Privacy Policy

02Your verification documents

These are the most sensitive thing you give us, so they are handled separately from everything else.

They go into private storage that other users cannot read. A single reviewer on our team looks at them to confirm the ID appears genuine and matches your selfie. The moment a decision is made — approved or rejected — the files are deleted from storage. What remains is the outcome, the timestamp, and a record of who decided.

They are never shown to other travellers, never shown to organizers, and never sold or shared with third parties.

03Who can see what

• Other travellers and organizers see your name, photo, city, age, verification badges, and travel preferences.
• An organizer you have applied to also sees your application message and your trust tier.
• Organizer payment details, including any QR code, are readable only by that organizer and by travellers holding an accepted seat on one of their trips.
• Reviews you write about a traveller stay private and are only ever surfaced in aggregate. Reviews you write about an organizer become public under the rules in our Terms.
• Nobody sees your email address, your password, or your verification documents.

04Why we are allowed to hold it

• To provide the service you asked for — matching, applications, and payment records are the product.
• To keep people safe. Identity verification is the core of a marketplace where strangers travel together and money changes hands.
• With your consent, which you give explicitly before uploading any ID document and can withdraw by deleting your account.
• To meet legal obligations where they apply.

05Who we share it with

We do not sell your data. We do not share it for advertising. It goes to a small number of processors who run parts of the service on our behalf, and only for that purpose:

• Supabase — database, authentication, and file storage.
• Resend — sending the small number of emails that matter, such as being accepted or a seat expiring.
• PostHog — product analytics, so we can see which parts of the app work.
• Vercel and Render — hosting.
• We may also disclose information where the law requires it, or where it is necessary to protect someone from harm.

06How long we keep it

• Verification documents: deleted the moment a decision is made.
• Account and profile data: for as long as your account is open.
• Trip and payment records: retained after account closure where they form part of another person record of a trip or a payment, because deleting them would erase their history too.
• Analytics: retained in aggregate.

07Your rights

You can ask us to show you what we hold about you, correct anything wrong, delete your account and personal data, or export your data in a portable form. Most profile fields you can edit yourself from your profile page.

For anything else, write to hello@yaply.live and we will respond. We may need to confirm who you are first.

08Security

Data is encrypted in transit. Access to it is restricted by row-level security rules, so one user account cannot read another user private data even if it tries. Verification documents live in private storage reachable only through short-lived signed links.

No system is perfect. If we ever discover a breach affecting your personal data, we will tell you and the relevant authority as the law requires.

09Children

Yaply Groups is for adults. You must be 18 or older to hold an account. If we learn that an account belongs to someone under 18, we will close it and delete the data.

10Changes

If we change how we handle your data in a way that matters, we will tell you before it takes effect rather than quietly editing this page.