Privacy Policy
Last updated: July 20, 2026 · Applies to the NayYay app and web app during the private beta.
Who we are
NayYay is an opinion-tracking and sharing app operated from Toronto, Ontario, Canada. Questions about this policy: support@nayyay.com.
What we collect
- Account: your email address and a password (handled by our authentication provider — we never see or store your password in readable form), plus an optional display name you choose.
- Your content: the verdicts (Yay/Meh/Nay) and comments you record, the photos you take (products, labels, menus, receipts, shelves, storefronts), and the barcodes you scan.
- Location: when you record an opinion, the app may capture your approximate GPS position as part of that opinion's private context (for example, to remember which restaurant a dish belongs to). “Near me” searches use your position at that moment to find places, and it is not shared with other users. A place's address and coordinates (a restaurant's location) are catalog facts, not personal data.
- Basic device info: platform (phone or browser) recorded with each capture, so we can debug problems.
Photos and hidden metadata
Camera photos carry hidden metadata (EXIF) that can include where and when the photo was taken. NayYay handles this in two layers:
- Every photo served to any user — including your friends — is re-encoded with all metadata removed. Nobody can pull your home's GPS coordinates out of a photo you shared.
- We retain your original photo, with its metadata, privately — it is never served to any user, including you, through the app. We use it only for data quality: verifying a product matches its barcode, or resolving which place a capture belongs to. It is deleted with your account.
Sharing — private by default
- Your opinions are visible only to you unless you connect with a friend using a one-time invite code.
- Sharing is directional and chosen by each side: when connecting, you each pick whether to share your opinions, see the other person's, both, or neither.
- What friends see: your shared verdicts, comments, and the cleaned photos — never your private capture context (GPS, original photos).
- Nicknames you give your friends are private to you. Friends see the display name you chose for yourself, or a masked version of your email.
- You can disconnect from any friend at any time; their access ends immediately.
What we never do
- We do not sell or rent your data. To anyone. Ever.
- We do not run ads and do not share your data with advertisers.
- We do not track you across other websites or apps.
- We do not scrape your contacts. Connections happen only by invite codes you exchange yourselves.
Where your data lives
- Database and accounts: Supabase, hosted in Canada (ca-central-1 region).
- Images: Cloudflare R2 object storage. Image access requires a signed, short-lived link minted only for signed-in users.
- Access to your rows in the database is enforced at the database layer (row-level security), not just in the app.
Catalog data from public sources
Product, place, and book facts shown in NayYay may come from Open Food Facts and OpenStreetMap (both under the Open Database License) and Open Library. These are facts about products and places, not about you.
Deleting your account
Settings → Delete account, inside the app. This permanently removes your opinions, comments, friend connections, and your photos — including the private originals. Facts you contributed to the shared catalog (for example, a product's name or a restaurant's address) may be retained, permanently severed from your identity. Deletion cannot be undone.
The beta request form
If you ask for a beta invite on our website, the form (your name, email, and message) is emailed by our own web server to beta@nayyay.com, and you receive a copy of your request by email. No third-party form service is involved, and the form data is not stored on the web server. We use what you send only for the invite conversation — it never becomes a mailing list, and it isn't shared with anyone else.
Children
NayYay is not directed to children under 13, and we don't knowingly collect their data.
Changes to this policy
If this policy changes in a way that matters, we'll say so in the app and update the date at the top of this page. During the beta, expect small clarifications as features evolve.