Privacy Policy

This policy explains what information the Layali mobile app collects, why, who else sees it, and what you can do about it. It covers the app on iOS and Android and this website.

1. Who we are

Layali ("Layali", "we", "us") operates the Layali app and this site. For privacy questions, and to exercise any of the rights described below, write to privacy@layali.app.

2. What we collect

Information you give us

• Profile details. Your nickname, profile photo, short bio, gender and date of birth, where you choose to provide them. Only your nickname and photo are required to appear in rooms.
• Content you send. Private messages, public room chat, gifts you send, and your live audio and video while you are broadcasting or on mic.
• Reports and support requests. What you write when you report another user or contact support, including your user ID.

Information created when you use the app

• A device identifier. On first launch the app generates a random identifier and stores it on your device. It is not derived from your hardware, advertising ID, or any platform identifier, and it does not follow you to other apps. It is how we recognise your device between sessions. Clearing the app's data or reinstalling generates a new one — see section 8 for why that matters.
• Account and activity data. Your user ID, level, coin and diamond balances, who you follow, rooms you have entered, and login timestamps.
• Technical data. App version, chosen language, device model and operating system version, and IP address, sent with requests so the service can respond correctly and so we can investigate abuse and faults.

What we do not collect

• Payment card numbers or billing addresses. Apple and Google handle payment.
• Your contacts, calendar, photo library (beyond a photo you pick), or precise location.
• Advertising identifiers. There is no advertising or cross-app tracking in Layali.

3. Device permissions

Layali asks for exactly two permissions, and only at the moment a feature needs one:

• Microphone — so you can speak on mic in a party room or host a stream. Decline it and you can still listen.
• Camera — so you can appear on video from your seat or broadcast video. Decline it and your seat stays audio-only.

Turning a permission off disables only the feature that uses it. You can review and change both in Settings → Permissions, or in your device settings.

4. How we use it

• To run the service: sign you in, show live streams and rooms, deliver your messages, and keep your balances correct.
• To keep the service safe: filter public chat, act on reports, and detect fraud, abuse and attempts to manipulate the gift economy.
• To process purchases: confirm with Apple or Google that a top-up succeeded, then credit your diamonds.
• To support you: answer your requests and investigate faults you report.
• To meet legal obligations, and to respond to lawful requests from authorities.

Where the law requires a legal basis (for example the GDPR), we rely on performance of our contract with you for running the service, our legitimate interests in safety and fraud prevention, your consent for device permissions, and legal obligation where one applies.

5. Who we share it with

We do not sell personal information and we do not share it for advertising. We do use service providers to run parts of the app, and they receive only what their function needs:

• Real-time audio and video. Live streams and party-room voice are carried by Agora. It processes your audio and video stream and a room identifier while you are in a room.
• Messaging. Private conversations and public room chat are delivered by NetEase Yunxin, which stores your message history so your conversations are still there when you change devices.
• Image storage. Profile photos and images you send are stored on Alibaba Cloud OSS and served from its CDN.
• Payments. Apple and Google process every purchase under their own privacy policies. We receive a receipt to verify, never your payment details.

We may also disclose information where we are legally required to, or where it is necessary to protect someone's safety, and we may transfer it as part of a merger or acquisition — in which case this policy continues to apply until you are told otherwise.

Remember that other users see what you post: your nickname, photo, level, whether you are online, and anything you say in a room or on stream.

6. How long we keep it

• Account and profile data — while your account exists.
• Messages — retained by our messaging provider so your history survives a device change, until you delete your account.
• Transaction records — kept as long as tax and accounting law requires, even after account deletion.
• Moderation records — reports and enforcement decisions are kept long enough to handle repeat behaviour and appeals.
• Live audio and video — not recorded by us. It exists only while it is being transmitted.

7. Your rights and choices

Depending on where you live, you may have the right to:

• access a copy of the personal information we hold about you;
• correct it — most of it you can edit yourself in Me → Edit profile;
• delete it, by deleting your account (section 8);
• object to or restrict certain processing;
• withdraw a permission you granted, in your device settings;
• complain to your local data protection authority.

To make a request, email privacy@layali.app from the address on your account or include your user ID, so we can be sure the request is yours. We answer within 30 days.

8. Deleting your account

In the app: Settings → Account actions → Delete account. You will be asked to confirm, because the effect is permanent:

• your profile, balances and relationships stop being reachable;
• your coin and diamond balances are forfeited and cannot be refunded or transferred;
• signing in again creates a brand-new account — the old one does not come back.

Because sign-in is tied to your device, clearing the app's data or reinstalling has the same practical effect: the app generates a new device identifier and the previous account, with its balance, is no longer reachable. There is no password or email recovery path. If you want to keep an account, do not clear the app's data.

Content you already sent to other people (messages they received, gifts you sent) may remain visible to them. We keep transaction and moderation records as described in section 6.

9. Security

Traffic between the app and our servers is encrypted, and request payloads carry a second layer of application-level encryption. Session credentials are held in the platform's protected credential store — the iOS Keychain, and on Android encrypted storage backed by the system keystore. Access to production systems is limited to staff who need it.

No system is perfectly secure. If we discover a breach affecting your information, we will notify you and the relevant authorities as the law requires.

10. Children

Layali is for adults aged 18 and over. We do not knowingly collect information from children. If you believe a child is using Layali, email privacy@layali.app and we will remove the account and its data.

11. International transfers

Layali is available in several countries, and our providers operate globally, so your information may be processed outside the country where you live. Where we transfer personal data out of a region that restricts it, we rely on the transfer mechanisms that region's law provides, such as the European Commission's standard contractual clauses.

12. Changes to this policy

If we change this policy we update the date at the top. For changes that meaningfully affect your rights, we will tell you in the app before they take effect. Continuing to use Layali after a change means you accept the updated policy.

13. Contact us

Privacy: privacy@layali.app
Anything else: support@layali.app, or the Support page.