Privacy Policy

Effective date: 2026-11-03 · Version v1.15 · Covers oiyoi.org and the iOS app · Change history is at the end of this page · 中文版

1. Who looks after your data

OiYOi (oiyoi.org) is currently run by its founder as an individual; the company hasn't been registered yet. Operator: Yubo Song. Under UK law, the operator is the "controller" of your personal data and is responsible to you under the UK General Data Protection Regulation (UK GDPR).

2. What we collect (and what we deliberately don't)

What we collect:

• University email address: it has to be a student email from a university (UK .ac.uk, US .edu, Australian .edu.au, and the Canadian, European and other universities on our list). We only use it to check that you're a current university student. We store it encrypted and hashed, never in plain text.
• Profile tags from the sign-up questions: generated from your answers when you join and used to suggest matches.
• Habit and interest tags (optional): you pick these yourself and can change them at any time.
• Gender and year of birth (from the welcome card when you sign up): gender is used for audience settings — some shout-outs are posted to, say, women only, and without it we can't tell whether you should see them. Year of birth is used to enforce the minimum age (you must be 18 or over; see section 9) and for rough age-range matching. We only store the year, not your birthday. You can change both under Me.
• Device token for notifications (only once you've allowed notifications): the push address Apple or Android gives this device, plus the device's browser identifier, used to deliver alerts like "someone replied to you". It's deleted when you turn notifications off or delete your account. It isn't an advertising identifier, and we don't use any advertising or tracking SDKs.
• Posts and photos: the help requests, plans, items for sale and other things you post. EXIF data (including GPS) is removed from photos when they're uploaded.
• Chat messages: messages you exchange to help each other out (kept only briefly; see section 4).
• Contact details (WeChat ID): stored encrypted and hidden from everyone. They're only swapped once both of you have confirmed you're going ahead.
• Area: the area you picked in the welcome questions (or set once from your location if you tapped "use my location once" in that question). Turning location on does not change it automatically and doesn't upload it.
• Location of a Live: when you post a Live we record where it was posted. You choose who can see it each time: friends, close friends (the default, meaning you've both marked each other as close friends) or favourites (close friends who've also both marked each other as favourites). All three need a relationship you've both agreed to, and there's no public option (anything sent as "public", or without a choice, from older versions of the app is stored as close friends only). Every time before posting, the app shows a card explaining that the Live will include your current location (to about 10 metres), that only the group you chose can see it, and that a Live can't be posted without a location. Your location is only attached if you tap "Agree and post"; tapping cancel takes you back to the post screen and nothing is uploaded. We record that consent (who, when, which Live and which group), and we ask again for your next Live. Older versions of the app don't show this card, so Lives posted from them only record a rough location to about 1 km. Lives and their files are deleted after 24 hours. EXIF data (including GPS) is removed from photos and location data is removed from videos on upload.
• Location of a shout-out or plan: you search for the place yourself on the map (by name, address or postcode); posting a shout-out doesn't read your current location. When you drop the pin, there's a line saying "Everyone on OiYOi can see this place". Only when you tap "Confirm" do we store that exact place (to about 1 metre), which all verified students can see. It's where you're meeting, not where you are. We also record when you confirmed it. The pin only shows your seagull handle. Coordinates sent from older versions of the app without this step are rounded by our server to an area of about 500 metres.
• Pick-up point for items you're selling: all verified students can see it, so by default we only store a rough location to about 50 metres, and the pin on the map sits on that rough location — enough to know which area, but not the front door. If you want buyers to find the exact spot, tap "Show exact location" on the post screen and choose "Show this place" on the confirmation card (the default is "Only show the rough area"). We record when you chose to show it. Pick-up points set from "My current location" can't be shown exactly.
• Home: when you set your home, its location is stored on our server, and only you can read the original coordinates. You choose who can visit: close friends (the default) or favourites, and nothing looser. Ordinary friends, strangers and people you've blocked can't even see whether you have a home. People who can visit can see:
  • A little house on the map: our server rounds its position to a grid point about 200 metres across. There's no circle on the map and no address or house number; they can also see the name of the area your home is in.
  • That you're "in": when you open your own home screen in the app, people who can visit see that you're "in". It disappears when you leave that screen, at the latest after about 90 seconds. This doesn't read your location; we only record when you last opened it.
  • That you're "at home": only shown after you tap "I'm home" or turn on "Work out when I'm home" (off by default). When you tap "I'm home", your location at that moment is sent to our server to compare with your home, then thrown away, not stored. With "Work out when I'm home" on, only "home / not home" is uploaded, never coordinates. If neither is on, your door sign says "Out".
  • Visiting: they can drop into your home in the app, and you and anyone else allowed in can see who's there right now (people drop off when they leave or after about 90 seconds of inactivity). This has nothing to do with where anyone actually is; visiting doesn't read location.
• Reviews: reviews written by others only show which day they were written, not the time.
• SIM card search (compares coverage from the four networks along your route from home to uni): when you open it, we round your home location to about 1 km (rounded on your phone first, then again on our server), or take only the first half of a postcode you type in (for example WC1E 6), and send that, together with your university's location (its public entrance), to TfL (Transport for London, for the route) and postcodes.io (to look up the borough). If we've switched on Ofcom's address-level coverage check, we also send Ofcom a postcode we've picked near that 1 km grid point — not your postcode. All of these are in the UK and receive no handle or account details. This location isn't stored in our database or written to logs; it's discarded once the result is worked out.
• A note when adding a friend or messaging a seller (optional): the other person can read it before they accept. It's stored encrypted and checked by a text filter before it's sent. A friend-request note is deleted once they accept or decline. A note to a seller becomes the first message in your chat once they accept (and is deleted under the chat rules in section 4), or is deleted if they decline. Until they accept, the seller only sees your tags (uni · age range · gender), not your handle. They can report or block you; if they report you, the note is attached to the report so we can deal with it. The start of the note appears in their lock-screen notification (without saying who it's from).
• Your coordinates for an "I'm here" check-in: when you tap this button, we send your device's exact coordinates at that moment to a public map service (an OpenStreetMap Overpass mirror) to ask "which named places are within 250 metres of you?". These coordinates aren't stored in our database or linked to your account; they're only used to get that list of places, and nothing identifying you (handle or account details) is sent with them. Which mirrors, and in which countries, is explained in section 5.
• Automatic place check-in (sent by the app without you tapping): while the location button is on and the app is open, the app counts on your phone how long you've been in the same spot (within about 35 metres). After 3 minutes, and only if you're on the map screen, it sends your location rounded to about 20 metres to our server to ask "which place is nearby?" — so a bubble can pop up on the map and you can rate the place with one tap. It asks at most 4 times an hour; if you move away (more than about 35 metres), the app goes into the background or you turn location off, the timer resets. Our server checks our own list of places first. Only if it can't find a place near you does it ask an OpenStreetMap Overpass mirror, in the same way as "I'm here" (with no handle or account details; see section 5). These coordinates aren't stored in our database or written to logs; they're discarded once the lookup is done, and we don't use them to record where you've been. If you don't want this, turn off the location button on the right of the map and it won't happen.
• Most recent activity: when your account last used the app, and which feature it was using at that moment (only the path of the request, not what you searched for, your location or any parameters). We only keep the latest one; each new one replaces the last, so there's no history. It's used for two things: recommendations only count accounts that have been active recently, and our admin dashboard counts active users and shows which features people online are using right now.
• Anonymous usage statistics: so we know which features people use most and roughly for how long, and can improve the app, the app counts three kinds of numbers that contain no identifying information: how many times a feature was used that day (opening Today's picks, posting a shout-out, signing up, sending a chat message, tapping a card, asking Yoi, visiting a home, adding a friend, posting); which band each app session falls into (under 1 minute / 1–5 minutes / 5–15 minutes / over 15 minutes), plus the total seconds and number of sessions that day (totals only; any single session counts for at most 1 hour); and how many times each main screen was opened that day and for how many seconds (Map, List, Chats, Explore, Flights, Me, Home, Dating, Today's picks, Yoi and Posts; totals only; any single visit counts for at most 30 minutes). These numbers are collected on your phone for a while and then sent to our server in batches (if they can't be sent, they're discarded). Our server only adds them to that day's totals: we don't record who you are, which device you used or your IP address. The database only holds "which day · which item · how many", so these numbers can't be linked back to you.
• Hometown (optional, for finding people from your hometown): in the welcome questions or hometown settings you can choose which Chinese province or city you're from, or choose "Mysterious East" to leave it blank. It has one use only: when both you and the other person have switched on "hometown", we can tell you're from the same province (it's shown when you add a friend, and we tell you how many people from your hometown there are). It's not public and doesn't appear on your profile or anywhere other people can see. Our audit log only records "set / cleared", not where; our staff can't see your hometown when they look at an individual account in the admin tools either. We know a hometown can reveal ethnic origin, so we treat it as sensitive information. You can change it or clear it with "Mysterious East" at any time, and it's deleted with your account.
• Security and abuse signals: events such as hitting rate limits, failed log-ins and suspected scraping. IP addresses are only stored as hashes, which can't be reversed.
• Voice — two different things, explained separately (both only turn the microphone on while you're holding the mic button):
  • Talking to Yoi (hold to ask): the recording is sent to a transcription provider to be turned into text and discarded straight away. On this route we don't keep the audio; it isn't saved to disk or to our database. We only keep the text it was turned into (just like a question you'd typed).
  • Voice messages in chats: on this route we do keep the audio file, because the other person needs to be able to play it. The file follows the same rules as the message: deleted within 72 hours after everyone's read it, and after 7 days at the latest, and deleting the message deletes the audio file too.
• Apple account details (only if you choose Sign in with Apple): Apple only gives us your name and email address, nothing else. At Apple's step you can choose "Hide My Email", in which case we get a forwarding address from Apple and never see your real email address. We only use it to send you notifications (for example, the result of an identity check). ⚠️ Signing in with Apple doesn't mean you're in: it's just a way of logging in, and you still need to verify that you're a student or graduate.
• LinkedIn account details (only if you choose to sign in with or link LinkedIn): your name, email address, profile photo, and whether LinkedIn has officially verified you. Stored encrypted and deleted when you unlink.
• Photos of your student card or degree certificate (only if you apply for graduate verification, and only if you upload them yourself): stored encrypted, visible only to admins, and deleted as soon as a decision is made — we don't keep copies. You can blank out your student number and grades first; we only need to see your university and your name.

What we deliberately don't collect:

• Your real name — on OiYOi you're a seagull handle, plus an optional nickname (the exception: if you sign in with LinkedIn we receive your name, as above; if you don't use LinkedIn, we never get it);
• Your movements — there's no background location and no location history: the app doesn't read your location in the background, and we don't record where you've been or when. Your location is only read once, for the specific actions listed above, and stored at the precision described. To be clear, though: the app does read your precise location (to show you on your own map, for "I'm here" check-ins and automatic check-ins after 3 minutes in one spot; Lives you agree to post are stored to about 10 metres and only shown to the group you choose; and when you set your home we store its location, which only you can read precisely — everyone else only sees a grid point to about 200 metres), so in our App Store privacy label we declare "Precise Location", not "Coarse Location";
• Government ID such as passports, ID cards or visas — never. Graduate verification only looks at your student card or degree certificate, and deletes it afterwards (see above);
• Any payment details — OiYOi doesn't handle money, so it never touches your card.

Your communities

• What your choice does — it decides what you see first.
• Anyone can choose any community. You can choose up to two, and change them once a week.
• Your communities don't decide who you are or who you can meet. A few things do depend on whether you chose the Chinese community, because they follow language: which official group chat you join, whether Flights (UK–China routes only) appears, whether you're shown partner events written only in Chinese, and whether posts mostly in Chinese are suggested to you. You can still open those posts from a profile or a link.
• We don't ask for your nationality or background to do this, and we don't work them out from your name, language, location, email or anything else.
• Your communities aren't shown on your profile.
• Our admin tools only show how many people chose each community, never who, and show small numbers as "under 5". If you sign up for a partner organisation's event, that organisation sees whether to contact you in English or Chinese, which comes from whether you chose the Chinese community. It doesn't see your communities.
• You can remove your choices at any time in Settings › My communities, or delete your account. We keep the time of each change so the once-a-week limit works; removing your choices wipes what you chose, including past changes.

3. Why we collect it (our lawful bases, in plain English)

• To run the service (performance of a contract): without email verification we can't confirm you're a student, without tags we can't suggest matches, and without chat you can't help each other out.
• To keep everyone safe (legitimate interests): handling reports, banning scammers and harassers, filtering prohibited content and stopping fake or abusive accounts. We've weighed this up: the impact on your privacy is small and the benefit to the community is clear.
• Things you've agreed to (consent): photos of your student card or degree certificate, the device token for notifications, your optional hometown (only used if you've switched on "hometown" too; see section 2), shout-out locations you've confirmed on the map, pick-up points you've chosen to show on the confirmation card, Yoi sending what you say to third-party AI (we ask you first; see section 5), sharing your details with a partner organisation when you sign up for its event, and the social links you switch on for your NFC card (see section 6). You can use OiYOi without any of these; you just won't be able to use the related features. You can change your mind at any time — see "Withdraw your consent" in section 8.
• To make the app better (legitimate interests): the anonymous usage statistics in section 2 — daily totals only, which can't identify anyone.

We don't use your data for advertising or for any analysis unrelated to the purposes above.

4. How long we keep it

• Chat messages: permanently deleted within 72 hours after everyone in the chat has read them, and after 7 days at the latest whether or not they've been read. The exception: if someone saves a "snapshot" of a message, the person who saved it keeps that snapshot, and it isn't deleted with the original.
• Everything else (email, tags, posts, photos, encrypted WeChat ID): kept for as long as your account exists. When you ask to delete your account, it first goes into a cooling-off period (your account is disabled and you can change your mind and restore it at any time). Once that period ends, your data is permanently deleted.
• Moderation records (reports, bans, admin audit logs): kept but anonymised after you delete your account — the link to you is cleared, so nobody can tell who it was. Without this, deleting an account would be a way to wipe the slate clean, and people who'd been harassed wouldn't be protected. Our lawful basis for this is our legitimate interest in preventing fraud and abuse.
• Reported or preserved conversations are an exception: if someone reports a conversation, or anyone in it taps "Preserve evidence", deletion of its messages is paused for up to 180 days, after which normal deletion resumes automatically. Why: people who've been scammed or harassed often only report it a few days later, by which time the evidence would normally be gone — and without evidence, the person affected can't do anything about it. Preservation only applies to the conversation that was reported or flagged by someone in it; it doesn't mean everyone's chats are kept longer. The lawful basis is processing necessary to establish, exercise or defend legal claims.
• Security logs (failed log-ins, rate limits, unusual access): automatically deleted after 90 days. They only record the time, which address was accessed and a number that can't identify you, so we can spot attacks or scraping. 90 days is long enough to investigate an ongoing attack; keeping them longer would just mean holding on to a trail of your activity, so we clear them.

5. Where it's stored (and what leaves Europe)

Data we store is kept in Europe: our database and servers are in Railway's European region (the Netherlands), photos, voice messages and videos are stored on Cloudflare R2's European locations, and verification emails are sent through Resend. The UK recognises Europe's level of data protection (an adequacy decision), so storing it there is compliant. We won't move the account database outside Europe.

But a few things are sent outside Europe in real time, and we want to be upfront about them — they're sent to be processed once, not moved there to be stored:

• We ask before anything is sent: the next three items (conversations with Yoi, voice transcription and photos sent to Yoi) all use third-party AI. The first time you type, send a photo or hold to talk to Yoi, the app shows a card explaining who it goes to, what's sent and what isn't. Nothing is sent until you tap "Agree and continue"; if you tap "No thanks", nothing is sent, Yoi's input box shows a small lock, and the map and everything else work as normal. If the wording of that explanation changes, we'll ask you again. You can withdraw your consent at any time under Me › Settings › AI services Yoi uses, after which nothing more is sent. Our server records which version of the explanation you agreed to and when (and when you withdraw) — without that record, our server won't pass anything on for Yoi.
• US · Conversations with Yoi: what you say to Yoi is sent to Anthropic (or OpenAI if we haven't set up an Anthropic key), both in the US. Along with what you've just said and the last few turns of the conversation, it includes your seagull handle, the nickname you chose and the name of the area you're usually in (so it knows what to call you and which area to look at first). It doesn't include your real name, email, contact details or your phone's location. When you ask Yoi to plan a route or find somewhere, the place names you mention (such as "UCL" or "Heathrow") are sent to TfL (Transport for London), OpenStreetMap's place search and postcodes.io to turn them into points on the map, and the start and end of the route are sent to TfL to look up services. These aren't AI services, they're in the UK and Europe, and they only receive place names and coordinates — no handle or account details.
• US · Voice transcription: the recording when you hold to talk to Yoi is sent to Groq (or OpenAI as a fallback), both in the US. To help it catch place names, we also send a list of place names in the area you're usually in (public information anyone can see on the map). The audio is discarded once it's transcribed, and the request includes no handle, nickname or account details.
• US · Photos you send to Yoi: photos you take with the camera button on Yoi's screen (or choose from your photo library) are sent with your message to Anthropic (or OpenAI if we haven't set up an Anthropic key) — it needs to see the photo to answer. It's sent once only: the photo isn't added to the conversation history, your next message won't send it again, and we don't keep a copy. This only happens when you tap the camera button yourself — we never look through your photo library.
• US · AI checks on posts and comments: when you post or comment, the text and images (title, body, comment and any photos you upload) are first checked by Anthropic's AI — for things that aren't allowed, such as sexual content, violence, hate or harassment, illegal trading, spam or other people's personal information. For images we send a smaller copy we've made ourselves (no longer than 1024 pixels on the long side), with all EXIF data such as where it was taken removed; videos aren't sent (our team checks video posts). It includes none of your handle, account, email, university, area or coordinates. Posts that are clearly fine are published straight away, borderline ones go to our team, and posts that clearly break the rules aren't published and we tell you which rule. This step keeps what everyone sees safe (our lawful basis is legitimate interests), so we don't show a separate consent card — if you don't want it, you can choose not to post or comment, and browsing isn't affected. Our moderation records only keep the category of decision and a one-line reason; we don't keep a separate copy of your content. The same applies to reports: reported content (a post, comment, shout-out, item for sale, review, the reported message in a private chat, or a profile) and the reason for the report are also sent to the same AI to judge how serious it is — only to handle the report, and without anyone's handle (neither the reporter's nor the reported person's).
• The coordinates for an "I'm here" check-in are sent within the EU: this feature queries OpenStreetMap's public Overpass mirrors — overpass-api.de (Germany) and overpass.kumi.systems (Austria), both in the European Economic Area. All they receive is the coordinates at that moment and the query "find named places nearby", with no handle or account details, and we don't keep those coordinates. This only happens in two cases: when you tap "I'm here", or when the automatic check-in described in section 2 can't find a place near you in our own list (in which case the location sent is rounded to about 20 metres). (Until 31 August 2026 this list also included a mirror run by Russia's VK / Mail.ru, and it was first in line; the founder decided to remove it that day. We've left this note here rather than pretend it never happened.)

What allows us to send it: the EU Standard Contractual Clauses (SCCs, Modules 2 and 3) apply between us and these three providers (Anthropic, Groq and OpenAI), together with the UK Information Commissioner's International Data Transfer Addendum (template B.1.0, as laid before the UK Parliament on 2 February 2022). Both took effect when we accepted their commercial terms, and under UK law they are the "appropriate safeguards" required by Article 46. We've also carried out a transfer risk assessment, which concluded that what we send is already minimised (the voice route sends nothing that could identify you, and the conversation route sends no email, contact details or precise coordinates) and proportionate to the risk at the destination. We review it regularly, and redo it straight away if we change provider or start sending more.

In every case, we only send the minimum needed to handle that one request. The account database, chat history, map data and graduate-verification photos never leave Europe.

6. Who we share it with

• We don't sell data or share it with advertisers. No exceptions.
• Infrastructure providers ("processors" acting on our instructions): Railway (servers), Cloudflare (images and network) and Resend (email). They only store and transfer data for us and can't use it for their own purposes.
• AI and transcription providers (also "processors" acting on our instructions, all in the US; see section 5): Anthropic (conversations with Yoi, falling back to OpenAI if we haven't set up an Anthropic key) and Groq / OpenAI (turning what you say into text). We only send what's needed for that one request. To be precise: the Yoi route includes your seagull handle, the nickname you chose and the area you're usually in — it needs to know what to call you and which area to look at first. It doesn't include your email, contact details or precise coordinates. Photos you send to Yoi go the same way (sent once, not added to history, and we don't keep a copy). AI checks on posts and comments also go to Anthropic: only the text of the post and a smaller copy of each image with EXIF removed, with no handle or account details (see section 5). When handling a report, the reported content (a post, comment, shout-out, item for sale, review, the reported message in a private chat, or a profile) and the reason are also sent to it to judge how serious it is — only to handle the report, again without anyone's handle. The transcription route sends nothing that could identify you. Our contracts say they must not use it to train their models.
• Data sources for the SIM card search: only when you open the SIM card search, an approximate location of your home (to about 1 km, or the first half of your postcode) and your university's public location are sent to TfL (routes) and postcodes.io (borough), and, if we've switched on Ofcom's address-level check, a postcode we've picked is sent to Ofcom. All are in the UK, no account details are sent, and we don't store that location (see section 2).
• Map lookup mirrors: only when you tap "I'm here", or when the automatic check-in can't find a place near you in our own list, coordinates are sent to OpenStreetMap's public Overpass mirrors to get a list of nearby places (one in Germany and one in Austria, both in the European Economic Area; see section 5).
• Apple: only if you tap "Sign in with Apple" yourself — at that point you're signing in with Apple (Face ID or your password stay within Apple's screens and we never see them), and Apple only sends us your name and email address. If you don't use it, this never happens.
• Apple Maps (areas we haven't hand-drawn): in areas we haven't hand-drawn yet, the base map comes from Apple (MapKit JS). When that part of the map is shown, your device requests map data directly from Apple, so Apple can tell roughly which area the map is showing (to within a few hundred metres), as well as your IP address, device and language. When the map is following your location, that area is also roughly where you are. We don't send your location, account or any personal details to Apple, and we don't use Apple's search, directions or geocoding services. In areas we have hand-drawn, the map doesn't go through Apple at all. For how Apple handles these requests, see Apple's explanation.
• LinkedIn: only if you tap "Sign in with LinkedIn" or "Link LinkedIn" yourself — at that point you're signing in with LinkedIn, and LinkedIn sends us your name, email address and verification categories. If you don't use it, this never happens.
• Partner organisations (student societies, students' unions, university departments and similar). This only happens when you sign up for an event run by one of our partner organisations and tick the consent box on the sign-up form. At that point we share your university email address, university, gender, age range and your answers to the sign-up questions with the organisation running that event, so they can use them for that event only (for example, check-in and event updates). Our lawful basis is your consent (Article 6(1)(a) UK GDPR). If you don't tick the box, you can't sign up and nothing is shared. Once the organisation receives your details, it is responsible for its copy as an independent controller, and our agreement with each organisation requires it to use them only for that event and not pass them on. To withdraw, tap "Withdraw my sign-up" on the event page: we delete your answers straight away, you leave the event chat, and the organisation can no longer see you. If they've already exported a list, we'll ask them to remove you from it. You can also email us (see section 1).
• Social links on your NFC card. These are optional and added by you under Me › My card (for example WhatsApp, Instagram, WeChat ID or QR code, RedNote, Douyin, Snapchat, TikTok and LinkedIn). Every link is off by default, and so is the main switch. Only the links you switch on are shown, and only to people who tap or scan your card. They open the app themselves; we don't add anyone for you. Your links never appear in public lists, search or on the map, and your email is never shown. Our lawful basis is your consent (Article 6(1)(a) UK GDPR). To withdraw, switch the card or a link off and it disappears straight away; clear a link and save to delete it from our servers. Everything is deleted when you delete your account.
• Law enforcement: if we receive a lawful request from the police or another authority (for example, in a fraud case), we'll comply as the law requires.

7. Cookies

We only use strictly necessary session cookies to keep you logged in — no tracking or advertising cookies. Under the UK's PECR rules these don't need consent, which is why you won't see a cookie banner: there's simply nothing to agree to. (The iOS app doesn't use cookies; your log-in token is stored on your device.)

8. Your rights

Under the UK GDPR you can:

• See your data: ask for a copy of the data we hold about you;
• Correct it: fix anything that's wrong (you can change your tags and nickname yourself in the app);
• Delete it: go to Me → Delete account and do it yourself in the app — no need to email anyone. There's a cooling-off period in case you change your mind; after that your data is permanently deleted, as described in section 4;
• Restrict or object: object to processing based on legitimate interests;
• Take it with you (data portability): ask for a machine-readable copy of the data you've given us, or ask us to send it straight to another service — this covers data processed automatically on the basis of contract or consent;
• Withdraw your consent: you can take back any of the things in section 3 that are based on consent at any time, and this doesn't affect anything we did before you withdrew. How: for the notification token, turn notifications off in your phone's settings; for exact locations you've shown, delete or take down that post; for partner event sign-ups, tap "Withdraw my sign-up"; for NFC social links, switch them off or clear them; for student card or certificate photos, they're already deleted once a decision is made — if it's still being reviewed, email us to stop it and we'll delete them straight away and review your application from the written details instead.

There's only one automated decision, and a person always backs it up. Posts and comments are checked by AI first (see section 5): posts that are clearly fine are published straight away, borderline ones go to our team, and posts that clearly break the rules aren't published and we tell you which rule. We spot-check a proportion of what the AI lets through and take down and notify you about anything it got wrong. If you think a decision was wrong, edit and post again, or email us and a person will review it. Graduate verification uses an internal score, but it's only a signal to help our reviewers prioritise; whether you're approved is always decided by a person. Apart from that, we don't make purely automated decisions with legal or similarly significant effects on you.

What you have to give us: only your university email — without verifying it we can't confirm you're a current university student, so you can't join. Everything else is optional; if you don't provide it, you just can't use the related feature.

To exercise your rights, email hello@oiyoi.org and we'll reply within one month. If you think we've handled your data wrongly, you can complain to the UK regulator, the ICO (ico.org.uk) — but please come to us first; most things can be sorted out with a quick conversation.

9. Under-18s

OiYOi is only for people aged 18 or over. If we find an account belonging to someone under 18, we'll delete the account and its data.

10. Changes to this policy

If this policy changes in a meaningful way (for example, we start collecting a new type of data or change provider), we'll let you know in advance somewhere prominent in the app, and ask you to confirm again for major changes. Small wording changes are made directly and dated.

Change history

v1.15 (3 November 2026: added "Your communities" to section 2 — what your choice does, the few things that depend on it, what our admin tools can see and how to remove your choices); v1.14 (31 October 2026: added two items to section 6 — "Partner organisations": when you sign up for a partner organisation's event and tick the consent box, your university email, university, gender, age range and sign-up answers are shared with that organisation for that event only, and you can withdraw at any time; "Social links on your NFC card": optional, off by default, only the links you switch on are shown to people who tap or scan your card, and clearing a link deletes it. Section 3 and "Withdraw your consent" in section 8 updated to match. English version of this policy published at /privacy-en); v1.13 (21 October 2026: one more kind of number in "Anonymous usage statistics" in section 2 — how many times each of 11 main screens was opened that day and for how long, still only added to daily totals, with no account, device or IP; the same day, the default rough location of a pick-up point for items for sale was reduced from about 200 metres to about 50 metres; homes are still about 200 metres); v1.12 (18 October 2026: added "Hometown (optional)" to section 2 and listed it under consent in section 3; it had been collected before but was missing from earlier versions, and we also removed the one place staff could see it for an individual account); v1.11 (17 October 2026: added "Anonymous usage statistics" to section 2 and its lawful basis, legitimate interests, to section 3; this had been live since 4 October 2026 but was missing from earlier versions); v1.10 (17 October 2026: in areas we haven't hand-drawn, the base map now comes from Apple (MapKit JS) — added "Apple Maps" to section 6); v1.9 (15 October 2026: wording changed to describe users as "current university students" rather than "international students"; no change to the data we collect or how we use it); v1.8 (11 October 2026: posts and comments are now checked by AI first — added to sections 5 and 6, and the "no automated decisions" statement rewritten to describe this accurately; the same day, reported content is also sent to the same AI to judge how serious it is, without handles); v1.7 (7 October 2026: added the automatic place check-in after 3 minutes in one spot, live since 17 September 2026 but missing from earlier versions, and corrected the summary; also added "Most recent activity"); v1.6 (28 September 2026: home shown as a little house to about 200 metres to people who can visit, and whether you're "in"; added the SIM card search, notes when adding friends or messaging sellers, location button moved to the right of the map, no more radius circle); v1.5 and v1.4 (17 September 2026: shout-out locations are places you search for and confirm; pick-up points default to a rough location; home as a virtual space for close friends; Live audiences chosen by you with no public option; location section rewritten to match the current app); 13 September 2026: consent added as a lawful basis, data portability and withdrawing consent added, cross-border transfer safeguards described accurately as SCCs plus the UK Addendum B.1.0, and the automated-decisions and "what you have to give us" statements added; v1.1 (31 August 2026: location precision, voice and international transfers rewritten to match how the app actually works).)