CYA Privacy Policy

CYA Inc. (“CYA”, “we”, “our”, or “us”) understands that privacy is important to our users. This Privacy Policy explains what information we collect, how we use and share it, and the choices you have. It applies whenever you use the cya.live website, the CYA mobile apps for iOS and Android, the CYA browser extension, and every feature they offer, including live streams, event chat, direct messages, video calls, Spaces, and Meet N Mix (together, the “Service”), and to all visitors, registered users, and others who access or use the Service.

By using or accessing the Service you agree to this Privacy Policy and to our Terms of Service. If you do not agree, do not use the Service.

We may update this Privacy Policy from time to time. When we make material changes we will post the new policy here with a new “Last updated” date and, where appropriate, notify you in the app or by email. If you object to a change you should delete your account; continuing to use the Service after a change means you accept it.

1. Information you give us

Account. To create an account you provide an email address and a password, or sign in with Apple or Google (see section 5). You choose a display name and a public @handle, and you may add a profile photo, a bio, tags, and your date of birth. You can watch free public shows without an account, but you need one to get a ticket, chat, message friends, or host.

Your public profile. Your display name, @handle, profile photo, bio, tags, and the shows you host are visible to other users and, for public shows, to anyone on the web. Other users can see when you are in a room, on stage, or online to friends.

Content you create. When you go on stage or start a video call, your camera and microphone streams are transmitted to the other participants and, for shows, to the audience; hosts may record shows, and recordings can be published as replays or clips. Chat messages, direct messages, group messages, reactions, and anything you upload (photos, videos, slides, links) are stored so they can be delivered and shown.

Tickets and purchases. Paid tickets, Space subscriptions, and store items are purchased on cya.live through Stripe, our payment processor. Stripe collects your card details directly under its own privacy policy; CYA never sees or stores your full card number. We keep a record of what you bought, when, and for how much. The mobile apps only claim free tickets.

Support. When you contact us we keep the correspondence and the information you include in it, such as your name and email address.

2. Information the apps and website collect automatically

• Device and usage data: device model, operating system and app version, browser type, language and time zone, IP address and the approximate region derived from it, referring pages, the pages and screens you view, the shows you watch and for how long, crashes and errors.
• Push notification token: if you allow notifications, the app registers a device token (via Expo Push, backed by Apple Push Notification service on iOS and Firebase Cloud Messaging on Android) so we can notify you about messages, calls, friend requests, and shows. The token is removed when you sign out.
• Camera and microphone: the apps use the camera and microphone only when you choose to join the stage of a live show or start a video call, and only while you are on stage or in the call. They are never accessed in the background or without your action. You can revoke access at any time in your device settings.
• Bluetooth: on Android the app requests Bluetooth permissions so audio can be routed to connected headphones or speakers during calls and stage sessions. We do not scan for or store information about nearby devices.
• Cookies and similar technologies on the website, described in section 6.

We do not collect your precise location. We do not read your contacts, photos, or files unless you choose to share a specific item.

3. How we use information

• To operate the Service: deliver streams, chat, messages, calls, tickets, and replays.
• To maintain your profile and let other users find and interact with you.
• To personalise what you see, such as the For You feed and trending content, based on what you watch, like, and save.
• To send service messages: registration confirmations, ticket receipts, show reminders, security notices, and responses to your requests. You cannot opt out of messages needed to run the Service.
• To send marketing emails, only if you have consented; every one has an unsubscribe link.
• To keep the Service safe: detect and investigate fraud, abuse, and violations of our Community Guidelines, act on reports, and enforce our Terms.
• To understand how the Service is used and to improve it, using aggregate analytics.
• To comply with law and respond to lawful requests.

4. How we share information

• With other users, as described above: your public profile, your presence in rooms, your stage video and audio, and the messages and content you post.
• With service providers who process data on our behalf and only for that purpose, including cloud hosting and storage, real-time video and messaging infrastructure, content delivery, push notification delivery (Expo, Apple, Google), payment processing (Stripe), email delivery, and analytics. They are not permitted to use your information for their own purposes.
• Aggregated or de-identified data that cannot reasonably identify you may be shared with anyone, for example audience counts for a show.
• For legal reasons: to comply with law, regulation, legal process, or a governmental request; to investigate suspected fraud, harassment, or other violations of law or of our policies; and to protect the rights, property, and safety of CYA, our users, and the public.
• In a business transfer: if CYA is involved in a merger, acquisition, financing, reorganisation, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify affected users before personal information becomes subject to a different privacy policy.

We do not sell your personal information.

5. Signing in with Apple or Google

If you sign in with Apple or Google, we receive your name, email address (or Apple’s private relay address if you choose to hide your email), and a token that lets us verify the sign-in. We use it only to create and sign you into your CYA account. When you delete your account we revoke the Apple sign-in token with Apple.

6. Cookies, analytics, and advertising on the website

The cya.live website uses cookies and similar technologies (including local storage and web beacons) to keep you signed in, remember your preferences, measure how the site is used, and, where enabled, show interest-based advertising. We use session cookies, which expire when you close your browser, and persistent cookies, which last up to one year. Analytics providers such as Google Analytics may set their own cookies under their own policies. We may also collect “clickstream” data, the trail of pages you visit and the sites you came from, in aggregate and anonymous form, to understand how visitors move through the site.

Where interest-based advertising is used, it relies on non-identifying information and may involve cross-device matching by our vendors using probabilistic techniques. You can restrict or clear cookies in your browser settings, and opt out of interest-based ads through your device’s advertising settings (iOS: Settings → Privacy → Tracking; Android: Settings → Google → Ads). The website will still work, though some features may not.

The mobile apps do not use advertising identifiers (IDFA or Android advertising ID) and do not track you across other companies’ apps or websites.

7. Security

We use commercially reasonable technical and organisational measures to protect your information, including encryption in transit for all Service traffic, encrypted storage of credentials, and access controls for our staff and providers. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security. Protect your login details and do not share your account. Do not share confidential or sensitive information in chat with people you do not know.

8. Data retention

We keep your information for as long as your account is active and as needed to provide the Service. Chat messages, direct messages, and uploads are kept while the conversation or show they belong to exists. Recordings and replays are kept until the host removes them. Purchase records are kept as required by tax and accounting law. When information is no longer needed we delete it or de-identify it; we may keep aggregate or anonymised data indefinitely.

9. Deleting your account and your rights

You can delete your account at any time from the app (Menu → Settings → Danger zone → Delete account) or the website (Settings → Your account → Deactivate account), or by emailing info@cya.live from the address on your account. Full instructions are at cya.live/delete-account. Deletion is immediate and permanent: your profile, sign-in details, friends, saved and liked shows, notification tokens, and personal data are removed; shows you hosted and messages you sent remain visible to their audiences with your name and profile removed; and records we must keep by law are retained only for as long as the law requires.

You may also ask us to tell you what personal information we hold about you, to correct it, or to give you a copy, subject to legal exceptions. Depending on where you live you may have additional rights, such as the right to object to certain processing or to lodge a complaint with a privacy regulator. Contact us using the details in section 13.

10. Children

The Service is designed for people 13 years of age and older, and features that connect you with people you do not know, such as Meet N Mix, require you to be 18 or older. We do not knowingly collect information from anyone under 13. If we learn that we have, we will delete it. If you believe a child under 13 has an account, contact us.

11. Where your information is processed

CYA is based in Canada and uses cloud providers with infrastructure in Canada, the United States, and other countries. By using the Service you consent to your information being transferred to and processed in those countries, where it may be accessible to law enforcement and national security authorities under local law.

12. Other websites, apps, and services

The Service may contain links to, or embed content from, third-party sites and services such as YouTube. Their privacy practices are their own; we do not control them and are not responsible for them. Please review their policies before using them.

13. Contact

CYA Inc., Attention: Privacy Officer
2020 Winston Park Drive, Suite 200, Oakville, ON L6H 6X7, Canada
info@cya.live