Privacy policy
Last updated: 15 October 2026TEMPLATE. Fill in every [bracket], make it match what the app really does at launch, and have a lawyer review it before you publish. It is a starting point, not legal advice.
Yalla ("we", "us") is run by [YOUR NAME OR ORGANISATION], Morocco. You can reach us at hadilappsupport@gmail.com. This policy explains what we collect, why, who can see it, and how to delete it.
What we collect
- Account: your name, email address and password (stored only in protected form), and whether you are a student or a club.
- Profile: the photo, major, year, graduation year, interests and favourite spots you choose to add. Clubs add a logo, description, photos and head members.
- Content you create: hangouts and events, messages in private and group chats and communities, suggestions, announcements, and reports you send.
- Location, only if you turn sharing on: your position on campus while you share it (exact, or only the nearest campus spot if you choose). We also keep a short history of spots you checked in at, which powers your favourite spots, the "explored" map and your profile summary. Ghost mode, which is the default, switches sharing off and stops this history. You can clear the history at any time.
- Activity: which days you used the app (for the Butterfly badge), who viewed your profile (shown to you, unless you use private browsing), who you follow, and your blocks.
- Technical: your device's push notification token, if you allow notifications, and basic logs needed to keep the service running.
Why we use it
To run the app: show events, besties and maps, deliver messages and notifications, recommend hangouts, keep the community safe (reports, blocks, moderation), and fix bugs. We do not sell your data and we do not show ads.
Who can see what
- Your location is visible only to besties who you added and who added you back, and only while you share it.
- Events you join show your name to others, unless you are in ghost mode.
- Your profile (name, photo, major, badges) is visible to other people on Yalla. People who open it appear in your visitors list, and you appear in theirs, unless either of you uses private browsing.
- Club events, news and photos follow the club's settings: events go to followers, chat and ideas to accepted members.
- Reports are seen by us only. The person reported is not told who reported them.
Who else handles data
- Supabase, which stores accounts, content and photos for us (login, database and file storage).
- Cloudflare, which hosts the Yalla website and app files.
- OpenFreeMap and OpenStreetMap, which provide the map. Their servers see your IP address and the map area you view, not your account.
- Google Fonts, which serves the app's fonts.
Keeping and deleting your data
You can delete your account in the app (Me, then Delete my account). We then remove your profile, photos, location history, private chats, the messages you wrote elsewhere, your event attendance, friendships, follows and memberships. Events you host are cancelled. Reports about you may stay for safety, without the message content. Backups are removed within [NUMBER] days.
Your rights
You can ask to see, correct or delete your data by writing to us. Depending on where you live (for example under [APPLICABLE LAW, such as Morocco's Law 09-08 or the GDPR]) you may have additional rights, including complaining to the data protection authority.
Age
Yalla is for people aged 16 and over. If you believe a younger person has an account, tell us and we will remove it.
Security
We use encryption in transit and access controls on our servers. No service is perfectly secure, so please use a strong, unique password.
Changes
If we change this policy in a way that matters, we will tell you in the app before it takes effect.