Privacy policy

Merdot Private Limited operates Yupzap, a social networking and messaging service intended for people aged 13 and over.

Information we process

We process your phone number, account identifier, username, display name, profile picture and settings. Optional information includes recovery email, birthday, gender, biography, website and professional or business information you submit.

We process messages, photos, videos, voice recordings, documents, posts, comments, reactions, follows, call metadata and reports needed to provide the features you use. If you share a location, that location forms part of your message. With your permission, contact information is processed for contact discovery and privacy controls; stored phone matches use keyed hashes.

We also process session identifiers, push notification tokens, device/platform information, IP addresses, request and security records, engagement events and subscription transaction records. Payment providers process payment credentials; Yupzap uses transaction identifiers and subscription status.

How information is used

We use information to create and secure accounts, deliver messages and calls, display content to your selected audience, provide discovery and notifications, manage subscriptions, investigate reports, prevent fraud and abuse, and maintain the service. Optional permissions can be declined, but related features may not work.

Who receives information

Content is shared with the recipients or audience you choose. Public posts and public profile information may be visible to others. Service providers process information needed for hosting, storage, authentication, message delivery and payments: MongoDB Atlas (database), Cloudflare (media storage and network), Amazon Web Services (servers and email), NVIDIA (automated checks on reported posts only), Google (link safety checks, notifications, Google Play billing and, only if you choose it, backup to your Google Drive), Apple (App Store purchases and notifications), Expo (app updates and notifications), Merdot Connect (SMS sign-in codes and messages), Merdot AI (the help bot and creator tools), Razorpay (payments), MalwareBazaar (file fingerprints checked against known malware), Giphy (GIF search) and Jamendo (music catalogue). Information may also be disclosed when legally required or needed to investigate abuse and protect people.

Sign-in records, city and interest topics

Sign-in records and city: when you sign in or your session is refreshed, we record the IP address and a short device description for 90 days to protect your account. From the IP address we work out an approximate city, state and country using an offline database on our own servers (IP Geolocation by DB-IP). If you have already allowed location for another feature, the app may also send a city name worked out on your phone, at most once a day; your exact location is never sent or stored for this, and we never ask for location permission for it.

Interest topics: to personalise Discover and future sponsored content inside Yupzap, we work out up to 10 general topics (such as food, travel, cricket or music) from the public posts you like, comment on, share, save or view and the accounts you follow, using their hashtags, place tags and categories. We never use sensitive categories (religion, caste, health, politics or sexuality), and we never use your private chats, messages or calls.

Personalised ads switch: Personalised ads is on by default. You can turn it off in Settings, Privacy. When it is off, your interest topics are deleted and no new ones are built; sponsored content then uses only your approximate city and what is on screen.

We never share your personal information with advertisers, not even your username. We only match ads to interests inside Yupzap, and advertisers see total numbers only. Audience totals are never shown for groups smaller than 100 people. We never sell your data and never share it with ad networks.

Security and device storage

Network connections to our service use encryption in transit. This is different from end-to-end encryption: do not assume every chat or attachment is end-to-end encrypted. Server access is authenticated. The app caches content on your device to improve loading; copies saved by recipients outside Yupzap cannot be recalled.

Retention and deletion

Account information and content are retained while needed to operate your account and the features you use. You can delete your account in the app or request deletion through our account deletion page. Account deletion removes the active profile, sessions, owned uploads, posts and account settings, and removes the content of messages you sent. Other users' independent content is not deleted.

Billing transaction records and abuse, fraud, security and audit records may be retained separately where needed for financial obligations, dispute resolution, legal compliance or safety investigations. These records are not used to restore a deleted profile. Retention depends on the applicable obligation or investigation; contact us for the retention applicable to your request. Copies in backups or already downloaded by recipients are not erased by deleting a profile from the active service.

Your choices and requests

You can edit your profile, control audiences, block and report accounts, manage permissions, and request access, correction or deletion by contacting support. We may verify account ownership before acting. Do not email passwords, login codes or payment card details.

Contact: support@yupzap.com