Privacy Policy

This Privacy Policy explains what YaaFlip collects, why, who sees it, how long we keep it, and what you can do about it. YaaFlip is operated by Popcode Studio, LLC, a Georgia limited liability company (contact: Brenton Strine), 2530 Hosea L. Williams Dr. NE, Atlanta, GA 30317, 626-731-4682, hello@yaaflip.com. YaaFlip is a service for children used through their parents' accounts, so this policy covers both the adults who hold accounts and the children who use them. The Parent Consent Disclosures are our direct notice to parents under the Children's Online Privacy Protection Act (COPPA) and are part of this policy.

The short version

• We collect the least we can and we delete on a clock. Videos are deleted when a listing ends. Location is read at the moment it is needed and never stored, except the few fixes that prove a drop-off or a pickup, which are deleted after the trade.
• We never store your home address or any location of your family, with one exception you choose: your porch address, if you open your porch to your kids' friends.
• We never show, sell, rent or share anything about your family for advertising. There is no advertising on YaaFlip and no tracking of your family across other sites or apps.
• A child's video is seen only by verified families whose chosen drop-off spots lie within their browse distance of the listing's drop-off spots, never by the public, never by a search engine.
• We keep only what we need about your identity: your verified name, the type and issuer of your ID, the last four digits of its number, a one-way hash of the number, and the live face capture from your identity check. We never receive or keep the picture of your ID.
• You can see everything about your family inside the app, delete a kid's profile, and delete your whole account, at any time.

Information about adults

Your account

Your email address, a password (stored only as a one-way hash by our authentication provider, Supabase), whether your email is confirmed, your parent PIN (stored as a one-way hash), your notification settings, your household's drop-off spots and browse distance, your settings for how your kids may spend points and for porch pickup, and the devices you are signed in on (so you can sign one out). We record which version of our legal documents you accepted and when.

Payment

Your card is collected and stored by Stripe, our payment processor; card numbers never pass through YaaFlip. We keep Stripe's customer identifier for your account, the card's brand, last four digits and expiry so we can show you which card is on file, and a record of each purchase of Yaa! Points (amount, date, Stripe's charge identifier, and a link to Stripe's receipt). Stripe also collects the billing postal code or address your card issuer checks. No child's name or profile reaches Stripe; our code allows only internal identifiers in what we send.

Identity

To activate, and to join a household as a second adult, you complete an identity check with our identity vendor, Didit: a photo of a government ID and a live face capture, with liveness checks. Didit confirms the document is genuine and that the face matches it, then returns results to us. We keep: your full name as it appears on the document, the document type and issuing state, the last four digits of the document number, a salted one-way hash of the full number (so we can recognize the same document if it is used again, without storing it), the live face capture (stored in an encrypted bucket that no app screen can display, used only by our staff to resolve a registry name match or investigate abuse), and Didit's risk signals about the device and network used. We do not keep the ID image, your date of birth beyond what the check requires, or the full document number, and we delete the verification session at Didit after we have recorded this set. Didit's own processing takes place on infrastructure in the European Economic Area, with transfers under Standard Contractual Clauses.

Every adult's verified name and issuing state are checked against national and state sex-offender registries through our registry vendor, Offenders.io. A match is reviewed by a person; nothing is decided automatically. We may also run an automated check of public news sources on the verified name, whose only effect is to flag an account for human review; it is never used to decide anything on its own. These checks are not consumer reports and are not used for employment, credit, housing or insurance purposes. We keep a record of each check and its outcome.

Invites, friend codes and sessions

When an invite or a friend code is redeemed, and when you sign in, we record the network address and basic details of the device (its type and browser), and whether it was opened from the YaaFlip launcher on your home screen. We use this only to verify identity, enforce rate limits and investigate abuse, and to tell you about a sign-in from a device we have not seen before.

Location

At activation, and whenever you change your family's drop-off spots or open your porch, your browser asks you for your location. We use it in that moment to check that each drop-off spot you choose is within 20 miles of you (or, for a porch, to place the porch), and we do not store it. The only locations we store about a family are the public drop-off spots it chose and, if you open your porch, the porch address and position (see Porch pickup).

Porch pickup

If you switch on "our porch is open for pickups", we store the porch address you type and the position of your phone at that moment, so the pickup can be checked against it. That address is shown only to the parent of a buying family whose child is a confirmed friend of your child, only for that one trade, in the parent zone, and the disclosure record is deleted when the trade ends. Turning the switch off deletes the stored porch.

Support and other messages you send us

Notes you write about a trade from Safety & support, questions you send from our FAQ form, and emails to hello@yaaflip.com. A note about a trade is read together with that trade's record. An automated assistant (Google Gemini on a paid, no-training tier) may classify your note, draft a reply and, for simple matters, resolve it using the same tools our staff use; our staff can see every reply and action afterwards, and replying "not solved" sends it to a person. Notes that mention a child's safety always go to a person first.

Hosting a drop-off spot

If you apply to host a drop-off spot, we collect your name, email, phone, the place's name, kind, address and position, hours and instructions, why you would like to host, the version of the Host Terms you agreed to, and the network address and browser used to apply. Approved drop-off spots appear on a map inside the app for signed-in members only; the public site shows no drop-off spots. A host's account never shows the host anything about the families who use the drop-off spot.

Email and notifications

We send email through Resend, which sees the address, subject and content of each email, and tells us if an address bounces or marks us as spam so we can stop sending to it. If you turn on push notifications, your browser gives us a subscription for that device; the messages we send through Apple's, Google's or Mozilla's push services are encrypted so that only your device can read them.

Information about children

Children never create accounts. A child uses YaaFlip through a kid profile under a parent's account. We collect from and about a child:

• A username and an avatar. The username is chosen by the child, screened before it is saved (G-rated; never a real last name) and shown with the avatar to every family a listing reaches. The avatar is a design recipe, not a photo.
• Listing videos, with the child's face and voice. A listing is a video of at most 60 seconds that the child records showing the toy, and a title. We coach children to use first names only and never to say or show a last name, a school, an address or a house number, and our screening and our reviewers look for exactly those things.
• Trading records. The child's listings, claims, purchases, sales, cancellations, disputes and reliability record; which listings the child has watched (so the feed shows what is new); listings the child bookmarked; friendships with other kids' profiles; avatar items the child bought.
• Yaa! Points. The child's ledger: every point earned, spent, held, released or moved.
• Location, twice per trade, briefly. When a child's family records a drop-off, we read the phone's position to confirm it is at the drop-off spot and keep it with the proof for 14 days and 2 hours; when a buyer reveals a pickup code or reports "It's not here", we keep that position for 2 hours. These are the only location fixes we store, and the app shows no map and no location to any child.
• Views and reports. How many families watched a listing (never which), and reports a child makes about a listing.

We do not collect from a child a real name, an age or date of birth, an address, a school, a phone number, an email address, contacts, photos other than the listing videos and the drop-off photo a parent helps take, or any persistent location. There is no chat, no comments, no direct messages and no public profile. We do not use a child's information for advertising, profiling or behavioral targeting, and we never sell it.

Who can see a child's video

A listing video is visible only inside YaaFlip, only to activated accounts — households anchored by an adult who completed the identity check — whose chosen drop-off spots lie within their browse distance (at most 50 miles, measured between public drop-off spots) of one of the listing's drop-off spots. Videos are streamed through signed, short-lived links and cannot be downloaded. The same video is seen by our safety screening and, when flagged or reported, by our reviewers; and, if a trade's dispute is put to a neighborhood panel, by the two or three jurors, each of whom is a verified parent who could already see the listing. A host never sees a video. The public, search engines and advertisers never do.

How we use information

• To run YaaFlip: accounts, profiles, listings, trades, points, notifications, support.
• To keep children safe: screening usernames, titles and videos; verifying every adult's identity and checking registries; locality checks on invites, friend codes and drop-off spots; the reliability record, strikes and the warning ladder; investigating reports and abuse.
• To meet our legal obligations, including COPPA, and to enforce our Terms.
• To send the notifications you choose and the ones we always send (safety and account notices, receipts).
• To understand how YaaFlip is used, in aggregate: counts, never a family's profile.

We do not use any information to train AI models. Where an AI vendor processes information for us, it does so on paid terms that forbid training on our data.

Who we share information with

We share information only with the companies that run parts of YaaFlip for us, each bound by a data-processing agreement, and only what each needs:

• Cloudflare hosts YaaFlip and stores and streams listing videos (Cloudflare Stream). It sees the videos, thumbnails and drop-off photos, and the request data of everyone who uses the app.
• Supabase runs our database and sign-in. It stores everything in this policy except what is held at Stripe, Didit and Cloudflare Stream, on servers in Canada.
• Google (Gemini, paid tier) screens usernames and titles, screens listing videos including their audio, and helps answer support notes. On the paid tier Google does not use this content to improve its models; it keeps prompts and responses for a limited period to detect abuse of its service.
• Stripe processes payments and holds the card.
• Didit performs the identity check (adults only; see Identity).
• Offenders.io performs the registry check (adults only; verified name and state).
• Resend delivers our email.
• Apple, Google and Mozilla push services relay encrypted push notifications to the devices that asked for them; they cannot read the messages.

Where information is kept. The database that holds your family's information is hosted in Canada (Montréal), by Supabase, and is subject to Canadian law while there. YaaFlip's application runs on Cloudflare's worldwide network, and listing videos are stored and streamed by Cloudflare Stream from that network. Our other vendors process information where they operate; the identity check is processed in the European Economic Area, as described above.

We will also share information when the law requires it, to respond to lawful requests, to protect a child's safety or the rights and safety of others, to enforce our Terms, or with a successor that takes over YaaFlip under this policy. We do not share information for advertising, and we do not sell it.

How long we keep things

These are the longest we keep each kind of information. We delete sooner whenever we no longer need something, and the clocks below run automatically.

• Listing videos and thumbnails: deleted when the toy sells (deletion begins when the trade completes), when a listing is taken down, or 30 days after a listing expires without selling — the 30 days let a family re-list without filming again. A listing is live for 30 days at a time.
• Drop-off photos: deleted 30 days after the trade closes.
• Location fixes: a drop-off proof's position, 14 days and 2 hours; a code reveal or a dispute position, 2 hours.
• Porch disclosures: deleted when the trade ends. The stored porch itself: until you switch your porch off or delete your account.
• Identity keep-set (name, document type and issuer, last four, hash, face capture, check outcomes): while your account exists, and for no more than 12 months after it closes, so that a closed account cannot be reopened under the same document.
• Trading and points records (listings' facts, trades, ledger entries, strikes, decisions): kept while the account exists and for no more than 7 years afterwards, as our financial and safety record; after an account is deleted, these records no longer carry a kid's username or avatar.
• Sign-in and session records: 180 days.
• Notifications and their delivery records: while the account exists.
• Support notes and replies: while the account exists and for no more than 2 years after.
• Host applications: approved ones for the life of the drop-off spot; declined and withdrawn ones for no more than 12 months.
• Email delivery records at Resend: 30 days at the vendor.
• Google's abuse-detection logs: a limited period set by Google.

When your account is deleted, everything above that is not listed as kept afterwards is deleted or made anonymous within 30 days, and backups age out within 30 days after that.

Your choices and rights

• Review. Everything we hold about your family that is shown in the app is yours to see there: profiles, listings, trades, points, settings, notices. Email hello@yaaflip.com for a copy of anything the app does not display.
• Delete a kid's profile from Household members: the child's username, avatar, listings, videos, bookmarks and friendships are removed; the child's points move to your family wallet.
• Delete your account from Payment & account: everything about your household is deleted as described above, and your Yaa! Points are forfeited. We refuse deletion while a trade is still under way.
• Withdraw consent for us to collect information from your children by deleting the kid profile or the account. You may refuse further collection at any time; we cannot run a kid profile without the information this policy describes, so refusal means removing the profile.
• Correct your email, password and settings in the app; ask us to correct anything else.
• Notifications have switches per category in Notification settings, and every optional email carries a one-click unsubscribe. Safety and account notices and receipts always send.
• Residents of California and other states with privacy laws may have additional rights to know, delete, correct and limit use of personal information, and to not be discriminated against for exercising them; we honor those requests at hello@yaaflip.com. We do not sell or share personal information for cross-context behavioral advertising.

We will verify that a request comes from the account's adult before acting on it.

Security

We protect information with measures appropriate to its sensitivity: every database table denies access by default and grants it row by row to the household that owns the data; videos and photos are served only through signed, short-lived links; face captures and drop-off photos sit in buckets no client can read; secrets live only in our hosting provider's secret store; vendor webhooks are signature-verified; sensitive account changes require a fresh password check; and our test suite re-proves these rules on every change. No system is perfectly secure; if a breach affects your family we will tell you as the law requires.

Children's privacy, in one place

The Parent Consent Disclosures restate, as COPPA's direct notice, what we collect from children, how we use and share it, how you consented, and how to review, delete and refuse. If you believe a child has used YaaFlip without a parent's consent, or that we hold information about a child we should not, email hello@yaaflip.com and we will act promptly.

Changes

When this policy changes in a way that matters, we email the account owner before the change takes effect and show the new version and date on the Legal page. Changes that would let us use a child's information in a materially new way are never made without a parent's consent.

Contact

Popcode Studio, LLC (Brenton Strine) · 2530 Hosea L. Williams Dr. NE, Atlanta, GA 30317 · 626-731-4682 · hello@yaaflip.com