Privacy

The privacy policy and the terms, both dated "Last updated 25 October 2026," are more specific than the homepage. They also describe a normal centralized chat app: the operator can read text, automated filters read it first, and voice encryption depends on the server handing out keys. This page follows those documents. It does not describe a breach. None is in the public record this site found.

On 25 October 2026, Reddit user ja_n2000 posted "Seeing Yapper/Yapin' being hyped up like that is kinda scary" on r/DiscordAlternatives, working from the policy. The post is right about text messages and about unverified call keys. Two points in it are sharper than the policy text of that same day: the desktop process scan is off unless you turn it on, and the privacy policy says the sponsored GIF is switched off right now. Both are covered below.

Text messages are readable by the service

Terms section 5.4:

Direct messages and group chats are visible to their members. Messages on Yapin' are encrypted in transit but are not end-to-end encrypted, so don't use Yapin' for information that must stay strictly secret.

Terms section 5.5 says content you send, "including direct messages, group chats and files," is checked by automated systems on their servers and their providers' servers. The checks look for slurs and hate symbols, selling sexual content, telling someone to hurt themselves, adult links, spam, scam and phishing links, malware, sexual or violent or abusive images, child sexual abuse material, and ban evasion. A message that fails "is refused before it's saved."

The privacy policy says staff look at private content when it was reported, flagged by a check, or when safety, security, or the law requires it. "Only the people in a DM can read it in the app" can be true of the interface and still leave the operator able to read the same text on the server.

A message you delete is kept privately for 2 days so it can still be reported. Backups are kept up to 7 days. Server logs, up to about 30 days. If content is under investigation, they may keep it longer. For child sexual abuse material the policy says at least one year, reported to NCMEC and/or the authorities.

Pictures go to a second company when the filter is unsure

After an upload, their servers check images, GIFs, and videos. When that check thinks an image might be sexual, "the image itself (not your name, account or messages) is sent to Anthropic's Claude AI for a second look." Claude also checks for graphic violence and gore on every picture posted in Yapin' HQ, and on pictures from accounts less than a day old. The policy says Anthropic does not use these images to train its AI.

That is a real disclosure, and it is also a third party in the path of private pictures. A flagged DM image leaves Yapin' and is read by Anthropic's model. The homepage FAQ does not mention Anthropic.

Voice encryption you cannot check

Terms section 13:

They are end-to-end encrypted: the audio and video are encrypted on your device with keys that only the people in the call (including any bot taking part) have, so we and our providers can't listen in or watch while the service works as designed. The app doesn't yet let you check another person's key yourself, so this protection relies on our servers passing keys on honestly.

The privacy policy says the same thing in shorter form: "the app can't yet show you a code to check someone's key yourself." Who joined a call, and when, is visible to the operator. Calls are not recorded by Yapin', according to both documents.

There is a built-in exception after decryption. While you are in a voice channel, your device keeps the last 30 seconds of call audio in memory. It stays there unless you report someone and leave "Attach last 30 seconds of audio" on. The clip is then stored with the report, only staff can listen, and it is deleted 30 days after the report is handled. Other people in the call can do the same to you. Screen share and video are not included in the clip. A bot in the call is also a holder of the keys, by the sentence quoted above.

So the voice design is: encryption on the device, keys distributed by the server, no safety number, and a 30-second audio upload path for reports. The policy states the trust assumption in plain language. The marketing says "end-to-end encrypted calls and screen share" in the 23 October announcement, without that sentence.

A device ID, kept for two years

The app stores a random device ID in local storage and in a first-party cookie named yd that lasts 2 years. It is sent when the app loads. The policy says the ID is not derived from hardware, and that the server stores it, and the network you connect from, only as salted SHA-256 hashes. The hashes are used to block ban evasion and to refuse Shards rewards and decoration sales between accounts on the same device or network. Hashes that have not been seen for 120 days are deleted.

Sign-up IP addresses are kept 90 days, "to limit sign-ups per address." Sign-in attempt IPs are kept about a day. If a banned account is deleted, a hash of its email and of networks it signed in from can be kept until the ban would have ended, a year at most.

The policy also says there are no advertising or tracking cookies, and no cookie banner, because the storage is "strictly necessary." A two-year device identifier used to link accounts is a tracking mechanism for abuse control. Whether that needs a consent banner is a legal question this page does not decide. The policy's own description is that the cookie exists and lasts two years.

The desktop app can read process names

This is off unless you enable it. From the privacy policy:

Desktop app game status: off unless you turn on "Show what I'm playing" in the desktop app. When it's on, the app looks at the names of programs running on your computer every 20 seconds to spot known games. That list stays on your computer; only the matched game's name is sent to us, to show "Playing …" on your profile.

The legal basis they give is consent. Discord has a similar "display current activity" feature. The difference they do not mention on the homepage is that this client is closed source and was first shipped, by the operator's own account, in the same fortnight as the rest of the app. Nobody outside the project can read how that process list is collected. The Reddit post treats that as a local security risk. That is a risk judgment, not a published vulnerability.

Ads are written into the terms, and switched off in the policy

Privacy policy, 25 October 2026: "Sponsored GIFs: this is switched off right now." When it is on, the picker can show one ad, marked Sponsored, from KLIPY. To choose it, the server sends KLIPY a random ID that changes every time, the browser user agent, the language, and the picker's width. The ad loads from KLIPY and its ad partners in a frame, so those companies see the user's IP address. The policy says Yapin' does not share name, email, messages, servers, or friends with them, and does not build ad profiles.

The stated legal basis for showing the ad is "our legitimate interests in keeping Yapin' free." Terms section 14 is written in the present tense: the GIF picker "may show ads from KLIPY and its ad partners." GIF search queries are sent to KLIPY by the Yapin' server either way. Message text that the browser cannot translate on device is sent to Google Translate by their server, without names or account details.

The homepage line is "No data selling, no ad profiles." The policy agrees they do not sell personal data. The ad slot is already specified, justified, and waiting.

Who holds the data

The privacy policy names the processors:

The database is in the EU. The company is a Delaware LLC, and several processors are in the United States. The policy says those transfers use the providers' standard contractual clauses and, where certified, the EU-US Data Privacy Framework. Access control for chats is described as "access rules in our database." That is consistent with Supabase row-level security, which the Reddit post assumes. The policy does not use the phrase "row level security," and no outside audit is linked.

Linked accounts are optional: Steam, AniList, Last.fm, and Trakt. If you connect them, Yapin' stores the public profile data those sites return, including games and hours, anime lists, or listening and watch history, and refreshes it from their APIs. Friend suggestions can be built from that plus shared servers. There is an opt-out.

What you can actually do

The policy says you can delete the account in settings, and that deletion removes the login, profile, messages, reactions, friends, uploaded pictures, linked accounts, Shards, device hashes, and servers you own. Decorations you made that other people bought stay on their profiles. Payment records stay for as long as tax law requires. A self-serve export exists: Settings, My Account, Your data, Download. One JSON file, newest 50,000 messages, up to 3 times a day. The terms say that if the service shuts down they will "try" to give 30 days' notice and let you download your data "where reasonably possible."

Minimum age is 13. The operator is Yapper Media LLC. The contact for data requests is hello@yapin.gg. They name the Czech Office for Personal Data Protection as their lead authority and say the service is run from the Czech Republic, so GDPR applies to the policy. The company itself is American. See Who runs it for what that company is, and is not, on paper.