Privacy Policy

1. Information We Collect

Account Information

When you create an account, we collect your email address and password (hashed and stored securely). If you sign in with Google or Apple, we receive your name, email, and profile photo from those services.

Profile Information

You may provide a display name, username, avatar photo, and date of birth. Date of birth is used solely for age verification (to confirm you are 13 or older) and to determine account type.

Usage Data

We collect information about how you use YCU, including videos watched, courses completed, quiz responses, XP earned, streaks, and group activity. This data powers your progress tracking, leaderboards, and personalized recommendations.

Analytics

We use PostHog to understand how users interact with the app. PostHog collects anonymized usage events such as screen views and feature usage. We do not track your location. Analytics data is used to improve the app experience and fix issues.

Push Notifications

If you enable push notifications, we store a device token to deliver notifications about group activity, new content, streaks, and other updates. You can disable notifications at any time in your device settings.

2. How We Use Your Information

We use your information to:

• Operate and maintain your account
• Track your learning progress, XP, and streaks
• Display leaderboards and group activity
• Send push notifications you have opted into
• Improve the app through anonymized analytics
• Respond to support requests
• Enforce our Terms of Service

3. Information We Do Not Collect

We do not collect your precise location, contacts, browsing history outside the app, or any biometric data. We do not sell, rent, or share your personal information with advertisers or data brokers.

4. Data Storage and Security

Your data is stored securely using Supabase (hosted on AWS infrastructure) with encryption at rest and in transit. Passwords are hashed using industry-standard algorithms. We use row-level security to ensure users can only access their own data.

5. Third-Party Services

We use the following third-party services:

• Supabase — authentication, database, and file storage
• PostHog — anonymized product analytics
• Expo — app updates and push notifications
• Google and Apple — social sign-in (if you choose)

Each service has its own privacy policy. We only share the minimum information necessary for these services to function.

6. Children's Privacy

YCU is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13, we will delete that account and data promptly. If you believe a child under 13 has created an account, please contact us.

7. Your Rights and Choices

You can:

• Update your profile information at any time
• Disable push notifications in your device settings
• Request a copy of your data by contacting us
• Delete your account, which will remove your personal data

If you are in the EU/EEA, you have additional rights under GDPR including the right to access, rectify, port, and erase your data.

8. Data Retention

We retain your data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days. Some anonymized, aggregated data may be retained for analytics purposes.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the app or by email. Your continued use after changes constitutes acceptance.

10. Contact

If you have questions about this Privacy Policy or your data, contact us at support@ycu.app.