Privacy Policy · Yallla

This Privacy Policy explains what personal data Yallla collects, why, who we share it with, where it goes, how long we keep it, and your choices. It covers the iOS app, yallla.club and my.yallla.club (together, the "Service").

The Service is run by Fondry Company for Custom Software Design and Programming (شركة فوندري لتصميم وبرمجة البرمجيات الخاصة), a one-person company registered in Kuwait under Commercial Register No. 516831 ("Fondry", "Yallla", "we", "us"). Fondry is responsible for your data. Contact: support@yallla.club.

Every sign-in and sign-up screen shows this line: "By continuing, you agree to the Terms and Privacy Policy." When you continue past that screen, you agree to this policy, including the international transfers described in "Where your data goes".

Yallla is for people aged 18 or older. By agreeing to the Terms, you confirm you are 18 or older. We do not knowingly collect data from anyone under 18. If you think someone under 18 has an account, tell us and we will delete it.

DATA YOU GIVE US

Account. Your email address, and whether you use Yallla as talent, as a client, or both. You sign in with a one-time link sent to your email. We do not collect or store a password for your account.

Profile.

Display name and username.
Photo, bio, city, skills, interests and links, if you add them.
A company name, if you have given one.
Your Instagram username, if you give it. We use it to check that talent are who they say they are, and we show it on your public profile and with the proposals you send, unless you turn that off in Edit profile.
Portfolio images you upload, and links to videos on YouTube, Vimeo, Instagram or TikTok, with any captions.

Contact details. The email, phone number and WhatsApp number you add as ways to reach you. They are not public. See "Who can see your data".

Invite codes. The code you joined with, which tells us who invited you, and the codes you receive to pass on.

Briefs (clients). Title, description, category, budget, location, image, and status. Also whether you told us you found someone after the brief ended.

Proposals (talent). Your proposal text, rate, the contact details you attached, and its status.

Reports. When you report a brief or a profile: the reason, any note you add, and who you reported.

Settings. Your notification choices, briefs you save, and whether you have seen the welcome screen.

Support. Emails you send to support@yallla.club and our replies.

DATA WE COLLECT AUTOMATICALLY

Activity. When you signed up, signed in and were last active, and counts we use for daily limits (for example, briefs posted and proposals sent). How many times you used translation that day.

Moderation records. Flags our team or the system set on your account or briefs: verified or authenticated badges, activation, whether your briefs skip review, posting limits, report counts, "under review", banned, and notes from brief reviews.

Push notification token. If you allow notifications in the app, your device gets a token so we can send you notifications.

Security check. When you sign in, sign up, ask to join or post a brief, Cloudflare Turnstile checks that you are a person and not a bot. It receives your IP address and basic browser or device data.

Technical data. Our hosting providers record basic request data, such as IP address, time, and the page or service requested. We use it to run and secure the Service.

Crash and error reports. When something breaks, the app and websites send an error report to Sentry. It includes the error, the device or browser type, operating system, app version, and the screens or steps just before the error. In the app, the report is linked to your account ID, not your name or email. So these reports are pseudonymous, not anonymous. We have turned off IP address storage in Sentry.

Visits to my.yallla.club. We use Vercel Web Analytics and Speed Insights to count page views and measure page speed. They record the page, where the visit came from, device and browser type, and country. They do not use cookies and do not identify you personally.

HOW WE USE YOUR DATA

To run Yallla: create your account, sign you in, show briefs and profiles, send proposals, and share contact details after an accept.
To review briefs and keep Yallla safe: check talent, stop spam, bots, scams and abuse, act on reports, and enforce our Terms.
To send you emails and push notifications about your account, your briefs and your proposals.
To translate brief text when you ask.
To feature talent, and occasionally a live brief, on Yallla's Instagram and other social media accounts, as described in the Terms.
To fix bugs and improve the Service.
To follow the law and protect our rights.

We do not sell your data. We do not show ads or build advertising profiles.

Why we are allowed to use it:

to provide the Service you signed up for;
our legitimate interest in keeping Yallla safe, reviewing briefs, fixing problems and promoting Yallla;
your consent, which you give when you continue past the sign-in or sign-up screen (including for international transfers), and consent you give for specific things, such as push notifications or giving us your Instagram username. You can withdraw consent at any time;
legal obligations.

WHO CAN SEE YOUR DATA

Anyone, including people not signed in: a talent profile at my.yallla.club/your-username. This shows display name, username, photo, bio, city, skills, interests, links, badges, portfolio, your Instagram username unless you have hidden it in Edit profile, and a notice if the account is under review. Search engines can index these pages.

Signed-in talent whose accounts we have activated: live briefs, including the title, description, category, budget, image, and the client's name and photo. Briefs are not shown to people who are not signed in, or to talent who are not yet activated.

A client: their own briefs, and the proposals sent to them, with each applicant's name, username and profile.

Social media: we may occasionally feature a live brief on Yallla's social media accounts. We decide for each post whether the client's name appears. When we feature talent, we always credit them by name or username. You can ask us not to feature you. See the Terms.

Contact details: shared only when a client accepts a proposal. The client then sees the contact details that talent attached to that proposal. The talent sees the client's contact details. Nothing is shared before the accept, and this is enforced in our database. Once shared, the other person may keep them, and we cannot take them back.

Our team: can see account and moderation data to review briefs, answer support requests and deal with reports.

SERVICE PROVIDERS WE USE

These companies process data for us to run the Service:

Supabase: database, sign-in, file storage and server functions. Your account, profile, briefs, proposals and uploaded images are stored in its Mumbai, India region.
Resend: sends our emails from its Ireland region. These are sign-in links, brief review results, new proposals, proposal updates, brief balance updates, and the one-time check-in after a brief ends. It receives your email address, name and the email content.
Sentry: crash and error reports, stored in its Germany (EU) region. See above.
Vercel: hosts yallla.club, my.yallla.club and our admin panel, keeps short request logs, and provides Web Analytics and Speed Insights on my.yallla.club.
Cloudflare Turnstile: checks that you are a person when you sign in, sign up, ask to join or post a brief. It receives your IP address and basic browser or device data.
Discord: our team gets internal alerts in a private Discord server. Alerts include names, usernames, account events (for example, signed up, activated, banned, username changed), brief titles, categories, budgets, up to 400 characters of a brief description, up to 160 characters of a proposal, proposal rates, and report reasons and notes. Alerts never include email addresses or the contact details saved on your account.
Expo: delivers push notifications to your iPhone through Apple's push service. It receives your push token and the notification text. Expo also delivers app updates, which means the app contacts Expo's servers.
Google Cloud Translation: translates a brief's text when you ask. We send only the text, with no account details. We store the translation with the brief.
Apple: distributes the app through the App Store and delivers push notifications. Apple handles App Store data under its own privacy policy.

Video services. Portfolio videos come from YouTube, Vimeo, Instagram and TikTok. When you view a portfolio, your device or our server may load thumbnails or the player from those services, and opening a video takes you to them. They receive your IP address and may set their own cookies, under their own privacy policies.

We may also share data if the law requires it, to protect people from harm or fraud, or if Fondry's business is sold or restructured. The new owner would have to respect this policy.

WHERE YOUR DATA GOES

Yallla is run from Kuwait. To provide the Service, your data is sent to and processed in these countries and regions:

India.

Supabase (Mumbai region): stores your account, profile, briefs, proposals, contact details, reports and uploaded images. It also runs sign-in and our server functions, and keeps database logs.

European Union.

Resend (Ireland): sends our emails, and keeps email delivery logs.
Sentry (Germany): stores crash and error reports.

United States.

Vercel: hosts our websites and admin panel, keeps request logs, and runs analytics on my.yallla.club.
Cloudflare Turnstile: runs the security check on sign-in, sign-up, joining and posting.
Discord: holds our internal team alerts.
Expo: delivers push notifications and app updates.
Google Cloud Translation: translates brief text when you ask.
Apple: distributes the app and delivers push notifications.
YouTube, Vimeo, Instagram and TikTok: serve video thumbnails and players when you view a portfolio.

Some of these providers also use servers in other countries to deliver their service.

We choose providers with appropriate security, and rely on their contract terms to protect data sent abroad.

When you continue past the sign-in or sign-up screen, you consent to your data being transferred to and processed in the countries and regions listed above. If you do not consent, do not continue and do not use the Service.

COOKIES AND LOCAL STORAGE

We do not set cookies on yallla.club or my.yallla.club.

On yallla.club, your browser's local storage keeps:

your sign-in session, so you stay signed in;
a brief you are writing, so it is not lost (the image is kept in the browser's IndexedDB);
your theme choice and recent searches.

In the app, your sign-in session is stored in the iOS Keychain. The app also stores your display settings and an unfinished sign-up on your device.

These are needed for the Service to work, and they stay on your device. Clearing your browser data or deleting the app removes them.

Vercel Web Analytics does not use cookies. Cloudflare Turnstile and embedded or linked videos from other services may set their own cookies.

YOUR NOTIFICATION CHOICES

Push notifications: turn them off in Settings, Notifications in the app, or in your iPhone settings.
Emails: turn off emails about briefs and proposals in Settings, Notifications, in the app or on yallla.club. Each of these emails also has a one-click unsubscribe link.

Some emails are service messages, and we send them whatever your notification settings are:

sign-in links;
the one-time check-in email after your brief ends. It is a service message about your own brief. It is sent regardless of your notification settings and has no unsubscribe link.

We may also send important messages about your account, the Terms, or this policy.

HOW LONG WE KEEP DATA

Account and profile: while your account is open.
Briefs: a brief stays live for 30 days, then stays in your account until you or we delete it, or you delete your account. Briefs our team removed stay until you delete your account.
Proposals: until the proposal or the brief is deleted, or you delete your account. An accepted proposal cannot be deleted by the talent.
Reports: until the brief, the reporter's account or the reported account is deleted.
Old username: after you change your username, the old one is held for you and forwards to your profile for 14 days.
Invite codes: the code records stay after you delete your account, but no longer link to you.
Database backups: daily backups are kept for 7 days. Deleted data can remain in backups for up to 7 days.
Server and request logs: Vercel logs are kept for 1 day. Supabase logs are kept for 7 days.
Crash and error reports (Sentry): 90 days.
Email delivery logs (Resend): 30 days.
Discord alerts: kept until we delete them.
Emails you send us: kept for communication and our records.

We may keep specific data longer if we need it for a legal claim, a request from the authorities, or an investigation into serious abuse, and only until that is resolved.

DELETING YOUR ACCOUNT

Delete your account in Settings, Account & security, in the app or on yallla.club, or email support@yallla.club.

When you delete your account:

your sign-in account, profile, contact details, briefs, proposals, reports, saved briefs, notifications and push tokens are deleted from our live database straight away;
your photo, portfolio images and brief images are deleted from storage;
copies in backups, logs, Sentry, Resend and Discord are deleted when they reach the end of the periods above;
contact details already shared with another user after an accept, and social media posts already published, are outside our control. You can ask us to remove our own social media posts.

YOUR RIGHTS

Wherever you live, you can ask us to:

give you a copy of your data;
correct data that is wrong (you can edit most of it yourself in Settings, Edit profile);
delete your data;
stop using your data for a particular purpose, including social media features;
withdraw a consent you gave, without affecting what we did before. If you withdraw consent to international transfers, we cannot keep providing the Service, so you will need to delete your account.

Email support@yallla.club. We may need to confirm it is you. We will reply within 30 days.

COMPLAINTS

If you are not happy with our answer, you can complain to an authority in Kuwait:

data privacy: the Communication and Information Technology Regulatory Authority (CITRA);
consumer matters: the Ministry of Commerce and Industry;
data breaches and cybercrime: the Cybercrime Department at the Ministry of Interior.

If you live outside Kuwait, you can also complain to the data protection authority where you live.

SECURITY

We use encryption in transit (HTTPS) and database access rules so that each user can reach only what they are allowed to see. Contact details are released only after an accept, and that rule is enforced in the database, not only in the app. Only our team can use the admin panel.

No system is perfectly secure. If a breach affects your data, we will tell you and explain what happened, as the law requires.

CHANGES TO THIS POLICY

We may update this policy. The date on this page shows the latest version. If a change is important, we will tell you by email or in the Service before it takes effect.

If we add paid options, we will update this policy first to explain what the payment provider processes and what records we must keep for accounting and tax.

CONTACT

Questions, complaints or data requests:

Yallla, Fondry Company for Custom Software Design and Programming, Kuwait support@yallla.club