Privacy Policy
The short version
Oya is built so that nobody, including us, can produce a list of where people will be tonight. A plan shows only its neighbourhood until you join it. Your position is never stored. A plan is deleted an hour after it ends. There's no feed, no history, no analytics, no advertising, and no account unless you want one.
This policy says exactly what the app does with your data. If anything here is wrong, then the app is wrong, and we'll fix the app.
What we hold about you
If you're a guest: a random identifier created on your phone the first time you continue past the welcome screen, the time you agreed to these terms, and nothing else until you do something.
If you make an account: how you signed in. With Apple: the identifier Apple gives us for you, and your name and email address if you chose to share them (Apple can hide your address behind a relay address, and we treat that as your address). With Google: the identifier Google gives us for you, your email address, and your name, which becomes your name in Oya only if you haven't set one. With a phone number: the number, which we send a code to and use for nothing else. With email: the address and a password. The password is stored only in hashed form. We don't verify the address, and we don't send email to it.
A name, if you set one. It can be anything you like. It's what people on a plan with you see, and what a friend searches for.
A profile photo, if you add one: a small square copy of a photo you choose or take, shown next to your name wherever your name is shown. Anyone who has its link can open it. Oya only uses the photos and the camera when you choose to add one, and takes nothing else from your library. Removing it in the app deletes it.
Your plans, while they exist: the title, the time, the place, who may see it, and who said they're coming, plus a ticket link and a room or entrance if you add them. Your spot on plans you joined, whether you checked in, what you wrote in a plan's chat, with when you sent it, and the songs you asked for and voted for. All of this is deleted an hour after the plan ends.
Groups you're in: the group's name, the currency its money is counted in, who is in it, and its link. What's said in a group's chat, with who said it and when, for 30 days, after which it's deleted. The group's money: each expense (who paid, how much, what for and who it was split between) and each payment between members, and each goal with what each member logged towards it. Oya never holds or moves money; these are records the group keeps for itself. The money and goals are kept as long as the group exists.
Your friends and the requests between you. A link you can share that lets someone add you as a friend; it shows your name to whoever opens it, and nothing else. The people you've blocked. Reports you've sent.
If you turn on notifications: a token that identifies your phone to Apple's push service, kept with your account so we can tell you when a friend posts a plan, or when someone says something in a group you're in. You can turn a group's notifications off in the group. Nothing else about your phone.
Feedback you send from the app: what you wrote, the app's build number, the kind of phone and its iOS version, the screen you were on, and the plan you were looking at if there was one. No position and no device identifier. We read it, and so does a tool we run that drafts code changes for us to review. Every few days the app may ask what Oya should add next; what you answer is feedback like this.
If you host: your credit balance, each top-up and its Stripe reference, and each check-in a featured plan was charged for, with the plan's title. A host sees how many people said they're coming and how many checked in, never who. The code that signs you in to the host page lasts ten minutes, and the sign-in twelve hours. If you pay monthly: Stripe's references for the subscription and each month's payment, and the date it runs to.
If you host and connect Spotify on the host page: your Spotify name, whether it is Premium, and the keys Spotify gives us to see what is playing and to add songs to your queue, which stay on our servers and never reach anyone's phone. While a plan of yours is on and taking song requests, from fifteen minutes before it starts until it ends, the song playing on your Spotify is shown to the people going. At no other time is it shown to anyone. Disconnecting on the host page, or deleting your account, deletes all of it.
If you apply to sponsor an event on the sponsor page: your organisation's name and website, the email you gave, what you wrote, and whether you were accepted and paid. Only Oya's admins see it. Once you've paid, your organisation's name and website are shown on the event to everyone.
A count of the times you showed up, and nothing about where. For 24 hours after a check-in we also hold which plan it was, so the same plan can't be counted twice. After that, the link to the plan is removed.
Your points and level, worked out from the check-ins the app confirmed you were at. If you host: a running total of points from the people who checked in at your plans, and, while a plan exists, who has already counted toward it, which is deleted with the plan. Points can't be bought, sold, sent to anyone or turned into money. A perk a host offers on a plan, and its code, are the host's: Oya shows them and shows the code only to people at the level the host chose.
Location
The map centres on you using the position from your phone. That position isn't sent to us. The app asks our server what's on in the neighbourhoods you're looking at, never for a point.
A plan's exact place, and its room or entrance if it has one, are shown only to people who have joined it. Until then, they see the neighbourhood, which is about a kilometre across.
When you search for a place while posting a plan, the text you typed and the centre of the neighbourhood you're in, rounded to about a kilometre, are sent to our server and to OpenStreetMap's Nominatim service to list nearby places. A place you add to the map comes from that search, with OpenStreetMap's coordinates for it, or from a spot you press and hold on the map. Either way it's a place you chose, not where your phone is. We keep a record of which account added a place, to limit abuse. That record isn't shown to anyone.
When you press and hold the map to start a plan, that spot is sent to Apple to look up its address, and saved as the place for your plan.
When you check in, the app takes one location fix and sends it to our server. The server compares it to the place and keeps only yes or no, and how far away you were if the answer was no. The coordinates aren't stored and aren't logged. Oya never reads your location in the background.
While you write a plan for everyone, its title, time, ticket link and neighbourhood are sent to our server to list plans already up for the same event. We look for the same ticket link, or a similar title near the same time in the same neighbourhood, never the address. Nothing is kept until you post.
Who can see what
A plan for everyone shows its title, time, neighbourhood, ticket link if it has one, and how many people are in to anyone nearby, with no name attached. Who's going, the exact place and the room or entrance are shown only to people who join. A plan more than a day away isn't on the map until the day before; until then only people with its link see it.
A plan for friends shows the same, plus your name, to your accepted friends only.
A plan sent by link doesn't appear on the public map. It's shown to whoever opens the link, and the link can be passed on.
Your name, and whether you checked in, are visible to the other people on a plan you joined. Your count, your friends list, your blocks and your reports are visible to you alone.
A plan's chat is seen only by the people who are in that plan, while they're in it, and is deleted with the plan. So are its song requests: what was asked for, by whom, and how many voted.
A group, its chat, its money and its goals are seen only by the people in it. Someone with the group's link sees its name and how many are in it, and nothing else, until they join. Someone who leaves a group stays in its money records, so the totals stay true, but can no longer see the group.
Blocking someone removes you from each other's maps, plans, chats and searches. They aren't told.
Reports
When you report a plan, a message (in a plan or a group) or a person, we keep the report: the reason, anything you wrote, which account made it, and which account it's about. Because a plan is deleted soon after it ends, we also keep a copy of what you were looking at: the plan's title, time, neighbourhood and the name of its place; the message's words, who sent it and when; or the person's name at the time. No coordinate and no position are kept.
A person reads every report within 24 hours. The person reported isn't told who reported them. A report survives either account being deleted, with the link to the deleted account removed.
Who processes data for us
Supabase hosts our database and sign-in, and runs the function that deletes accounts. When you log in with a phone number, the code is sent by text message through Twilio, which receives your number.
Apple provides the map in the app, the names of the areas you look at and of the neighbourhood of a plan you send, and the address for a spot you press on the map. Apple receives the map areas you look at, that neighbourhood's centre, and that spot, under Apple's own privacy policy. If you sign in with Apple, Apple handles that sign-in under its own privacy policy.
OpenStreetMap provides place search (Nominatim) and the map image on the plan link page. Its servers receive the search text and the neighbourhood described above, and the neighbourhood of a plan whose link is opened. We don't send it who you are.
Expo hosts the plan link page. The plan's identity travels after the # in the link, which browsers don't send to the host, so the host doesn't learn which plan was opened.
Expo and Apple send notifications, if you turn them on. Expo's push service receives your phone's token and the words of each notification, which are who posted and the plan's name, or the group's name and who sent a message, and passes them to Apple, each under its own privacy policy. A notification never says where a plan is or when it is, and never what was said in a group.
Nobody else. There are no analytics, no advertising networks and no crash reporting services in the app.
A ticket link on a plan opens the ticket site, such as Posh or Eventbrite, in your browser or its app, under that site's own privacy policy. We don't send it who you are, and we don't sell or hold tickets.
Stripe takes card payments from hosts who add credit, under Stripe's own privacy policy. Your card details go to Stripe, never to Oya. We receive the amount, Stripe's reference for the payment, and which Oya account it was for.
Spotify, if a host connects it, under Spotify's own privacy policy. Spotify receives the searches people make for songs to request, without who made them, and, for a connected host, our requests to see what is playing and to add a song to their queue.
Anthropic, whose Claude reads the feedback you send so it can be sorted and summarised for us. It receives what you wrote, the screen and the app's build, never who sent it or anything about your phone, under Anthropic's own commercial terms.
If you sign in with Google, Google handles that sign-in under its own privacy policy. We receive your Google identifier, email address and name, and nothing else from your Google account.
Keeping and deleting
A plan, and everything about who joined it, is deleted an hour after it ends by a job that runs every fifteen minutes. The daily count of plans you joined is kept for two days, to limit abuse, and then deleted.
You can delete your account, or your guest, from inside the app. It happens immediately. It removes your login, your name, your photo, any plan you posted that's still up, your spot on plans you joined, your messages in plan chats and groups, your friends, requests and blocks, your phone's notification token, and your count. Places you added to the map stay, with nothing saying who added them. Reports stay, with the link to your account removed.
Notifications waiting to be sent are deleted after a week.
A group's messages are deleted after 30 days. A group is deleted when its last member leaves, with its chat, money and goals. Deleting your account leaves your expenses, payments and goal entries in the groups you were in, with nothing saying they were yours, so the other members' totals stay true.
Our hosting provider keeps short-lived backups of the database for disaster recovery. Deleted data may remain in those backups for a limited time before it's gone from there too.
Your choices
You can use Oya without an account, without a name, and without turning on location. With location off, you move the map by hand and can't check in.
You can see and change your name, your photo, your friends and your blocks in the app. To exercise any other right over your data, or to ask what we hold, write to help@adigunllc.com from the address on your account, or describe your guest from inside the app's help page.
You can turn notifications off in Profile, or in your phone's Settings.
Age
Oya is for people aged 17 and over. We don't knowingly collect anything from anyone younger. If you believe someone under 17 is using Oya, tell us at help@adigunllc.com and we'll remove the account.
Security and changes
Data travels encrypted between the app and our servers. Access to the database is restricted to what each screen needs, enforced on the server, and tested before every release.
We may update this policy. The date at the top is the date of the current version. We'll show you a material change in the app before it applies. Questions go to help@adigunllc.com.
Contact
Questions, reports, or a request about your data: help@adigunllc.com