Privacy Policy
Last updated 28 October 2026
Yaba Fun is a demonstration social app run by Yabafun ("we", "us"). This policy explains what personal data we collect, why, and the choices you have. We don't sell your data, we don't show ads, and we don't use analytics or tracking tools.
1. Who we are
Yabafun is the controller of your personal data for Yaba Fun. Contact us at contact@yaba.fun about anything in this policy.
2. Data we collect and why
| What | Details | Why (legal basis) |
|---|---|---|
| Account details | Email address and password (stored and hashed by our authentication provider, never by us); your username. | To create and secure your account and let you sign in (contract). |
| Two-factor authentication | If you turn it on: the authenticator secret (held by our authentication provider, never by us) and whether two-factor is on. | To secure your account at your request (contract). |
| Notifications | Who followed you or liked, commented on or replied to your content, and whether you've seen it. Deleted after 90 days. | To keep you informed about activity on your account (contract). |
| Images | Photos you upload for posts or your profile. We remove embedded metadata (such as location and camera details) before storing them with Cloudflare R2. Deleted together with the post or when you change or remove your photo (within a day). | To show the images you chose to share (contract). |
| Profile | The display name and bio you choose to add, and when you last changed your username. | To show your public profile and limit how often usernames change (contract). |
| Wallets created for you | When wallets are switched on, we ask Privy (Privy Inc.) to create an Ethereum-compatible and a Solana wallet for your account. Privy generates and secures the keys for you; we never see them. We share your account's sign-in token with Privy to do this, and keep only the public addresses. | To give you a wallet with your account (contract). |
| Linked wallets | Public addresses of wallets you link to your account, and when you proved you own them by signing a message. Shown only to you; you can unlink them any time. | To show you your wallets and their public balances at your request (contract). |
| Balances and transfers | To show your balances we look your public addresses up on public blockchain nodes (balances are public on-chain data). When you send funds, the transfer is signed in your own wallet through Privy and broadcast to the network; we log only the network and the public transaction hash. We never see or store private keys or seed phrases, and can't move funds for you. | To show your wallet and carry out transfers you ask for (contract). |
| Swaps | When you ask for a swap quote we send your public wallet addresses, the tokens and the amount to Relay (Relay Protocol), which quotes and settles swaps. We keep a record of each swap you start: tokens, amounts, status and transaction hashes. | To carry out swaps you ask for and show your swap history (contract). |
| Shared trades | When you tick "Share this trade" (you choose for each trade), the completed trade becomes public: your username and photo, the tokens, amounts, its dollar value, your optional thesis and the transaction link appear on your profile, the token's page, chart markers, your followers' feeds and the weekly leaderboard. Unshared trades are only visible to you. | To show the trades you choose to share (consent, given per trade). |
| Google sign-in | If you choose Google: your name, email address and profile picture, as shown on Google's consent screen. We use your name only to suggest a username. | To sign you in with Google at your request (contract). |
| Content you post | Posts, likes, and the time they were made. | To run the social features you use (contract). |
| Security data | Your IP address and the email you sign in with, only in one-way hashed form, counted for at most an hour to limit repeated attempts. | To protect accounts and the service from abuse (legitimate interests). |
| Reports and blocks | Posts and comments you report (the reason and any note you add) and accounts you block. Moderators can see who made a report; the reported person can't. People you block aren't told. | To keep the community safe and enforce our Terms (legitimate interests). |
| Security log | A record of account events (sign-ups, sign-ins and failed attempts, sign-outs, password resets and changes), with the time, a hashed IP address and your browser type. Attempts on unknown accounts store the email only in hashed form. Kept for 90 days. | To detect and investigate unauthorised access to accounts (legitimate interests). |
| Technical logs | Request logs kept by our hosting provider (such as IP address, browser and time), for a short period. | To keep the service running and secure (legitimate interests). |
Your profile (username, display name, bio, join month), who you follow, who follows you, communities you create, and your posts and comments are public to other users. Community member counts are public; we don't publish member lists. Your email address is never shown to other users. Market, trading and presale screens show fictional, generated data only. Your wallet addresses and balances are shown only to you; we don't collect keys, card or bank details.
5. How long we keep data
- Account data, posts and likes: while your account exists. When you ask us to delete your account, we delete it and your content.
- Posts and comments you delete: removed straight away. If one had open reports when you deleted it, we keep it hidden until a moderator has reviewed those reports, then delete it. Content a moderator removes is kept hidden as a record.
- Hashed security counters: about an hour, then deleted.
- Reports: until the reported post or comment, or your account, is deleted. Blocks: until you unblock or delete your account.
- Security log of account events: 90 days, then deleted.
- Hosting logs: kept by our providers for a short period under their own retention settings.
6. Your rights
Under UK and EU data protection law you can ask to access, correct, delete or receive a copy of your data, and object to or restrict how we use it. Email contact@yaba.fun and we'll respond within one month. Account deletion is handled by email for now; an in-app option is planned.
You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.
7. Security
Passwords are hashed by our authentication provider, sessions are signed and refreshed automatically, connections are encrypted (HTTPS), and repeated sign-in attempts are rate limited. No system is perfectly secure, so please use a unique password.
8. Age
Yaba Fun is for people aged 18 or over. We don't knowingly collect data from anyone younger; if you think we have, contact us and we'll delete it.
9. Changes to this policy
We'll update the date at the top when this policy changes, and tell signed-in users about significant changes. See also our Terms of Service.