Privacy Policy
The short version
Oya is built so that nobody, including us, can produce a list of where people will be tonight. A plan shows only its neighbourhood until you join it. Your position is never stored. A plan is deleted an hour after it ends. There's no feed, no history, no analytics, no advertising, and no account unless you want one. We count how many people do things each day, never who.
This policy says exactly what the app does with your data. If anything here is wrong, then the app is wrong, and we'll fix the app.
What we hold about you
If you're a guest: a random identifier created on your phone the first time you continue past the welcome screen, the time you agreed to these terms, and nothing else until you do something.
If you make an account: how you signed in. With Apple: the identifier Apple gives us for you, and your name and email address if you chose to share them (Apple can hide your address behind a relay address, and we treat that as your address). With Google: the identifier Google gives us for you, your email address, and your name, which becomes your name in Oya only if you haven't set one. With a phone number: the number, which we send a code to and use for nothing else. With email: the address and a password. The password is stored only in hashed form. We don't verify the address, and we don't send email to it.
A name, if you set one. It can be anything you like. It's what people on a plan with you see, and what a friend searches for.
Your pizza, if you pick one: the toppings you like (or no cheese). Shown on your profile to your friends, people in a plan with you, and people you have a message thread with (once it's accepted, or when they messaged you first). In a plan, the people going see how many like each topping, not who. Picking no toppings removes it.
A profile photo, if you add one: a small square copy of a photo you choose or take, shown next to your name wherever your name is shown. Anyone who has its link can open it. Oya only uses the photos and the camera when you choose to add one, and takes nothing else from your library. Removing it in the app deletes it.
Your plans, while they exist: the title, the time, the place, who may see it, and who said they're coming, plus a ticket link and a room or entrance if you add them. Your spot on plans you joined, whether you checked in, what you wrote in a plan's chat, with when you sent it, and the songs you asked for and voted for. All of this is deleted an hour after the plan ends.
Pickup games, if a host keeps score on a sport plan: the two sides' names and colours and the score, and which side each person picked. When the host finishes the game, the result is kept after the plan is deleted: the sides, the final score, when it was played, the area (about 20 by 40 km, never the place), who hosted, and who played on which side. Your record and the leaderboard are made from these. Your friends see your record. Other people see it, with your name and photo, only if you turn on Show me around here on the leaderboard, and only for games in that area. Turning it off hides you again. Results are kept until you delete your account, which removes you from them.
Parking, if you use it: the place you're looking around is used to find car parks and isn't kept. Only the area (about 5 km across) is noted, with no one attached, so its car parks can be loaded from OpenStreetMap. If you say a car park is full or has spaces, what you paid there, or whether it was good, that's kept with your account: full or spaces for 45 minutes, what you paid for 30 days, your rating until you take it back or delete your account. Other people see counts and the middle amount paid, never who. If you say where you parked for a plan, the spot (from your phone, once, when you tap), the car park, what you paid and whether there's space left are shown to the people in that plan, with your name. It's deleted with the plan, and hidden if you leave it.
Heists, if you run one: your crews (their names, their line and who is in them), and for each run when it started, when each of you checked in at each point, the finish time, and whether it was on foot or on wheels. Where you were is checked at each point and not kept. The crews that finish and their times are shown on the heist's board, and the record's crew and time on the heist's page at oya.city/h, which anyone with the link can open; who ran is shown only to the crew. A run card you share goes wherever you send it. Kept until you delete your account, which removes you from them.
Quick join, if you use it: while you're looking, what for (a party, a game, a section spot or a heist crew), how many of you, the most you'll pay, and the area you're in (about 20 km across, never the place); it's deleted when you stop or after three hours. Each spot you're offered, and whether you took it, is kept for 30 days, so that people who take spots and don't go can be held back. An invite shows the host's name and photo, and the names and photos of your friends already going; anyone else going is shown as a number. A host sees how many joined from Quick join; other people see how many are looking around here, never who, and nothing under three. If you open spots on your plan, people looking around here who are friends of your friends (or anyone, if you choose) can be offered one, and taking it puts them in your plan. If you have notifications on and a spot opens while you're looking, you get one notification saying so, at most one every ten minutes; when you were last told is kept for ten minutes.
Rites, if you do one: a rite is a heist done as a tradition. Finishing a rite's heist puts you on its roll: how many times you've done it, and when first and last. How many people have done a rite is shown to anyone. Your name, photo and one line show on the roll only if you sign it, and you can take them off. A title you choose to wear shows on your profile. If you vote on a change to how a rite is run, your vote is kept with the change; others see the totals, never who voted which way. The founder of a rite chooses to have their full name, photo and the year shown on its founder's stone for good, including after they delete their account; the founder's voice note is heard only by people on the roll. If you're on a rite's roll and have notifications on, you get one notification when its season opens; which seasons you were told about is kept for a year.
Capture the flag, if you play: while a game is on, the app sends where your phone is every few seconds. Your own side sees it, and everyone in the game sees it while you carry a flag; nobody outside the game sees anything. When the game ends, every position from it is deleted at once. The game's name, its two bases, its score, who played on which side, and each player's captures and tags are kept for 30 days, then deleted.
Bringing a friend: if someone new adds you with your link, we note that you brought them. When they first go to a plan with an account, you both get gold, and the note is kept as the gold in each of your histories; otherwise it's deleted after 90 days. Your profile shows how many joined through you, never who.
Drops, if you leave one: the place you chose, your note and photo, and the friend it's for, kept until it's deleted, or 30 days if it isn't opened. Only that friend sees it, and only as a pin until they're within 50 metres of it; to check, the app sends where they are once, and that isn't kept. When it was opened is kept, and shown to you.
Field days, if a host runs one: its teams and who is on which, the captains and referees, the run of show, each event's results, and MVP votes (others see who won, never who voted for whom). Anyone who can see the plan can see the field day. Kept while the plan is.
Your week: your profile shows how many plans you checked in at, heists you finished and field days you played this week, and how many weeks in a row, worked out from those records. If you have notifications on, Sunday evening brings one notification with your week; which weeks we told you is kept for eight weeks so it's once a week.
Friends this week, if you turn it on (it is off until you do): your friends see your weeks in a row and whether you went out this week, as counts, never which plans. Turning it off hides it at once.
Your month and your year: cards worked out from the same records. So the cards can count them after a plan is gone, each check-in keeps which place it was at and whether you wore the aso-ebi; that goes with your check-ins. On 31 December, if you have notifications on and went out that month, one notification with your December, and on 1 January one with your year; which months and years we told you are kept so it's once.
Waitlists, if you join one for a full section: that you're in line and when you joined, so spots are offered in order. When a spot frees, the first in line gets a notification and the spot is held for them for 30 minutes. Your place goes when you leave the line, take a spot, or the plan ends.
Named matatus, if you crew one: its name, line, art photo and what it's playing, who is its crew (shown only if the crew choose) and who asked to join, and the day of its last run. While you drive as it, your bus on the map carries its name; where you are is kept only as long as any ride is (gone when you stop, or after 10 quiet minutes). No plate numbers. A new art photo is checked by an automated system (Anthropic's Claude, which receives the image once and keeps nothing) before anyone but the crew sees it. If you follow one: that you do, and whether you want a notification when it starts its day. Reports of a matatu are kept with who sent them. A crew can make one of their plans a party run of their matatu: the matatu's page lists it to those who can see the plan, and followers who asked for news are told once.
Nganya this week: while you ride a line near a named matatu its crew is driving, that you rode it that day, for its weekly count; and your one vote a week for the best art. Others see only the totals, never who. Both are kept for eight weeks.
Regulars: a check-in keeps whose plan it was, after the plan is gone. A host sees who checked in at three or more of their plans in the last 90 days (they saw each of those check-ins already), and can send them one notification about a plan to come, once per plan.
How was it: if you checked in at a plan, the morning after you're asked (and, with notifications on, told once) how it was. Your stars and your line go to the host with the plan's title and place; the host sees them, never your name. Who rated is kept so it's once each. An unanswered ask goes after 7 days.
Door lists, if a host uses one: who the host or their door crew marked as here, by whom and when, and who the host named as door crew. Being marked here at the door checks you in, as checking in yourself does. Only the host and door crew see the list. If you're in, a code for that plan's door, shown only to you; when the door scans it, the camera reads the code and nothing else is kept. Kept while the plan is.
Gifts, if you pay for a friend's spot: the payment records who paid and whose spot it is. Your friend is told who got them the spot; you see whether it went through. A refund goes back to the card that paid. Kept as payment records are.
Covers, if you pay for several spots at once: the same as a gift, for each spot, plus one record of the payment that covered them. The people on the plan and its host see your first name and how many spots you covered. We also keep, per day, how much was spent through Oya in each currency and how many payments there were, with no names, ids or places.
Àrọ trade books, if you keep one or are added to one: the business's name, its places (kept to about 10 metres), its members and their roles, and every entry: what it was, how much, where, who recorded it, when, any names you type for suppliers and buyers, bank references, and photos of the scale. Only the book's members see it. Entries are never changed or deleted; the owner can delete the whole book. When you record goods, your location is compared with the place once and not kept. Market prices: the market, the price you reported and the day; others see the middle of the week's prices once three people have reported, never who. When you report a price, your location is compared with the market once and not kept.
If you report a fault, a club's listing or a market: what you reported, the reason you picked, and when. After three reports it is hidden until someone at Oya looks; the person whose content it is never sees who reported it. Links you share to a public project, a fault or a market show the same title and numbers anyone nearby can already see, never who added or reported anything.
Tips you add on an Ọwá park or line: the tip and when. Others see the tip and how many voted it up, never who wrote it or who voted; your votes are kept so you vote once. Reported tips are hidden after three reports until someone at Oya looks.
If you report the task force seizing okadas: that someone reported it, in an area of about a kilometre, and when, kept as city alerts are (two hours unless someone says it's still there). Your position is used once to find the area and not kept; nobody sees who reported.
Market price index: each week we work out, for each city, commodity and unit, the middle price and range of what people reported at markets, only where three or more different people reported. We share it free on oya.city/prices and sell the full history to organisations such as lenders, food companies and researchers. It never names anyone or any business. If you own an Àrọ book and turn on "Add my sale prices to the city index", what you sold for per kg (from sales recorded where the goods were weighed) is added the same way, counted as one of the three, never named. It is off unless you turn it on, and turning it off keeps your book out of every week built after.
Aso-ebi, if a host sets one for a plan: its name, colour and photo of the fabric, and who said they're wearing it. Anyone who can see the plan sees the aso-ebi and how many are wearing it; your friends see that you are. Kept while the plan is; a new colour clears who said yes.
Counts. Each day we count how many people opened the map, made plans, joined someone's plan, set off on and finished heist runs, took a spot through Quick join, paid for a spot and brought a friend. Each count is a total for the day and nothing else: no names, no accounts, no places. It's how we see whether Oya is working. We count how many, never who, and a total under three isn't shown to anyone, including us.
Clubs, if a group's owner lists it: its topic, a line about it, when it meets, and its area, kept to about a kilometre around where the owner was when they listed it (never an address). People within 25 km can find it, see how many are in it and its next meeting's day and book, and join it without a link. A club's meetings can be seen and joined by its members. A club's book, its past books, and where each member says they're up to are seen by its members only. Taking a club off the list clears its line, time and area. A club's owner can write a welcome line that people who join see until they close it, and hears when someone joins a listed club. Members can suggest books and vote for the next one; who suggested shows, who voted for what doesn't, and the round clears when a book starts.
If you say you'd join a kind of club that isn't near you yet: the kind and your area, kept to about a kilometre. Others nearby see how many want one, never who. When one is listed within 25 km you're told once and your ask ends; otherwise it goes after 90 days.
If you list a public project: what it is, the agency, the year, the budget, the link to where its money is written down, and its place, kept to about 100 metres. Anyone signed in nearby can see it. Who listed it is kept but not shown. If you check a project, saying what you see there: the project, what you said and when. Your location is compared on our server once to make sure you are within 300 metres and is not kept. Others see how many people said each thing, never who. If you follow a project: that you follow it, so we can tell you when someone checks it.
If you report something broken (a pothole, a streetlight, a pipe, a drain and so on): what it is, where it is to about 10 metres, and when. Anyone signed in nearby can see it. Who reported it is kept but not shown. If you add a photo of it, we check the photo with an AI model before anyone else sees it. If you say a fault is still broken or fixed: your answer and when. Your location is compared on our server once to make sure you are within 300 metres and is not kept. Reporting or saying still broken follows the fault, so we can tell you once when it is fixed. If you report an accident: that there was one in an area of about a kilometre, whether anyone is hurt, and when. It lasts two hours. No photos or words are taken for accidents.
Groups you're in: the group's name, the currency its money is counted in, who is in it, and its link. What's said in a group's chat, with who said it and when, for 30 days, after which it's deleted. The group's money: each expense (who paid, how much, what for and who it was split between) and each payment between members, and each goal with what each member logged towards it. Oya never holds or moves money; these are records the group keeps for itself. The money and goals are kept as long as the group exists.
Your friends and the requests between you. A link you can share that lets someone add you as a friend; it shows your name to whoever opens it, and nothing else. The people you've blocked. Reports you've sent.
If you turn on notifications: a token that identifies your phone to Apple's push service, kept with your account so we can tell you when a friend posts a plan, or when someone says something in a group you're in. You can turn a group's notifications off in the group. Nothing else about your phone.
Feedback you send from the app: what you wrote, the app's build number, the kind of phone and its iOS version, the screen you were on, and the plan you were looking at if there was one. No position and no device identifier. We read it, and so does a tool we run that drafts code changes for us to review. Every few days the app may ask what Oya should add next; what you answer is feedback like this.
If you host: your credit balance, each top-up and its Stripe reference, and each check-in a featured plan was charged for, with the plan's title. A host sees how many people said they're coming and how many checked in, never who. The code that signs you in to the host page lasts ten minutes, and the sign-in twelve hours. If you pay monthly: Stripe's references for the subscription and each month's payment, and the date it runs to.
If you host and connect Spotify on the host page: your Spotify name, whether it is Premium, and the keys Spotify gives us to see what is playing and to add songs to your queue, which stay on our servers and never reach anyone's phone. While a plan of yours is on and taking song requests, from fifteen minutes before it starts until it ends, the song playing on your Spotify is shown to the people going. At no other time is it shown to anyone. Disconnecting on the host page, or deleting your account, deletes all of it.
If you apply to sponsor an event on the sponsor page: your organisation's name and website, the email you gave, what you wrote, and whether you were accepted and paid. Only Oya's admins see it. Once you've paid, your organisation's name and website are shown on the event to everyone.
A count of the times you showed up, and nothing about where. For 24 hours after a check-in we also hold which plan it was, so the same plan can't be counted twice. After that, the link to the plan is removed.
If a plan is a section, its spots, its price each and its currency, and which of the people in it the host has marked as paid; that goes with the plan. Oya does not take, hold or send that money: people pay the host directly. Only the host sees who has paid; someone in the section sees only whether they have.
If you join Oya+ on oya.city: when your membership started and runs to, whether it is set to end, and the references Stripe gives us for you and your subscription. Stripe takes the payment under its own privacy policy; Oya never sees your card.
Photos you add: the picture (resized to at most 1600 pixels), who sees it (the people at the plan, the chat, your friends, or everyone), the plan or chat it belongs to and so the place, and who you tagged in it. A new photo is checked by an automated system (Anthropic's Claude, which receives the image once and keeps nothing) before anyone else sees it. Photos are kept until you delete them or your account; anyone tagged can remove their tag; two reports hide a photo until we look at it.
Your vibe, if you set it: up to three words from our list, the area you go out in, and the kinds of plans you're into. Anyone who can see you on Oya can see it.
While the map is open: once a minute, the four-character area the map is looking at (about 20 by 40 km) and the time, one row per person, overwritten each time and deleted after a day. It is only ever counted, as "online" around an area, never shown as you.
Projects you start or back: the title, the story, the goal, the deadline, who can see it, how backers pay the organiser, and each pledge (who, how much, and whether the organiser marked it paid). Everyone who can see a project sees its total and how many backed it; only the organiser sees who pledged what. Oya never takes, holds or sends the money, and a project is backing, not an investment: nobody gets a share or a return.
Direct messages: what you send, to whom and when, for 30 days, after which it's deleted. Someone who isn't your friend lands in your requests until you accept or delete. Deleting a conversation deletes it for both of you.
The feed shows you, and your friends, things each of you could already see: photos you can see, confirmed check-ins and plans your friends are going to that you could open, and popular public plans nearby. It never shows where someone is now.
Your points and level, worked out from the check-ins the app confirmed you were at. If you host: a running total of points from the people who checked in at your plans, and, while a plan exists, who has already counted toward it, which is deleted with the plan. Points can't be bought, sold, sent to anyone or turned into money. A perk a host offers on a plan, and its code, are the host's: Oya shows them and shows the code only to people at the level the host chose.
If you pay for a spot: the plan, the amount, Oya's fee, whether it was paid or refunded, and the references Stripe gives us. These records are kept after the plan ends, as payment records must be. If you take payments as a host: the ID of your Stripe account and whether Stripe lets it take payments. Stripe holds your bank and identity details under its own privacy policy; Oya never sees them or your card.
Ask Oya: your question, with where you are (or the place you name) and the plans, clubs, lines, parks, alerts and market prices you can already see near there, is sent to Anthropic's Claude to write the answer. The question and the answer aren't kept; we keep only how many you asked that day. If you share the days it planned, the link keeps the summary, the dates, the city, your first name and the public things in it (open plans, listed clubs, lines, parks and markets, never a private plan) for 30 days; anyone with the link can see it.
Location
The map centres on you using the position from your phone. That position isn't sent to us. The app asks our server what's on in the neighbourhoods you're looking at, never for a point.
A plan's exact place, and its room or entrance if it has one, are shown only to people who have joined it. Until then, they see the neighbourhood, which is about a kilometre across.
When you search for a place while posting a plan, the text you typed and the centre of the neighbourhood you're in, rounded to about a kilometre, are sent to our server and to OpenStreetMap's Nominatim service to list nearby places. A place you add to the map comes from that search, with OpenStreetMap's coordinates for it, or from a spot you press and hold on the map. Either way it's a place you chose, not where your phone is. We keep a record of which account added a place, to limit abuse. That record isn't shown to anyone.
When you press and hold the map to start a plan, that spot is sent to Apple to look up its address, and saved as the place for your plan.
When you check in, the app takes one location fix and sends it to our server. The server compares it to the place and keeps only yes or no, and how far away you were if the answer was no. The coordinates aren't stored and aren't logged. Oya reads your location in the background only in Owa, after you allow it, while you say you're on or driving a line: to keep your bus on its line and to wake you at your stop. Your phone shows that it's in use the whole time, and it stops when you get off, or after two hours.
The daily hunt and city alerts use your location the same way. For the hunt, the server works out how far the day's place is and which way, and whether you're within 150 metres when you say you found it; it keeps only that you found it and when. A city alert you report keeps the area it's in, about a kilometre across, with no name shown to anyone; the coordinates aren't written down.
Owa: when you say you're on a line, your phone sends where you are while the Owa screen is open, about every 20 seconds or 50 metres, with the direction you're moving. Others see a bus or train on that line at that spot, never your name or face. It's deleted when you say you got off, or after 10 minutes without an update. When you mark a park or a jetty, it's placed where you stand, and we keep which account marked it, which isn't shown. When you say how a destination is at a park (loading, just left, no bus), your position is used once to check you're within 400 metres of it and isn't kept; others see what was said and how many said it, never who, and reports are deleted after a day. When you say what you paid on a line, we keep the line, the stop you got off at, the amount and your account (to allow one a ride); others see only the middle amount paid to each stop in the last 90 minutes and how many said so, and reports are deleted after 30 days. If you say you drive a line, it works the same way, and your bus is shown as having a driver, and as full when you say so. When you say you're waiting for a line, your position is used once to find its nearest stop within 500 metres; only the line and the stop are kept, others see a count of people waiting there and never who, and it's deleted when you get on, say you stopped, or after 20 minutes. When you ask for a trip, where you are and where you're going are sent to our server to work out the ways there; neither is kept. The city's lines come from OpenStreetMap; a line you map keeps its name, stops and fare, and which account made it, which isn't shown.
On the map for friends is off until you turn it on in Profile. While it's on and Oya is open, the app sends where you are, and our server keeps it at most twice an hour, rounded to about 100 metres, and shows it with your face and first name only to your friends, or only the friends you pick, and never to anyone you've blocked or who blocked you. Each spot is deleted 45 minutes after it was kept, and at once when you turn it off or hide for a while; while hidden, nothing new is kept.
While you write a plan for everyone, its title, time, ticket link and neighbourhood are sent to our server to list plans already up for the same event. We look for the same ticket link, or a similar title near the same time in the same neighbourhood, never the address. Nothing is kept until you post.
Who can see what
A plan for everyone shows its title, time, neighbourhood, ticket link if it has one, and how many people are in to anyone nearby, with no name attached. Who's going, the exact place and the room or entrance are shown only to people who join. A plan more than a day away isn't on the map until the day before; until then only people with its link see it.
A plan for friends shows the same, plus your name, to your accepted friends only.
A plan sent by link doesn't appear on the public map. It's shown to whoever opens the link, and the link can be passed on.
Your name, and whether you checked in, are visible to the other people on a plan you joined. Your count, your friends list, your blocks and your reports are visible to you alone.
A plan's chat is seen only by the people who are in that plan, while they're in it, and is deleted with the plan. So are its song requests: what was asked for, by whom, and how many voted.
A group, its chat, its money and its goals are seen only by the people in it. Someone with the group's link sees its name and how many are in it, and nothing else, until they join. Someone who leaves a group stays in its money records, so the totals stay true, but can no longer see the group.
Blocking someone removes you from each other's maps, plans, chats and searches. They aren't told.
Reports
When you report a plan, a message (in a plan or a group) or a person, we keep the report: the reason, anything you wrote, which account made it, and which account it's about. Because a plan is deleted soon after it ends, we also keep a copy of what you were looking at: the plan's title, time, neighbourhood and the name of its place; the message's words, who sent it and when; or the person's name at the time. No coordinate and no position are kept.
A person reads every report within 24 hours. The person reported isn't told who reported them. A report survives either account being deleted, with the link to the deleted account removed.
Who processes data for us
Supabase hosts our database and sign-in, and runs the function that deletes accounts. When you log in with a phone number, the code is sent by text message through Twilio, which receives your number.
Apple provides the map in the app, the names of the areas you look at and of the neighbourhood of a plan you send, and the address for a spot you press on the map. Apple receives the map areas you look at, that neighbourhood's centre, and that spot, under Apple's own privacy policy. If you sign in with Apple, Apple handles that sign-in under its own privacy policy.
OpenStreetMap provides place search (Nominatim) and the map image on the plan link page. Its servers receive the search text and the neighbourhood described above, and the neighbourhood of a plan whose link is opened. We don't send it who you are.
Open-Meteo provides the weather in city alerts. Its servers receive your location, or the middle of the map you're looking at, rounded to about 10 kilometres, without anything that identifies you, under Open-Meteo's own terms.
Expo hosts the plan link page. The plan's identity travels after the # in the link, which browsers don't send to the host, so the host doesn't learn which plan was opened.
Expo and Apple send notifications, if you turn them on. Expo's push service receives your phone's token and the words of each notification, which are who posted and the plan's name, or the group's name and who sent a message, and passes them to Apple, each under its own privacy policy. A notification never says where a plan is or when it is, and never what was said in a group.
Nobody else. There are no analytics, no advertising networks and no crash reporting services in the app.
A ticket link on a plan opens the ticket site, such as Posh or Eventbrite, in your browser or its app, under that site's own privacy policy. We don't send it who you are, and we don't sell or hold tickets.
Paystack takes payments for spots in naira, under Paystack's own privacy policy. A host who takes payments in naira gives Paystack their bank and account number; Oya keeps only the bank's name and the last four digits. A buyer's card or bank details go to Paystack, never to Oya; Paystack receives the buyer's email, or, for an account with no email, an address made for the payment that receives nothing. We receive the amount, Paystack's reference for the payment, and which spot it was for.
Flutterwave takes payments for spots in Uganda, Tanzania and Rwanda, under Flutterwave's own privacy policy, in the same way: a host gives Flutterwave their bank or mobile money account and a phone number, and Oya keeps only the bank's name and the last four digits; a buyer's card or mobile money details go to Flutterwave, never to Oya. We receive the amount, Flutterwave's reference and id for the payment, and which spot it was for.
Stripe takes card payments from hosts who add credit, under Stripe's own privacy policy. Your card details go to Stripe, never to Oya. We receive the amount, Stripe's reference for the payment, and which Oya account it was for.
Spotify, if a host connects it, under Spotify's own privacy policy. Spotify receives the searches people make for songs to request, without who made them, and, for a connected host, our requests to see what is playing and to add a song to their queue.
Anthropic, whose Claude reads the feedback you send so it can be sorted and summarised for us. It receives what you wrote, the screen and the app's build, never who sent it or anything about your phone, under Anthropic's own commercial terms.
If you sign in with Google, Google handles that sign-in under its own privacy policy. We receive your Google identifier, email address and name, and nothing else from your Google account.
Anthropic, whose Claude writes Ask Oya's answers. It receives your question, your first name and the things near you that you can already see in Oya (with the first names of friends going), never your phone number, under Anthropic's own commercial terms.
Keeping and deleting
A plan, and everything about who joined it, is deleted an hour after it ends by a job that runs every fifteen minutes. The daily count of plans you joined is kept for two days, to limit abuse, and then deleted.
You can delete your account, or your guest, from inside the app. It happens immediately. It removes your login, your name, your photo, any plan you posted that's still up, your spot on plans you joined, your messages in plan chats and groups, your friends, requests and blocks, your phone's notification token, and your count. Places you added to the map stay, with nothing saying who added them. Reports stay, with the link to your account removed.
If you checked in at a plan and its host runs it again, you get one notification about the new one, if you can see it. Who checked in is the record the plan already kept; nothing more is kept for this.
Notifications waiting to be sent are deleted after a week.
A group's messages are deleted after 30 days. A group is deleted when its last member leaves, with its chat, money and goals. Deleting your account leaves your expenses, payments and goal entries in the groups you were in, with nothing saying they were yours, so the other members' totals stay true.
Our hosting provider keeps short-lived backups of the database for disaster recovery. Deleted data may remain in those backups for a limited time before it's gone from there too.
Your choices
You can use Oya without an account, without a name, and without turning on location. With location off, you move the map by hand and can't check in.
You can see and change your name, your photo, your friends and your blocks in the app. To exercise any other right over your data, or to ask what we hold, write to [email protected] from the address on your account, or describe your guest from inside the app's help page.
You can turn notifications off in Profile, or in your phone's Settings.
Age
Oya is for people aged 17 and over. We don't knowingly collect anything from anyone younger. If you believe someone under 17 is using Oya, tell us at [email protected] and we'll remove the account.
Security and changes
Data travels encrypted between the app and our servers. Access to the database is restricted to what each screen needs, enforced on the server, and tested before every release.
We may update this policy. The date at the top is the date of the current version. We'll show you a material change in the app before it applies. Questions go to [email protected].
Contact
Questions, reports, or a request about your data: [email protected]