, so that we can enforce our rules and delete them when you delete your account.
- Your individual votes are not shown on your profile or listed publicly. The creator of a poll may be notified that you voted on it.
- Reports are confidential. The person you report is not told who reported them.
4. Advertising
OYLA shows ads through Google AdMob. To deliver, measure and limit ads, AdMob may process your device's advertising identifier, IP address, approximate location derived from it, and how you interact with ads.
- On iOS, the app asks for your permission through Apple's App Tracking Transparency prompt before the advertising identifier is used. If you decline, you still see ads, but they are not personalised using that identifier.
- On Android, you can reset or delete your advertising ID, or opt out of ads personalisation, in your device's Google settings.
- Where the law requires consent for ads (for example in the EEA and UK), the app asks for it before any ad is requested, and you can change your choice later in Settings.
- We ask AdMob to serve only ads rated suitable for teens and above.
Google's use of this data is described at policies.google.com/technologies/partner-sites.
5. How we share information
We do not sell your personal information. We share it only:
- with service providers that run the Service for us. Today that is Google (Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Cloud Messaging, Analytics, Crashlytics, App Check, Cloud Vision for image screening, and AdMob) and Apple (Sign in with Apple);
- with other users, as described in section 3;
- with authorities or other parties when the law requires it, or when it is reasonably necessary to investigate fraud, abuse, a security incident, or a risk of harm. Apparent child sexual abuse material is reported to the competent authorities;
- as part of a merger, acquisition or sale of assets, in which case this Policy continues to apply to your information.
6. Children
OYLA is not for children under 13. We check age at sign-up, and if someone tells us they are under 13 we delete the information collected for that account. If you believe a child under 13 is using OYLA, contact support@oylavote.com and we will remove the account. If the law where you live sets a higher age for using online services without a parent's consent, that age applies to you.
7. How long we keep information
- Account, profile, content and activity: until you delete them or delete your account.
- Notifications: 30 days.
- Inactive guest identifiers: 30 days after the last activity.
- Reports, moderation records, feedback and security logs: as long as reasonably needed to prevent abuse, resolve disputes and meet legal obligations. These may outlast your account.
- Images removed by moderation may be preserved, out of public reach, where needed to report illegal content or to respond to legal process.
- Backups and caches may keep copies for a short period after deletion.
8. Your choices and rights
- Delete your account: Settings > Delete account in the app, or the form at oylavote.com/delete-account. Deletion removes your profile, polls and their media, comments, votes, follows, notifications and sign-in record. Totals on other people's polls that your votes contributed to are not recalculated.
- Get a copy of your data, or correct it: email support@oylavote.com from the address on your account. We answer within 30 days.
- Push notifications: choose categories in Settings > Push notifications, or turn them off in your device settings.
- Ads: see section 4.
- Private account: switch it on in Edit profile.
We will not treat you differently for exercising any of these rights.
9. Where your information is processed
OYLA runs on Google Cloud / Firebase infrastructure. Your information is processed in the United States and in other countries where Google operates data centres. Where the law requires safeguards for international transfers, we rely on the ones Google provides in its data processing terms.
10. Security
Data is encrypted in transit and at rest. Access to the database is restricted by server-side rules, writes go through authenticated server functions with rate limits, and requests are verified with App Check. No system is perfectly secure; if we learn of a breach that affects your personal information, we will notify you and the relevant authorities as the law requires.
11. Region-specific information
A. United States (including California)
Depending on the state you live in, you may have the right to know what personal information we hold about you, to get a copy, to correct it, to delete it, and to opt out of the "sale" or "sharing" of personal information for cross-context behavioural advertising. We do not sell personal information for money. Showing ads through AdMob may count as "sharing" under some state laws; you can opt out by declining the tracking prompt on iOS, by turning off ads personalisation on Android, or by emailing us. We do not use or disclose sensitive personal information for purposes that require a right to limit. To make a request, email support@oylavote.com. You may use an authorised agent; we may ask for proof of the authorisation.
B. EEA, United Kingdom and Switzerland
Where applicable data protection law applies, you have the rights of access, rectification, erasure, restriction, objection and portability, and the right to complain to your local data protection authority. We process personal data on these bases: performance of our contract with you (running the Service), our legitimate interests (safety, abuse prevention, improving the Service), consent (advertising identifiers and, where required, analytics), and compliance with legal obligations. You can withdraw consent at any time.
12. Changes to this Policy
If we make material changes we will update the effective date above and tell you in the app or by other appropriate means before the changes take effect.
13. Contact
OYLA