Privacy Policy

1. Who we are

YumeBee is a private, end-to-end encrypted messaging app for iOS and Android, operated by YuMe Network Private Limited ("YumeBee," "we," "us," or "our"). We are the data controller (in India, the "data fiduciary") for the personal data described here.

This policy covers the YumeBee mobile app and the backend services it talks to. It does not cover anything you do in other apps, including the messaging service used to deliver your one-time sign-in code.

2. The short version

3. Information we collect

a. Information you give us

• Phone number. Required. It is your account identifier, and we verify it with a one-time code sent by SMS. We store the number; we store the code only as a keyed hash, for a few minutes.
• Profile. First and last name, the display name assembled from them, a unique username, and your date of birth (collected once at signup, to check the minimum-age requirement and to decide whether you see age-restricted sticker packs, and not editable afterward).
• Avatar. Every account has one. By default it is one of our built-in avatars, chosen at random at signup — we store only which one. If you upload a photo instead, that image is stored in our object storage and served to your friends. Either way, an avatar is public to people who can find you and, unlike message media, is not end-to-end encrypted.
• Recovery email (optional). If you choose to bind one, we store the address and whether it's verified. It is used only to help you regain access if you lose your phone number — never to log in, never for marketing.
• Social graph. Friend requests and friendships, blocks, group memberships and pending group invitations, group names, and whether a group is a gossip group (see §4).
• Watch cards. When you send a watch card, we store the whole card: the title and poster from the third-party catalog, the season and episodes you marked watched, any star rating, and any note you typed. This is not encrypted and we can read it. See §4 and §8.
• Reports. If you report a user or a message, whatever you send us as part of that report — including, sent by your phone from the copy it already holds, the text of the message you reported, or the last 10 text messages of that one-to-one chat (from both of you) when you report a person. The app shows you exactly what will be sent before you send it. Photos, videos, winks, voice messages, stickers and memes are never included, and reporting someone in a group attaches no messages at all. This is you choosing to show us something you received; it does not change what we can see of any chat nobody reports — which is nothing.
• Contacts. Only if you grant contacts access. The app reads phone numbers only — no names, photos, emails, addresses, birthdays or notes ever leave your phone — and sends those numbers to our server, which checks them against our users and tells the app two things: which of those numbers have a YumeBee account (and, for those, that person's display name, username and profile photo, so you can add them), and which ones you can invite. If you allow contacts access, we keep your contacts' phone numbers as keyed hashes (never the numbers themselves) to suggest people you may know, until you delete your account. Tapping Add sends an ordinary friend request. Tapping Invite opens your own messaging app with a short invite and a download link already typed; you send it yourself, from your own number, and we are not involved — we don't learn that you invited anyone, who, or whether you sent it. Older versions of the app sent the invite from our server instead: on those versions, tapping Invite sends that number a single SMS through our SMS provider (Fast2SMS), showing your YumeBee display name and phone number with a download link, and we keep that number with your account id and the time so we can enforce one invite per person per 10 days. That is deleted when you delete your account, and goes away entirely once those versions are retired.

b. Information collected automatically

• Device record. Platform (iOS or Android), app version, your push notification token, an internal device and connection identifier, and when the device was bound and last seen. One device per account — signing in elsewhere replaces this record.
• IP address. Seen on every request, as it must be for anything on the internet to work. We use it transiently to rate-limit one-time codes and to spot abuse, and it appears in short-lived server access logs. We don't look it up to work out where you are.
• Routing metadata. Delivering a message requires knowing who is sending to whom, when, roughly how large it is, and what type it is (text, photo, video, sticker, meme, emoji) so a push notification can be labeled — and, for an attachment, its file format (for example that a meme is an animated GIF, WebP, or PNG, or a still picture). This is inherent to running a messaging service and is not something encryption can hide.
• Delivery state. Delivered and read markers per conversation, typing indicators, online/offline presence, and unread counts. These are not end-to-end encrypted.
• Diagnostics and usage analytics. Our own self-hosted analytics records app events — which screen you opened, taps on major actions, connection and encryption-setup successes and failures, and API call outcomes — along with your user ID, a session ID, platform, OS version, and app version, and, on API call and connection events, whether your phone was on Wi-Fi or mobile data (the type of connection only — never which network, carrier, or location). No message content is ever included.
• Crash reports. When the app hits an unhandled error we send the exception type, a truncated error message, and the top stack frames through that same pipeline. These are code locations, not your data.
• Operational logs and metrics. Standard server logs and aggregate counters (request rates, error rates, delivery latency) used to keep the service running.
• How you found us. When a download link we published is opened — yumebee.app/get, sometimes with a tag on it like ?id=poster — our own server adds one to a count for that link, so we can tell which of our links people actually use. It is a tally and nothing else: no cookie is set, nothing is stored on your device, no advertising or analytics service is involved, and the count records nothing about you — not your IP address, not your device, and nothing that could be traced back to you or to a YumeBee account.

c. Message content

Message text, photos, and videos pass through our servers only as ciphertext we hold briefly for delivery. Encrypted media sits in object storage until the recipient fetches it, and is deleted on the same 24-hour schedule (or immediately, if you delete the message). We hold no key that would open any of it.

4. What we cannot see — and what we can

YumeBee uses the Signal protocol for end-to-end encryption, in both 1:1 chats and groups. Being precise about the boundary matters more than sounding reassuring, so:

We cannot read:

• Message text and emoji.
• Which emoji you reacted with, and which message you reacted to. A reaction is encrypted exactly like a message.
• Photo and video content, and custom stickers you make from your own photos — all encrypted on your device before upload.
• Your memes. Your meme library lives only on your phone — it is never uploaded or synced, and it's kept out of iCloud backups — and a meme leaves your phone only as an encrypted upload each time you send it. Pictures you add are re-saved without their camera details (such as where a photo was taken) before they're kept or sent.
• The keys that unlock media, which travel only inside the encrypted message.

We can see (protected in transit by TLS, but readable by our servers):

• Everything in §3(a) and §3(b) — your account details, your friend and group lists, routing metadata, and delivery state.
• Watch cards, including any note you type on one. A watch card note is the only text you type in YumeBee that our servers can read. If it's sensitive, send it as a message instead.
• Which built-in sticker you sent (the sticker images themselves are public assets anyone can see in the app).
• Whether your app can show memes. From the app version in your device record, our servers tell your friends' and group members' apps whether yours can show a meme — a yes or no, never the version itself. If it can't yet, their app sends you the same meme as an ordinary photo. This tells us nothing about which meme anyone sent.
• In a group, which members you @mentioned — sent to us in plain form solely so we can send those members a "you were tagged" notification. The message text itself, including the name you typed, stays encrypted.
• When you react to a message: whose message it was, and what kind of message it was (a photo, a whisper, a sticker…). Both are sent in plain form solely so we can send that one person a "reacted to your photo" notification — nobody else in the chat is notified. (You can't react to your own messages, so this never describes you reacting to yourself.) The kind is something we had already seen when that message was sent. The emoji you picked, and which specific message you put it on, stay encrypted.
• Group system messages (joins, leaves, invitations, renames) and the non-content activity signals we compute from message counts and timing — the most-active-member marker, the quiet-member note, and the group "aliveness" score. In a gossip group we deliberately publish less: we don't send the most-active-member marker or the derived group photo to anyone, and we never post the quiet-member note, because all three would point at who has been talking.
• Gossip groups — what we still see. A gossip group hides who sent each message inside the app, from the other people in the chat. It does not hide it from us, and we want to be plain about that rather than let the feature's name imply otherwise. Every message still carries, in plain form, which chat it belongs to and which account sent it — the same routing metadata every message in YumeBee carries, and what lets us deliver it at all. We cannot read what any of them say, in a gossip group or anywhere else. What changes in a gossip group is what we send out: the sender's name and account are left out of the notification other members receive, and the activity signals above are withheld. Hiding the sender in the chat is something each person's app does when it draws the message, which is also why everyone in a gossip group needs a recent version of YumeBee.
• Wink streaks. When you send a wink we already see that a wink was sent, in which chat, by whom — the same routing metadata every message carries, and what lets us send a "sent you a wink" notification. For streaks we keep a running count from it: how many days in a row everyone in that chat has winked, your longest-ever count, when the current day started and ends, and — if everyone completed a day early — when that happened, until the day is added to the count. We do not keep a record of individual winks, and we never learn whether a wink was opened — that happens only on your phone, which is exactly why a streak counts sending rather than opening.

Because your keys never leave your devices, we cannot recover your messages if you lose your phone, reinstall, or switch devices — for you, for law enforcement, or for ourselves.

Phone backups. YumeBee keeps its store on your phone — your last 24 hours of messages and your encryption keys — out of iCloud and computer backups on iPhone, and Android backups are switched off for the app entirely, so a backup of your phone doesn't carry your chats or your keys. Restoring a backup onto a phone gives you a fresh install of YumeBee: you sign in again, and nothing from before comes back. An iPhone backup made with a version of YumeBee from before this protection existed can still hold a copy until your phone's next backup replaces it.

5. What we never collect

• Names, photos, emails or addresses from your address book. We never collect them. If you use "From contacts" the app reads phone numbers only — see §3. Invites from the current app go out from your own messaging app and never reach us; only an invite sent from an older version of the app is kept (the invited number, so we can hold you to one invite per person per 10 days). See §3.
• Your precise location, or a location history. No GPS and no location permission. The only location we hold is the rough, city-level one Cloudflare estimates for your connection, used for friend suggestions (§3), and each new one replaces the last.
• Advertising identifiers. No IDFA, no Android Advertising ID, no advertising or attribution SDKs of any kind.
• Biometrics. If you lock the app with Face ID, Touch ID, or a fingerprint, that check happens entirely on your device — nothing about it reaches us.
• Unsent drafts. Text you type but don't send is saved on your phone so you can leave a chat and come back to it. It is never uploaded, never synced between devices, and is deleted after 24 hours like everything else.
• A log of who winked when. Wink streaks are stored as a count, the current day's start and end time, and (only while an early-completed day is waiting to be added) when it was completed, per chat — not as a history of individual winks, and never as a record of who in a group has or hasn't winked yet. The app never tells anyone who missed a day, and neither do we.
• Payment information. YumeBee is currently free and has no in-app purchases.
• Third-party trackers. Our analytics are self-hosted on our own infrastructure. There is no Google Analytics, Firebase Analytics, Crashlytics, Meta SDK, or similar in the app.

6. How we use information

• To run the service: verify your phone number, create and secure your account, bind your device, route messages to the right recipients, deliver push notifications, and show presence and receipts.
• To let you find and be found by friends: phone number and username lookup, friend requests, groups.
• To suggest people you might add: "Suggested for you" shows up to six people on YumeBee whose rough location (§3) is nearest yours, and you can appear in theirs. Only a display name, username and profile photo are shown — never anyone's location, and never how far away they are — though a list ordered by nearness does tell you the people in it are roughly nearby, and tells them the same about you. People you're already friends with, have a pending friend request with, or have reported (or who have reported you) are left out, as is anyone who hasn't opened the app in 30 days. No more than 25 different people are suggested to you in a day; to keep to that, we remember which accounts we've shown you for 24 hours (§8). There is currently no setting to opt out of appearing in suggestions.
• For the catalog and watch cards: your search terms are proxied to the third-party movie/TV catalog through our backend, so the catalog provider sees our server rather than you.
• For wink streaks: counting the consecutive days everyone in a chat has winked, and sending you at most two reminders on a day when your streak is running out and you haven't winked yet. Streak reminders are never sent to someone who has already winked, and we never send a notification when a streak ends.
• To decide what is age-appropriate: some built-in sticker packs are marked 18+, and your date of birth decides whether they appear in your sticker tray at all. The filtering happens on our servers, so a pack you are too young for is never sent to your phone. We do not otherwise profile you by age.
• To keep the service safe: rate limits, abuse and spam detection, and acting on user reports.
• To fix and improve the app: diagnosing crashes, finding broken flows, and understanding which features are used — from event and error data, never from message content.
• To help you recover access: if you bound a recovery email, sending a code to it when you ask to recover.
• To comply with law: responding to valid legal process, within the hard limits of what we actually hold (§9).

We do not use your data for advertising, profiling for marketing, or automated decisions with legal effects. We do not send marketing email.

7. Legal bases for processing

Where the GDPR, the UK GDPR, or India's Digital Personal Data Protection Act applies, we rely on:

• Performance of a contract — everything needed to give you the service you signed up for (§6, first three bullets).
• Consent — the optional pieces: binding a recovery email, uploading a profile photo, granting camera or photo access, enabling notifications. You can withdraw consent by removing the data or revoking the permission.
• Legitimate interests — security, abuse prevention, and keeping the app working (rate limits, logs, crash reports, aggregate usage analytics), balanced against the fact that we deliberately hold as little as possible.
• Legal obligation — where a law or valid order requires us to retain or produce something.

8. How long we keep it

We may keep a specific item longer where a law or a live legal claim requires it, and only for as long as that requirement lasts.

9. Who we share information with

We share the minimum necessary, with these categories only:

That is the complete list of categories. We do not share your data with advertisers, data brokers, or analytics companies, because we do not work with any.

10. Device permissions we ask for

Each of these is optional, requested only in the moment you use the feature, and revocable in your device settings at any time.

• Camera — to take a photo or video to send. Captured media is encrypted on your device.
• Microphone — to record a whisper (a voice message, up to one minute, held down in the message box) and the audio of a video you shoot. Both are end-to-end encrypted like any other message. YumeBee has no voice or video calling.
• Photo library — to pick an existing photo or video to send, or to set your avatar. We access only what you pick.
• Notifications — to alert you that a message arrived. Notifications never contain message content.

We ask for nothing else — no location, no calendar, no microphone access outside of voice messages and video capture, and no background tracking. Contacts access is optional and is used as described in §3.

11. How we protect information

• End-to-end encryption (Signal protocol) for message and media content, with forward secrecy — each message uses a fresh key that is destroyed after use.
• TLS on every connection between the app and our servers, including the real-time message channel.
• Encryption at rest for stored data, and media that is already ciphertext before it reaches our storage.
• No plaintext secrets: one-time codes and refresh tokens are stored only as hashes. Private keys exist solely on your device and are never transmitted.
• Single-device binding: signing in on a new device revokes the old device's keys and connection immediately.
• Key-change warnings and safety numbers, so you can verify independently that you're talking to the person you think you are.
• Least privilege internally — access to production systems is restricted, and message content is beyond even our own reach by design.

12. Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal data we hold about you, and get a summary of it.
• Correct inaccurate data — most of it (name, username, avatar, recovery email) is editable directly in the app. Date of birth is set once at signup; contact us if it's wrong.
• Delete your account and data — available in the app, immediately (§13).
• Withdraw consent for optional processing, by unbinding your recovery email, replacing an uploaded profile photo with one of our built-in avatars, or revoking a device permission.
• Object to or restrict processing based on legitimate interests.
• Portability of data you gave us, where applicable. Note that message content is not exportable by anyone, including us — it is encrypted and short-lived by design.
• Complain to your local data protection authority, or in India to the Data Protection Board.
• Nominate another person to exercise your rights in the event of your death or incapacity, where Indian law provides this.

Write to legal@yumebee.com to exercise any of these. We'll verify the request against your account — usually via your registered phone number — and respond within 30 days. There is no charge.

13. Deleting your account

You can delete your account from within the app at any time — no email, no waiting period. Step-by-step instructions live at yumebee.app/delete-account. Deletion is irreversible, and it:

• Deletes your account record, profile, date of birth, and recovery email.
• Deletes your device record, public keys, and all session and refresh tokens.
• Deletes your avatar and any encrypted media still waiting in the ephemeral mailbox.
• Removes your friendships and notifies your friends that you're gone.
• Removes you from every group you're in, leaving a system note for the other members.

Three honest caveats. First, messages you already sent live on the recipients' devices until they expire on their normal 24-hour schedule — we cannot reach into someone else's phone. Second, before you confirm, the app asks why you're leaving; the reason you pick and any note you add are kept against your old account id, with nothing else about you (§8). Third, watch-card send records (§8) are retained as internal records, and are de-identified rather than erased where we must keep them; ask us at legal@yumebee.com if you want that confirmed for your account. Backups and logs age out on the schedules in §8.

14. Children

YumeBee is not for children under 13, and we do not knowingly collect data from them. We ask for date of birth at signup to enforce this. If you believe a child under 13 has created an account, write to legal@yumebee.com and we will delete it. Where local law sets a higher minimum age for consent to data processing, that higher age applies. Our standards against child sexual abuse and exploitation, how to report it from inside the app, and our designated contact are published at yumebee.app/child-safety.

15. Where data is stored and transferred

Our servers and databases are operated by us on infrastructure we control. Because messaging is global, your data may be processed in countries other than your own, including by the notification and messaging providers listed in §9. Where such a transfer involves personal data protected by the GDPR, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. Regardless of where a server sits, message content remains encrypted end-to-end and unreadable in transit and at rest.

16. Changes to this policy

We may update this policy as the app changes. The "last updated" date at the top always reflects the current version. If a change is material — for example, collecting a new category of data or sharing with a new kind of recipient — we'll notify you in the app or by another reasonable means before it takes effect. Continued use after that means you accept the updated policy.

17. Contact and grievances

Privacy questions, data requests, and complaints: legal@yumebee.com. This address also reaches our Grievance Officer for the purposes of India's Digital Personal Data Protection Act and the Information Technology (Intermediary Guidelines) Rules. We acknowledge grievances promptly and aim to resolve them within the timelines those rules require.

Postal address: YuMe Network Private Limited, India. Write to the address above and we'll provide the registered office details for formal service.