OiYOiStudents in the same city, helping each other out
Privacy Policy
v1.16 applies from 11 November 2026
This page is the new version. Until then, v1.15 still applies. These changes are already live: WeChat IDs are no longer swapped; your hometown is no longer used to match you with anyone, and you can now choose any city in the world (optional); each keyring social link has its own switch; and Settings now has Report an issue, which saves your message, app version, browser identifier and handle and emails them to our team, but only when you choose to send it. Invite rewards open on 11 November 2026. Also from 11 November 2026, we'll keep a record against your account of the days you use the app, how often you open it, how long you spend in it and which features you use, for 90 days, so we can improve it. You can turn this off in Settings or email us to object.
The short version
We collect what we need to run the service: your university email, your tags, your posts and your chats. We don't collect your real name and we don't sell data. Chats are deleted 72 hours after everyone's read them. You can delete your whole account yourself, in the app, at any time.
Usage records. From 11 November 2026, we'll keep a record against your account of the days you use the app, how often you open it, how long you spend in it and which features you use, so we can improve it. It doesn't include your searches, your location or your messages. It's for internal use only, it's kept for 90 days and you can turn it off in Settings. See section 2.
Location. While the location button on the right of the map is on, the app reads your location in the foreground to show you on your own map. It stops when the app goes into the background or you tap the button again. One thing the app sends without you tapping anything: if you're on the map screen and stay in the same spot for 3 minutes, it sends your location (rounded to about 20 metres) to our server to ask "which place is this?", so a bubble can pop up for you to rate it. That location isn't stored in our database or written to logs, and it asks at most 4 times an hour. Every other location that leaves your phone does so because you did something: posting a Live (you choose friends, close friends or favourites; close friends by default; there's no public option; we ask you each time before it's posted, and only then attach a location to about 10 metres), a place you searched for and confirmed when posting a shout-out, a pick-up point for something you're selling (by default people only see a rough area of about 50 metres; the exact spot is shown only if you choose "show this place" on the confirmation card), your home (people who can visit see it only to about 200 metres), "I'm here" place check-ins, and the SIM card search (an approximate location of your home, to about 1 km, is sent to TfL and postcodes.io to work out coverage and isn't stored). There's no background location and no location history. See section 2 for details.
1. Who looks after your data
OiYOi (oiyoi.org) is currently run by its founder as an individual; the company hasn't been registered yet. Operator: Yubo Song. Under UK law, the operator is the "controller" of your personal data and is responsible to you under the UK General Data Protection Regulation (UK GDPR).
2. What we collect (and what we deliberately don't)
What we collect:
- University email address: it has to be a student email from a university (UK .ac.uk, US .edu, Australian .edu.au, and the Canadian, European and other universities on our list). We only use it to check that you're a current university student. We store it encrypted and hashed, never in plain text.
- Profile tags from the sign-up questions: generated from your answers when you join and used to suggest matches.
- Habit and interest tags (optional): you pick these yourself and can change them at any time.
- Gender and year of birth (from the welcome card when you sign up): gender is used for audience settings — some shout-outs are posted to, say, women only, and without it we can't tell whether you should see them. Year of birth is used to enforce the minimum age (you must be 18 or over; see section 9) and for rough age-range matching. We only store the year, not your birthday. You can change both under Me.
- Device token for notifications (only once you've allowed notifications): the push address Apple or Android gives this device, plus the device's browser identifier, used to deliver alerts like "someone replied to you". It's deleted when you turn notifications off or delete your account. It isn't an advertising identifier, and we don't use any advertising or tracking SDKs.
- Posts and photos: the help requests, plans, items for sale and other things you post. EXIF data (including GPS) is removed from photos when they're uploaded.
- Chat messages: messages you exchange to help each other out (kept only briefly; see section 4).
- Contact details (WeChat ID): we no longer swap WeChat IDs. They aren't shown even after you've both confirmed, so nobody can see yours. If you added one before, it's still stored encrypted and isn't used for anything else. You can delete it in one go under Settings › Account › Remove my WeChat ID (it's removed from our database straight away, and you'll only see this if you've added one). Otherwise it's deleted with your account. Older versions of the app still let you add one, but it isn't shown to anyone either.
- Area: the area you picked in the welcome questions (or set once from your location if you tapped "use my location once" in that question). Turning location on does not change it automatically and doesn't upload it.
- Location of a Live: when you post a Live we record where it was posted. You choose who can see it each time: friends, close friends (the default, meaning you've both marked each other as close friends) or favourites (close friends who've also both marked each other as favourites). All three need a relationship you've both agreed to, and there's no public option (anything sent as "public", or without a choice, from older versions of the app is stored as close friends only). Every time before posting, the app shows a card explaining that the Live will include your current location (to about 10 metres), that only the group you chose can see it, and that a Live can't be posted without a location. Your location is only attached if you tap "Agree and post"; tapping cancel takes you back to the post screen and nothing is uploaded. We record that consent (who, when, which Live and which group), and we ask again for your next Live. Older versions of the app don't show this card, so Lives posted from them only record a rough location to about 1 km. Lives and their files are deleted after 24 hours. EXIF data (including GPS) is removed from photos and location data is removed from videos on upload.
- Location of a shout-out or plan: you search for the place yourself on the map (by name, address or postcode); posting a shout-out doesn't read your current location. When you drop the pin, there's a line saying "Everyone on OiYOi can see this place". Only when you tap "Confirm" do we store that exact place (to about 1 metre), which all verified students can see. It's where you're meeting, not where you are. We also record when you confirmed it. The pin only shows your seagull handle. Coordinates sent from older versions of the app without this step are rounded by our server to an area of about 500 metres.
- Pick-up point for items you're selling: all verified students can see it, so by default we only store a rough location to about 50 metres, and the pin on the map sits on that rough location — enough to know which area, but not the front door. If you want buyers to find the exact spot, tap "Show exact location" on the post screen and choose "Show this place" on the confirmation card (the default is "Only show the rough area"). We record when you chose to show it. Pick-up points set from "My current location" can't be shown exactly.
- Home: when you set your home, its location is stored on our server, and only you can read the original coordinates.
You choose who can visit: close friends (the default) or favourites, and nothing looser. Ordinary friends, strangers and people you've blocked
can't even see whether you have a home. People who can visit can see:
- A little house on the map: our server rounds its position to a grid point about 200 metres across. There's no circle on the map and no address or house number; they can also see the name of the area your home is in.
- That you're "in": when you open your own home screen in the app, people who can visit see that you're "in". It disappears when you leave that screen, at the latest after about 90 seconds. This doesn't read your location; we only record when you last opened it.
- That you're "at home": only shown after you tap "I'm home" or turn on "Work out when I'm home" (off by default). When you tap "I'm home", your location at that moment is sent to our server to compare with your home, then thrown away, not stored. With "Work out when I'm home" on, only "home / not home" is uploaded, never coordinates. If neither is on, your door sign says "Out".
- Visiting: they can drop into your home in the app, and you and anyone else allowed in can see who's there right now (people drop off when they leave or after about 90 seconds of inactivity). This has nothing to do with where anyone actually is; visiting doesn't read location.
- Reviews: reviews written by others only show which day they were written, not the time.
- SIM card search (compares coverage from the four networks along your route from home to uni): when you open it, we round your home location to about 1 km (rounded on your phone first, then again on our server), or take only the first half of a postcode you type in (for example WC1E 6), and send that, together with your university's location (its public entrance), to TfL (Transport for London, for the route) and postcodes.io (to look up the borough). If we've switched on Ofcom's address-level coverage check, we also send Ofcom a postcode we've picked near that 1 km grid point — not your postcode. All of these are in the UK and receive no handle or account details. This location isn't stored in our database or written to logs; it's discarded once the result is worked out.
- A note when adding a friend or messaging a seller (optional): the other person can read it before they accept. It's stored encrypted and checked by a text filter before it's sent. A friend-request note is deleted once they accept or decline. A note to a seller becomes the first message in your chat once they accept (and is deleted under the chat rules in section 4), or is deleted if they decline. Until they accept, the seller only sees your tags (uni · age range · gender), not your handle. They can report or block you; if they report you, the note is attached to the report so we can deal with it. The start of the note appears in their lock-screen notification (without saying who it's from).
- Your coordinates for an "I'm here" check-in: when you tap this button, we send your device's exact coordinates at that moment to a public map service (an OpenStreetMap Overpass mirror) to ask "which named places are within 250 metres of you?". These coordinates aren't stored in our database or linked to your account; they're only used to get that list of places, and nothing identifying you (handle or account details) is sent with them. Which mirrors, and in which countries, is explained in section 5.
- Automatic place check-in (sent by the app without you tapping): while the location button is on and the app is open, the app counts on your phone how long you've been in the same spot (within about 35 metres). After 3 minutes, and only if you're on the map screen, it sends your location rounded to about 20 metres to our server to ask "which place is nearby?" — so a bubble can pop up on the map and you can rate the place with one tap. It asks at most 4 times an hour; if you move away (more than about 35 metres), the app goes into the background or you turn location off, the timer resets. Our server checks our own list of places first. Only if it can't find a place near you does it ask an OpenStreetMap Overpass mirror, in the same way as "I'm here" (with no handle or account details; see section 5). These coordinates aren't stored in our database or written to logs; they're discarded once the lookup is done, and we don't use them to record where you've been. If you don't want this, turn off the location button on the right of the map and it won't happen.
- Most recent activity: when your account last used the app, and which feature it was using at that moment (only the path of the request, not what you searched for, your location or any parameters). For this item we only keep the latest one; each new one replaces the last, so there's no history (daily records are separate: see "Usage records linked to your account" below). It's used for two things: recommendations only count accounts that have been active recently, and our admin dashboard counts active users and shows which features people online are using right now.
- Anonymous usage statistics: so we know which features people use most and roughly for how long, and can improve the app, the app counts three kinds of numbers that contain no identifying information: how many times a feature was used that day (opening Today's picks, posting a shout-out, signing up, sending a chat message, tapping a card, asking Yoi, visiting a home, adding a friend, posting); which band each app session falls into (under 1 minute / 1–5 minutes / 5–15 minutes / over 15 minutes), plus the total seconds and number of sessions that day (totals only; any single session counts for at most 1 hour); and how many times each main screen was opened that day and for how many seconds (Map, List, Chats, Explore, Flights, Me, Home, Dating, Today's picks, Yoi and Posts; totals only; any single visit counts for at most 30 minutes). These numbers are collected on your phone for a while and then sent to our server in batches (if they can't be sent, they're discarded). Our server only adds them to that day's totals: we don't record who you are, which device you used or your IP address. The database only holds "which day · which item · how many", so these totals can't be linked back to you. From 11 November 2026, the same numbers are also recorded against your account, as explained in the next item.
- Usage records linked to your account: from the date v1.16 applies (11 November 2026), we keep a record against your account of which days you used the app, how many times you opened it, how long you spent in it and which features and screens you used. We only record the names of features and screens (the ones listed in the item above), not what you search for, your location or the content of your messages. We use these records to understand which features are useful and whether people keep using the app, so we can improve it. They're for internal use only: we don't sell them, use them for advertising or give them to third parties. Only our admins can see them, and Railway, which runs our servers, holds them on our behalf and on our instructions (see section 6). We keep this detail for 90 days, then delete it or turn it into anonymous totals. If you delete your account, it's deleted with your account once the cooling-off period ends. To opt out, turn off "Share usage data" under Me › Settings, or email us to object. Older versions of the app don't have this setting, so just email us. Once you've opted out we stop recording this detail about you; the anonymous totals in the item above carry on as before. Anonymous figures collected before that date won't be linked back to anyone.
- Hometown (optional): under Me › Hometown you can search for any city in the world, or leave it blank (in older versions of the app it's a Chinese province or city, or "Mysterious East" to leave it blank). The city list is GeoNames open data held on our own server, so what you search for isn't sent to anyone else. Only you can see it: it's not public and doesn't appear on your profile or anywhere other people can see. Our audit log only records "set / cleared", not where; our staff can't see your hometown when they look at an individual account in the admin tools either. We know a hometown can reveal ethnic origin, so we treat it as sensitive information. You can change or remove it at any time, and it's deleted with your account.
- Invite records (invite rewards open on 11 November 2026): we store your invite code (7 random characters) and running count; the invite link between people (who invited whom, status, reason for any rejection and times); a keyed hash (HMAC) of the invited person's verified email address, with any "+tag" removed, to stop one person being counted twice (this is pseudonymised, not anonymous); which look you've unlocked; and audit records. Your phone stores a code waiting to be used and whether you've seen the prompts. We don't collect your address book, contacts, device IDs or App Store attribution data. IP addresses are only used in memory for rate limiting and aren't saved to our database. Who can see what: if you invite people, you see your code, how many have joined and how many choices you have, but not who they are. If you were invited, you only see your own code and rewards. If only a few people have joined, you may be able to guess who they are. Other users can't see who invited whom. Looks you've unlocked can be seen by people who visit your home. Our staff can look these records up in the database. We don't use them for marketing, profiling or automated decisions, and rewards have no cash value. See section 4 for how long we keep them.
- Issue reports (only if you write one): what you write to the team under Settings › Report an issue (up to 1,000 characters), along with your app version, your device's browser identifier (which shows the model and operating system) and your account, is stored in our admin tools. The full text, your seagull handle and app version are also usually emailed to the team's inbox (sent through Resend). It doesn't include your email address or IP address, and it isn't sent to AI. Please don't include passwords or other people's private details.
- Security and abuse signals: events such as hitting rate limits, failed log-ins and suspected scraping. IP addresses are only stored as hashes, which can't be reversed.
- Voice — two different things, explained separately (both only turn the microphone on while you're holding the mic button):
- Talking to Yoi (hold to ask): the recording is sent to a transcription provider to be turned into text and discarded straight away. On this route we don't keep the audio; it isn't saved to disk or to our database. We only keep the text it was turned into (just like a question you'd typed).
- Voice messages in chats: on this route we do keep the audio file, because the other person needs to be able to play it. The file follows the same rules as the message: deleted within 72 hours after everyone's read it, and after 7 days at the latest, and deleting the message deletes the audio file too.
- Apple account details (only if you choose Sign in with Apple): Apple only gives us your name and email address, nothing else. At Apple's step you can choose "Hide My Email", in which case we get a forwarding address from Apple and never see your real email address. We only use it to send you notifications (for example, the result of an identity check). ⚠️ Signing in with Apple doesn't mean you're in: it's just a way of logging in, and you still need to verify that you're a student or graduate.
- LinkedIn account details (only if you choose to sign in with or link LinkedIn): your name, email address, profile photo, and whether LinkedIn has officially verified you. Stored encrypted and deleted when you unlink.
- Photos of your student card or degree certificate (only if you apply for graduate verification, and only if you upload them yourself): stored encrypted, visible only to admins, and deleted as soon as a decision is made — we don't keep copies. You can blank out your student number and grades first; we only need to see your university and your name.
What we deliberately don't collect:
- Your real name — on OiYOi you're a seagull handle, plus an optional nickname (the exception: if you sign in with LinkedIn we receive your name, as above; if you don't use LinkedIn, we never get it);
- Your movements — there's no background location and no location history: the app doesn't read your location in the background, and we don't record where you've been or when. Your location is only read once, for the specific actions listed above, and stored at the precision described. To be clear, though: the app does read your precise location (to show you on your own map, for "I'm here" check-ins and automatic check-ins after 3 minutes in one spot; Lives you agree to post are stored to about 10 metres and only shown to the group you choose; and when you set your home we store its location, which only you can read precisely — everyone else only sees a grid point to about 200 metres), so in our App Store privacy label we declare "Precise Location", not "Coarse Location";
- Government ID such as passports, ID cards or visas — never. Graduate verification only looks at your student card or degree certificate, and deletes it afterwards (see above);
- Any payment details — OiYOi doesn't handle money, so it never touches your card.
Your communities
- What your choice does — it decides what you see first.
- Anyone can choose any community. You can choose up to two, and change them once a week.
- Your communities don't decide who you are or who you can meet. A few things do depend on whether you chose the Chinese community, because they follow language: which official group chat you join, whether Flights (UK–China routes only) appears, whether you're shown partner events written only in Chinese, and whether posts mostly in Chinese are suggested to you. You can still open those posts from a profile or a link.
- We don't ask for your nationality or background to do this, and we don't work them out from your name, language, location, email or anything else.
- Your communities aren't shown on your profile.
- Our admin tools only show how many people chose each community, never who, and show small numbers as "under 5". If you sign up for a partner organisation's event, that organisation sees whether to contact you in English or Chinese, which comes from whether you chose the Chinese community. It doesn't see your communities.
- You can remove your choices at any time in Settings › My communities, or delete your account. We keep the time of each change so the once-a-week limit works; removing your choices wipes what you chose, including past changes.
3. Why we collect it (our lawful bases, in plain English)
- To run the service (performance of a contract): without email verification we can't confirm you're a student, without tags we can't suggest matches, and without chat you can't help each other out.
- To keep everyone safe (legitimate interests): handling reports, banning scammers and harassers, filtering prohibited content and stopping fake or abusive accounts. We've weighed this up: the impact on your privacy is small and the benefit to the community is clear.
- Things you've agreed to (consent): photos of your student card or degree certificate, the device token for notifications, your optional hometown (see section 2), shout-out locations you've confirmed on the map, pick-up points you've chosen to show on the confirmation card, Yoi sending what you say to third-party AI (we ask you first; see section 5), sharing your details with a partner organisation when you sign up for its event, and the accounts you switch on in your keyring social links (see section 6). You can use OiYOi without any of these; you just won't be able to use the related features. You can change your mind at any time — see "Withdraw your consent" in section 8.
- To make the app better (legitimate interests): the anonymous usage statistics in section 2 — daily totals only, which can't identify anyone — and the usage records linked to your account. Our legitimate interest is understanding which features are useful and whether people keep using the app, so we can improve it. These records only go as far as the names of features and screens, are for internal use only and are kept for 90 days, and you can opt out or object at any time.
- Invite rewards: running invites and giving out rewards is performance of a contract (legitimate interests where that doesn't cover it). Stopping one person being counted twice or gaming rewards is legitimate interests. We've weighed this up: we only store a pseudonymised email hash, delete it on schedule and don't use it for anything else.
- To answer your questions and fix bugs (legitimate interests): issue reports you write to us, used only to deal with what you've told us about.
We don't use your data for advertising or for any analysis unrelated to the purposes above.
4. How long we keep it
- Chat messages: permanently deleted within 72 hours after everyone in the chat has read them, and after 7 days at the latest whether or not they've been read. The exception: if someone saves a "snapshot" of a message, the person who saved it keeps that snapshot, and it isn't deleted with the original.
- Everything else (email, tags, posts, photos, encrypted WeChat ID): kept for as long as your account exists. When you ask to delete your account, it first goes into a cooling-off period (your account is disabled and you can change your mind and restore it at any time). Once that period ends, your data is permanently deleted.
- Moderation and security audit records (reports, bans, admin audit logs, account action logs): these have no automatic deletion date. After you delete your account, the "who did it" field is cleared, but your account ID may stay in the "what it's about" field. Without these records, deleting an account would be a way to wipe the slate clean, and people who'd been harassed wouldn't be protected. Our lawful basis for this is our legitimate interest in preventing fraud and abuse.
- Invite records: unverified invites are deleted after 90 days. All other records, including the email hash, are deleted 180 days after they were created. Your invite code, running count and unlocked looks are kept for as long as your account exists. When your account is permanently deleted, those go too. Your account ID is cleared from invite records, but the record and email hash stay until the 180 days are up, to stop people deleting an account to claim rewards again. The other person keeps their reward. Related audit records (using a code, unlocking a look) are handled like the moderation and security audit records above.
- Issue reports: like moderation records, these have no automatic deletion date. When you delete your account the "sent by" field is cleared, but what you wrote stays (including anything in it that could identify you). The email to the team's inbox includes your handle and isn't deleted automatically; email us if you'd like it deleted.
- Usage records linked to your account (see section 2): this detail is kept for 90 days, then deleted or turned into anonymous totals. If you delete your account, it's deleted with your account once the cooling-off period ends. After deletion, copies in our encrypted backups remain until those backups are overwritten, usually after about 30 days.
- Reported or preserved conversations are an exception: if someone reports a conversation, or anyone in it taps "Preserve evidence", deletion of its messages is paused for up to 180 days, after which normal deletion resumes automatically. Why: people who've been scammed or harassed often only report it a few days later, by which time the evidence would normally be gone — and without evidence, the person affected can't do anything about it. Preservation only applies to the conversation that was reported or flagged by someone in it; it doesn't mean everyone's chats are kept longer. The lawful basis is processing necessary to establish, exercise or defend legal claims.
- Security logs (failed log-ins, rate limits, unusual access): automatically deleted after 90 days. They only record the time, which address was accessed and a number that can't identify you, so we can spot attacks or scraping. 90 days is long enough to investigate an ongoing attack; keeping them longer would just mean holding on to a trail of your activity, so we clear them.
5. Where it's stored (and what leaves Europe)
Data we store is kept in Europe: our database and servers are in Railway's European region (the Netherlands), photos, voice messages and videos are stored on Cloudflare R2's European locations, and verification emails are sent through Resend. The UK recognises Europe's level of data protection (an adequacy decision), so storing it there is compliant. We won't move the account database outside Europe.
But a few things are sent outside Europe in real time, and we want to be upfront about them — they're sent to be processed once, not moved there to be stored:
- We ask before anything is sent: the next three items (conversations with Yoi, voice transcription and photos sent to Yoi) all use third-party AI. The first time you type, send a photo or hold to talk to Yoi, the app shows a card explaining who it goes to, what's sent and what isn't. Nothing is sent until you tap "Agree and continue"; if you tap "No thanks", nothing is sent, Yoi's input box shows a small lock, and the map and everything else work as normal. If the wording of that explanation changes, we'll ask you again. You can withdraw your consent at any time under Me › Settings › AI services Yoi uses, after which nothing more is sent. Our server records which version of the explanation you agreed to and when (and when you withdraw) — without that record, our server won't pass anything on for Yoi.
- US · Conversations with Yoi: what you say to Yoi is sent to Anthropic (or OpenAI if we haven't set up an Anthropic key), both in the US. Along with what you've just said and the last few turns of the conversation, it includes your seagull handle, the nickname you chose and the name of the area you're usually in (so it knows what to call you and which area to look at first). It doesn't include your real name, email, contact details or your phone's location. When you ask Yoi to plan a route or find somewhere, the place names you mention (such as "UCL" or "Heathrow") are sent to TfL (Transport for London), OpenStreetMap's place search and postcodes.io to turn them into points on the map, and the start and end of the route are sent to TfL to look up services. These aren't AI services, they're in the UK and Europe, and they only receive place names and coordinates — no handle or account details.
- US · Voice transcription: the recording when you hold to talk to Yoi is sent to Groq (or OpenAI as a fallback), both in the US. To help it catch place names, we also send a list of place names in the area you're usually in (public information anyone can see on the map). The audio is discarded once it's transcribed, and the request includes no handle, nickname or account details.
- US · Photos you send to Yoi: photos you take with the camera button on Yoi's screen (or choose from your photo library) are sent with your message to Anthropic (or OpenAI if we haven't set up an Anthropic key) — it needs to see the photo to answer. It's sent once only: the photo isn't added to the conversation history, your next message won't send it again, and we don't keep a copy. This only happens when you tap the camera button yourself — we never look through your photo library.
- US · AI checks on posts and comments: when you post or comment, the text and images (title, body, comment and any photos you upload) are first checked by Anthropic's AI — for things that aren't allowed, such as sexual content, violence, hate or harassment, illegal trading, spam or other people's personal information. For images we send a smaller copy we've made ourselves (no longer than 1024 pixels on the long side), with all EXIF data such as where it was taken removed; videos aren't sent (our team checks video posts). It includes none of your handle, account, email, university, area or coordinates. Posts that are clearly fine are published straight away, borderline ones go to our team, and posts that clearly break the rules aren't published and we tell you which rule. This step keeps what everyone sees safe (our lawful basis is legitimate interests), so we don't show a separate consent card — if you don't want it, you can choose not to post or comment, and browsing isn't affected. Our moderation records only keep the category of decision and a one-line reason; we don't keep a separate copy of your content. The same applies to reports: reported content (a post, comment, shout-out, item for sale, review, the reported message in a private chat, or a profile) and the reason for the report are also sent to the same AI to judge how serious it is — only to handle the report, and without anyone's handle (neither the reporter's nor the reported person's).
- The coordinates for an "I'm here" check-in are sent within the EU: this feature queries OpenStreetMap's public Overpass mirrors — overpass-api.de (Germany) and overpass.kumi.systems (Austria), both in the European Economic Area. All they receive is the coordinates at that moment and the query "find named places nearby", with no handle or account details, and we don't keep those coordinates. This only happens in two cases: when you tap "I'm here", or when the automatic check-in described in section 2 can't find a place near you in our own list (in which case the location sent is rounded to about 20 metres). (Until 31 August 2026 this list also included a mirror run by Russia's VK / Mail.ru, and it was first in line; the founder decided to remove it that day. We've left this note here rather than pretend it never happened.)
What allows us to send it: the EU Standard Contractual Clauses (SCCs, Modules 2 and 3) apply between us and these three providers (Anthropic, Groq and OpenAI), together with the UK Information Commissioner's International Data Transfer Addendum (template B.1.0, as laid before the UK Parliament on 2 February 2022). Both took effect when we accepted their commercial terms, and under UK law they are the "appropriate safeguards" required by Article 46. We've also carried out a transfer risk assessment, which concluded that what we send is already minimised (the voice route sends nothing that could identify you, and the conversation route sends no email, contact details or precise coordinates) and proportionate to the risk at the destination. We review it regularly, and redo it straight away if we change provider or start sending more.
In every case, we only send the minimum needed to handle that one request. The account database, chat history, map data and graduate-verification photos never leave Europe.
6. Who we share it with
- We don't sell data or share it with advertisers. No exceptions.
- Infrastructure providers ("processors" acting on our instructions): Railway (servers), Cloudflare (images and network) and Resend (email). They only store and transfer data for us and can't use it for their own purposes.
- AI and transcription providers (also "processors" acting on our instructions, all in the US; see section 5): Anthropic (conversations with Yoi, falling back to OpenAI if we haven't set up an Anthropic key) and Groq / OpenAI (turning what you say into text). We only send what's needed for that one request. To be precise: the Yoi route includes your seagull handle, the nickname you chose and the area you're usually in — it needs to know what to call you and which area to look at first. It doesn't include your email, contact details or precise coordinates. Photos you send to Yoi go the same way (sent once, not added to history, and we don't keep a copy). AI checks on posts and comments also go to Anthropic: only the text of the post and a smaller copy of each image with EXIF removed, with no handle or account details (see section 5). When handling a report, the reported content (a post, comment, shout-out, item for sale, review, the reported message in a private chat, or a profile) and the reason are also sent to it to judge how serious it is — only to handle the report, again without anyone's handle. The transcription route sends nothing that could identify you. Our contracts say they must not use it to train their models.
- Data sources for the SIM card search: only when you open the SIM card search, an approximate location of your home (to about 1 km, or the first half of your postcode) and your university's public location are sent to TfL (routes) and postcodes.io (borough), and, if we've switched on Ofcom's address-level check, a postcode we've picked is sent to Ofcom. All are in the UK, no account details are sent, and we don't store that location (see section 2).
- Map lookup mirrors: only when you tap "I'm here", or when the automatic check-in can't find a place near you in our own list, coordinates are sent to OpenStreetMap's public Overpass mirrors to get a list of nearby places (one in Germany and one in Austria, both in the European Economic Area; see section 5).
- Apple: only if you tap "Sign in with Apple" yourself — at that point you're signing in with Apple (Face ID or your password stay within Apple's screens and we never see them), and Apple only sends us your name and email address. If you don't use it, this never happens.
- Apple Maps (areas we haven't hand-drawn): in areas we haven't hand-drawn yet, the base map comes from Apple (MapKit JS). When that part of the map is shown, your device requests map data directly from Apple, so Apple can tell roughly which area the map is showing (to within a few hundred metres), as well as your IP address, device and language. When the map is following your location, that area is also roughly where you are. We don't send your location, account or any personal details to Apple, and we don't use Apple's search, directions or geocoding services. In areas we have hand-drawn, the map doesn't go through Apple at all. For how Apple handles these requests, see Apple's explanation.
- LinkedIn: only if you tap "Sign in with LinkedIn" or "Link LinkedIn" yourself — at that point you're signing in with LinkedIn, and LinkedIn sends us your name, email address and verification categories. If you don't use it, this never happens.
- Partner organisations (student societies, students' unions, university departments and similar). This only happens when you sign up for an event run by one of our partner organisations and tick the consent box on the sign-up form. At that point we share your university email address, university, gender, age range and your answers to the sign-up questions with the organisation running that event, so they can use them for that event only (for example, check-in and event updates). Our lawful basis is your consent (Article 6(1)(a) UK GDPR). If you don't tick the box, you can't sign up and nothing is shared. Once the organisation receives your details, it is responsible for its copy as an independent controller, and our agreement with each organisation requires it to use them only for that event and not pass them on. To withdraw, tap "Withdraw my sign-up" on the event page: we delete your answers straight away, you leave the event chat, and the organisation can no longer see you. If they've already exported a list, we'll ask them to remove you from it. You can also email us (see section 1).
- Keyring social links (NFC). These are optional and added by you under Me › My card › Keyring social links (WhatsApp, Instagram, WeChat ID or QR code, RedNote, Snapchat, TikTok, Douyin and LinkedIn). Every link is off by default, and there's no main switch: each one has its own switch, and only the ones you switch on are shown, and only to people who tap or scan your keyring. They open the app themselves; we don't add anyone for you. Your links never appear in public lists, search or on the map, and your email is never shown. Our lawful basis is your consent (Article 6(1)(a) UK GDPR). To withdraw, switch a link off and it disappears straight away, but we keep it on our servers so you don't have to retype it; clear a link and save to delete it from our servers. Everything is deleted when you delete your account. If you'd turned the old main switch off, everything counts as off after you update. Older versions of the app still have the main switch, and nobody can see your links while it's off.
- Law enforcement: if we receive a lawful request from the police or another authority (for example, in a fraud case), we'll comply as the law requires.
7. Cookies
We only use strictly necessary session cookies to keep you logged in — no tracking or advertising cookies. Under the UK's PECR rules these don't need consent, which is why you won't see a cookie banner: there's simply nothing to agree to. (The iOS app doesn't use cookies; your log-in token is stored on your device.)
8. Your rights
Under the UK GDPR you can:
- See your data: ask for a copy of the data we hold about you;
- Correct it: fix anything that's wrong (you can change your tags and nickname yourself in the app);
- Delete it: go to Me → Delete account and do it yourself in the app — no need to email anyone. There's a cooling-off period in case you change your mind; after that your data is permanently deleted, as described in section 4;
- Restrict or object: object to processing based on legitimate interests. You can opt out of usage records linked to your account under Me › Settings, or by emailing us;
- Take it with you (data portability): ask for a machine-readable copy of the data you've given us, or ask us to send it straight to another service — this covers data processed automatically on the basis of contract or consent;
- Withdraw your consent: you can take back any of the things in section 3 that are based on consent at any time, and this doesn't affect anything we did before you withdrew. How: for the notification token, turn notifications off in your phone's settings; for exact locations you've shown, delete or take down that post; for partner event sign-ups, tap "Withdraw my sign-up"; for keyring social links, switch a link off (it's no longer shown, but we keep it) or clear it and save (it's deleted from our servers); for student card or certificate photos, they're already deleted once a decision is made — if it's still being reviewed, email us to stop it and we'll delete them straight away and review your application from the written details instead.
There's only one automated decision, and a person always backs it up. Posts and comments are checked by AI first (see section 5): posts that are clearly fine are published straight away, borderline ones go to our team, and posts that clearly break the rules aren't published and we tell you which rule. We spot-check a proportion of what the AI lets through and take down and notify you about anything it got wrong. If you think a decision was wrong, edit and post again, or email us and a person will review it. Graduate verification uses an internal score, but it's only a signal to help our reviewers prioritise; whether you're approved is always decided by a person. Apart from that, we don't make purely automated decisions with legal or similarly significant effects on you.
What you have to give us: only your university email — without verifying it we can't confirm you're a current university student, so you can't join. Everything else is optional; if you don't provide it, you just can't use the related feature.
To exercise your rights, email hello@oiyoi.org and we'll reply within one month. If you think we've handled your data wrongly, you can complain to the UK regulator, the ICO (ico.org.uk) — but please come to us first; most things can be sorted out with a quick conversation.
9. Under-18s
OiYOi is only for people aged 18 or over. If we find an account belonging to someone under 18, we'll delete the account and its data.
10. Changes to this policy
If this policy changes in a meaningful way (for example, we start collecting a new type of data or change provider), we'll let you know in advance somewhere prominent in the app, and ask you to confirm again for major changes. Small wording changes are made directly and dated.