Your privacy on Haylio

What we collect

Account

You sign in with Google. Google tells us your email address and a Google account ID, and we keep them with your Haylio account so you can sign in again on another phone. Other people never see your email or your Google account. We don't ask for a phone number or any government ID.

Profile

You choose a display name, a unique username, an avatar, an answer to one prompt, and optionally a bio, interests and a mood that lasts 24 hours. Your profile card shows these to other people. Your gender is stored privately and is shown on your card only if you turn on “Show my gender”. Bios and notes may not contain phone numbers, links or social media handles; the server rejects them.

Tonight's people and username search

“Show me in Tonight's people” lets other users be dealt your card and reply to your prompt. “Findable by username” lets anyone who types your exact username find you. You can turn either off in Settings. We record which cards are dealt to whom so that limits work and the same people aren't shown twice; this is cleared after 8 days. Anyone can see how many people viewed their card today; Haylio Premium members can also see who.

Messages

Private messages are stored so they can be delivered, then deleted automatically 24 hours after they are sent. Messages in chat rooms can be read by anyone in that room and are deleted after 7 days. Before a message is stored, Haylio hides anything that looks like a phone number, a bank account or IFSC code, or a card number, replacing it with “Hidden for privacy reasons”. The original digits are not stored.

Photos

You can send photos only to people you are connected with. Before a photo leaves your phone, the app shrinks it and saves it as a new image, which removes hidden details such as location (GPS), camera model and the time it was taken. Photos are kept in private storage that only you and the person you sent it to can open, and are deleted automatically about 24 hours after they are sent.

Connections and requests

When you and another person connect, we store that link until either of you removes it or deletes their account. Pending requests expire after 24 hours.

Location, if you turn on Nearby

• Nearby is off until you switch it on, and it is the only part of Haylio that uses location.
• While the Nearby tab is open, your phone sends its position. Our server immediately rounds it to an area roughly 550 metres across and stores only that. The exact position is not kept.
• Other people see only a distance band — under 1 km, 1–3 km, 3–10 km or 10–25 km — never a position.
• Your stored area is deleted 24 hours after your last update, or straight away when you hide from Nearby.
• Haylio never collects location in the background.

Notifications and presence

If you allow notifications, Google Firebase Cloud Messaging gives the app a device token, which we store so we can tell you about messages and requests while the app is closed. The app also tells our server when you're online, so your connections can see “online” or when you were last seen. This is a timestamp, not a location.

Reports, blocks and moderation

If someone reports a private chat, the recent messages of that chat (and photos the reported person sent in it) are copied into the report so it can be reviewed, and are kept beyond the usual limit until the report is resolved. Reported room messages are kept the same way. Someone reported by several people in a room within a day is muted there for 24 hours. If you block someone, we store that pair so you never see each other again.

Haylio Premium

Google Play handles payment — we never see your card, name or billing address. Google gives us a purchase token, which we store with your plan and its renewal and expiry dates, and check with Google when it renews, is cancelled or is refunded. Premium settings (card colour, badge, filters) are stored with your account.

Technical data

Standard server logs (IP address, request time) are kept by our hosting provider for security and debugging for a limited period. Haylio contains no advertising SDKs and no third-party analytics.

What we don't do

We don't sell data. We don't show ads. We don't build advertising profiles. We don't read your messages unless they are attached to a report. We never see or store your payment details.

Where data lives

Our database and file storage are hosted by Supabase in the Mumbai (ap-south-1) region. Notifications are delivered through Google Firebase Cloud Messaging, and payments are handled by Google Play.

Age

Haylio is for adults. You must be 18 or older to use it. If we believe an account belongs to someone under 18, we delete it.

Your choices

• Delete your account in Settings › Account, or without the app — see haylio.io/delete. Everything attached to your account is deleted immediately.
• Hide from Nearby, Tonight's people or username search in Settings at any time.
• Keep your gender private — it's hidden unless you choose to show it.
• Sign out from Settings. Uninstalling the app does not delete your account.

Contact and changes

Questions: erexstudio9@gmail.com. If this policy changes materially, we will show a notice in the app.