Privacy Policy

Last updated: 16 June 2026 · Effective: 16 June 2026

This Privacy Policy explains how WAYA collects, uses, shares, and protects your information, and the rights you have over it. It is written to meet the standards of the EU/UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), and the requirements of the Apple App Store and Google Play. Please read it carefully. By creating an account or using WAYA you agree to this Policy.

1. Who we are

WAYA ("WAYA", "we", "us", "our") is a communication app operated by the WAYA Team, which is the data controller for the purposes of GDPR. You can reach us about privacy at privacy@wayahq.com.

2. Age requirement — 18 and over

WAYA is intended only for adults aged 18 years or older. You must be at least 18 to create an account or use the app. WAYA is not directed to, and we do not knowingly collect personal information from, anyone under 18. If we learn that we have collected information from a person under 18, we will delete that account and its data promptly. If you believe a minor is using WAYA, contact privacy@wayahq.com.

3. What WAYA is

WAYA is a mobile and web communication app for private one-to-one and group messaging, voice notes, photo and video sharing, voice and video calls, and 24-hour "status" updates. You sign in with a username and password — WAYA does not require your phone number or email address to create an account.

4. Information we collect

4.1 Information you provide

• Account details: a username, a password (stored only as a salted one-way bcrypt hash — we never store it in readable form), an optional display name, an optional profile photo, and an optional short status text.
• Recovery code: if you choose to set one, it is stored only as a salted one-way hash so you can reset your password without email. We cannot read it.
• Content you create and send: your messages, voice notes, photos, videos, and status updates, and who you exchange them with.
• Reports and blocks: if you report content or block a user, we record that action to keep the service safe.

4.2 Information collected automatically

• Service metadata: message timestamps, the conversation a message belongs to, delivery/read status, and a "last active" time used to show whether you are online. This metadata is needed to deliver the service.
• Push notification token: only if you turn on notifications, we store the subscription token your browser or device provides so we can deliver call and message alerts.
• Technical data: when your app connects to our servers, standard internet data such as your IP address is processed by our hosting and call providers to deliver content and protect against abuse. We do not use this to build advertising profiles.
• On-device preferences: some settings (such as muted statuses, your chosen chat wallpaper, and similar preferences) are stored locally on your own device using browser local storage, not on our servers.

4.3 Information we do NOT collect

• We do not require or collect your phone number or email address.
• We do not access or upload your phone's address book or contacts.
• We do not collect your precise (GPS) location.
• We do not use advertising identifiers (IDFA / GAID) or third-party advertising or analytics SDKs.
• We do not sell your personal information.

5. How we use your information

• To create and maintain your account and let friends find you by username.
• To deliver your messages, voice notes, media, status updates, and to route your voice and video calls.
• To send notifications you have enabled (incoming calls and messages).
• To keep WAYA secure — authenticate sign-ins, prevent and investigate abuse, and act on reports and blocks.
• To maintain, troubleshoot, and improve the reliability and performance of the service.
• To comply with applicable law and respond to valid legal requests.

6. Legal bases for processing (GDPR)

• Performance of a contract — to provide the core messaging, calling, and status features you ask for.
• Legitimate interests — to keep the service secure, prevent abuse, and improve reliability, balanced against your rights.
• Consent — for optional features such as push notifications, camera, microphone, and photo access. You can withdraw consent at any time in your device settings.
• Legal obligation — where we must process data to comply with the law.

7. How your information is shared

We share the minimum necessary, and only with service providers ("sub-processors") that process data on our behalf under contract, or where required by law. We do not sell your personal information and we do not share it for cross-context behavioural advertising.

We may also disclose information (a) to comply with law, regulation, legal process, or an enforceable governmental request; (b) to enforce our Terms or investigate potential violations; (c) to detect, prevent, or address fraud, security, or technical issues; or (d) in connection with a merger, acquisition, or sale of assets, in which case we will require the recipient to honour this Policy.

8. International data transfers

WAYA operates globally, and your information may be processed in countries other than your own, including the European Union and the United States. Where personal data is transferred across borders, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or transfers to jurisdictions recognised as providing adequate protection.

9. How long we keep your information

• Account information: kept while your account is active.
• Status updates: automatically deleted 24 hours after you post them.
• Messages and media: kept so they can be delivered and shown in your conversations, until you or the other participant delete them, or until your account is deleted.
• Account deletion: when you delete your account in the app, we remove your profile, content, and media from our active systems, generally within 30 days. Residual copies may persist briefly in encrypted backups before being overwritten.
• Safety records: limited records of reports or blocks may be retained where needed to protect the service or comply with law.

10. Security — and an important note on encryption

We protect your information with industry-standard measures, including encryption in transit using TLS/HTTPS, encryption of stored data at rest by our infrastructure providers, access controls, and storing passwords and recovery codes only as salted one-way hashes.

WAYA is not end-to-end encrypted. Your messages, voice notes, and media are encrypted while travelling over the internet and are stored securely, but they are held on our servers in a form that our systems can access in order to operate the service, deliver your content, and comply with law. You should not use WAYA to send information you would not want stored on a server. We are transparent about this so you can make informed choices; we may introduce stronger encryption in future versions and will update this Policy if we do.

No method of transmission or storage is completely secure. Help protect your account by using a strong, unique password, setting a recovery code, and keeping your device and operating system up to date.

11. Your privacy rights

11.1 Everyone

You can access and update your profile in the app, change your password, and delete your account and content at any time using You → Delete my account. You can block or report users from within the app.

11.2 EEA / UK (GDPR)

Subject to conditions in the law, you have the right to access, correct, erase, restrict, or object to our processing of your personal data, to data portability, and to withdraw consent. You also have the right to lodge a complaint with your local data protection authority (for example, Ghana's Data Protection Commission, or an EU/UK supervisory authority).

11.3 California (CCPA/CPRA)

California residents have the right to know and access the personal information we collect, to request deletion, to request correction, and to opt out of the "sale" or "sharing" of personal information. WAYA does not sell or share your personal information, and does not use sensitive personal information for purposes that require an opt-out. We will not discriminate against you for exercising your rights.

To exercise any right that is not available directly in the app, email privacy@wayahq.com. We will respond within the time required by applicable law and may need to verify your identity, for example by confirming control of your account.

12. Cookies and local storage

WAYA uses your device's local storage to keep you signed in and to remember in-app preferences. We do not use advertising or cross-site tracking cookies.

13. Notifications, camera, microphone, and photos

WAYA asks for permission to use your microphone and camera (for voice notes, calls, and taking photos), to access photos you choose to send, and to send notifications. These permissions are optional, are only used for the features you trigger, and can be turned off at any time in your device settings.

14. Children

As stated in Section 2, WAYA is for adults aged 18 and over and is not directed to minors. We do not knowingly collect personal information from anyone under 18.

15. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date above, and for material changes we will provide notice in the app before the change takes effect. Your continued use of WAYA after an update means you accept the revised Policy.

16. Contact us

• Privacy & data requests: privacy@wayahq.com
• Support: support@wayahq.com