Privacy policy
Last updated: 19 July 2026. This policy explains what personal data Yo-Tag collects, why we collect it, how we protect it, and the rights you have over it. If anything is unclear, email us at support@yo-tag.com.
1. Who we are
Yo-Tag is operated by YOTAG Limited (trading as Yo-Tag), a company registered in England and Wales (company number 16599146). For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), Yo-Tag Ltd is the data controller responsible for your personal data. You can contact us at support@yo-tag.com.
2. What we collect
We collect the minimum needed to run the service:
- Email address— when you sign up with email or Apple Sign-In. If you use Apple's "Hide My Email", we receive a private relay address rather than your personal email. We use your email to send you a one-time verification code and for essential account communication.
- Apple account identifier — if you sign in with Apple, we store the stable identifier Apple provides so we can recognise your account when you sign in again.
- Your display name — the name you choose to show to your contacts.
- Your Yo-Tag handle (tag) — your chosen handle.
- Emergency and reunite contacts — the contacts you explicitly add for lost-phone recovery. We store only their name and Yo-Tag handle — never phone numbers. If you set up lost-phone access, we also store your emergency PIN in a securely hashed form that we cannot read back.
- Your contacts (sharing your tag) — if you choose to share your Yo-Tag with people from your address book, we ask for contacts access so you can pick who to share with. Your address book stays on your device — we never upload it. The share message itself is sent from your own phone (by text, WhatsApp, or however you choose), not by us. We keep a record of who you shared with — their name and number as they appear in your contacts — for 90 days, then delete it automatically.
- Call metadata — records of who called whom and for how long, so you can see your own call history. We never record or store call audio.
- Location— used only when you actively use a location feature: for example, when you choose to share your location as the finder of a lost item or person, or when a finder shares theirs with you. Location shared this way is kept briefly (see "How long we keep your data") and then deleted. We never track your location continuously or in the background.
- Phone numbers — we never ask for your phone number, and phone numbers are not used to identify Yo-Tag accounts. Beyond the share records described above, the only other case is a finder using our website — who may not have a Yo-Tag account — choosing to leave their number so an owner can reach them: it is shown to the owner only if the owner responds, removed if the owner dismisses the request, and deleted automatically in any case.
- Usage and diagnostic data — we use Firebase Analytics and error-monitoring tools to understand how the app is used and to fix crashes. This includes basic device and interaction data.
3. How we use your data and our legal basis
Under UK GDPR, we rely on the following legal bases:
- To provide the service (contract): creating and securing your account, verifying your email, connecting your calls, showing your call history, and delivering features you use.
- Legitimate interests: keeping the service safe (content moderation, abuse prevention, fraud prevention), and improving the app through analytics.
- Legal obligation: retaining limited records where the law requires it.
- Consent: where we ask for it (for example, optional features). You can withdraw consent at any time.
4. Calls and messages
Calls on Yo-Tag are real-time and routed through our voice infrastructure. Call audio is never stored or recorded. We keep only call metadata (who called whom and duration) so you can see your own history.
5. Lost-phone access (emergency contacts)
If you set up lost-phone access, you choose up to three emergency contacts and a PIN. We store your contacts as names and Yo-Tag handles only, and your PIN in a securely hashed form that we cannot read back — the same way passwords are protected.
If you lose your phone, you can open the Yo-Tag app on any other phone, enter your own tag and PIN, and see your emergency contacts so you can call them through Yo-Tag. Because anyone entering the right tag and PIN would see the same thing, choose a PIN that only you know. To protect against guessing, three wrong attempts locks access to that tag for 15 minutes.
Every time your emergency contacts are viewed this way, we record it (including the internet address it came from) in a security log kept for 12 months, and send you an alert in the app so you always know it happened.
6. Who we share your data with
We do not sell your personal data. We share data only with the service providers ("processors") that help us run Yo-Tag, and only as far as needed:
- Google Firebase — authentication, database, and analytics
- Apple — Sign in with Apple, in-app purchases, push notifications (APNs), and Apple Maps (used only when you use location features)
- Resend — sending your email verification codes and essential emails
- Zoho Mail — hosts our contact/support email, so it processes any email you send us
- LiveKit — real-time call routing (audio is not stored)
- Hetzner — hosts our self-managed call-routing servers in Germany (audio passes through in real time and is never stored)
- Sentry — error and crash monitoring
- Cloudflare Turnstile — bot/abuse protection on our web forms (sees your IP address)
- Railway — hosting our backend servers
- Vercel — hosting our website and admin tools
These providers process data on our behalf under contract. Some may process data outside the UK; where they do, we rely on appropriate safeguards (such as UK-approved data transfer mechanisms).
6a. Access by our team
Authorised YOTAG Limited staff may access personal data where needed to provide support, investigate reports, keep the service safe, or comply with the law. Such access is limited and logged in an internal audit record.
7. How long we keep your data
We keep your core account data (your profile, tag, connections, and call history) for as long as your account is active.
Operational data is deleted automatically on a schedule, whether or not you delete your account:
| Data | Kept for |
|---|---|
| Email verification codes (the one-time codes we email you when signing in) | 24 hours |
| Temporary tags (short-lived tags you create to share) | 8 days |
| Lost-item "ping" notifications (a finder telling you your tag was found, including any location they chose to share) | 30 days |
| Technical diagnostics and call-quality logs (information about how calls performed, used to find and fix problems) | 30 days |
| Connection requests, call records, tag-share records, and reunite requests (who asked to connect with whom, when calls happened, who you shared your tag with, and lost-item alerts) | 90 days |
| Emergency-contact alerts (the in-app notices telling you someone viewed your emergency contacts) | 90 days |
| Emergency access security log (our record of lost-phone contact lookups — who looked up whose contacts and from what internet address — kept longer so we can investigate misuse) | 12 months |
Automatic deletion happens within approximately 72 hours of the end of each period.
When you delete your account, we delete your personal data immediately from our live systems — your tag is permanently retired and can never be claimed by anyone else. Residual copies in backups and logs are cleared within 30 days. We may retain minimal records for longer only where the law requires it.
8. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Delete your account and personal data — available any time from Settings → Delete account in the app, which removes your data immediately
- Export your data — available from Settings → Download my data, or by emailing support@yo-tag.com
- Correct inaccurate data
- Object to or restrict certain processing
- Withdraw consent where we rely on it
To exercise any right, use the in-app options or email support@yo-tag.com. If you're unhappy with how we handle your data, you have the right to complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk.
9. Children
Yo-Tag requires users to be at least 13 years old. When you first set up the app, we ask for your date of birth to check this. Your full date of birth never leaves your phone — it is used on your device to confirm your age and is never sent to or stored on our servers. Anyone under 13 cannot create an account.
Yo-Tag is designed to be used within families, and we encourage users under 18 to use it with the knowledge of a parent or guardian. We do not knowingly collect more data from anyone under 18 than is needed to provide the service. If you believe a child under 13 has created an account, contact support@yo-tag.com and we will delete it.
10. Security
We protect your data with encryption in transit and at rest, access controls, and regular security review. No system is perfectly secure, but we take reasonable steps to protect your information.
11. Changes to this policy
We may update this policy from time to time. When we make material changes, we'll update the "Last updated" date and, where appropriate, notify you in the app.
12. Contact
For any privacy question, request, or concern, email support@yo-tag.com.