Privacy Policy

1.Who is responsible for your data

The data controller is LARGEIS LABS LLP, a company registered in Республика Казахстан.

For anything about your data, write to privacy@syilyq.app. General support is support@syilyq.app.

2.Account data

Signing up to Syilyq is only possible with a phone number. There is no password: you enter your number, receive a one-time code, and confirm it.

We store the following account details:

• Your phone number and whether it has been verified — required.
• First name, last name, date of birth and gender — collected at sign-up.
• Username, avatar, bio and links — optional.
• Email address — optional.
• Account type (personal or business); for business accounts, the company name and subscription tier.
• Privacy settings: profile visibility and who may mention you.

3.Content you create

Wishlists, wishes, showcases, products, posts, comments, replies, polls and votes, reactions, stories, bookmarks and saved entries are stored on our servers until you delete them.

The same applies to your social connections: follows, mutual friendships, requests, blocks and content reports.

Images and video are uploaded to Amazon S3 and delivered through Amazon CloudFront using signed URLs with a limited lifetime.

4.Contacts from your phone book

If you invite friends from your contacts, the app asks for phone book access. You can decline — invitations also work by link or by username.

When you send an invitation we store the invitee's phone number, the contact name from your phone book, your id as the inviter, an invitation token and its expiry. This is data about someone who does not use Syilyq yet, so:

• We use it only to connect the invitation to a future sign-up.
• We do not send marketing to it and do not pass it to third parties.
• If the invited person signs up, the invitation becomes a friend request they are free to decline.
• Anyone whose number was uploaded can request deletion by writing to privacy@syilyq.app.

5.Device, notifications and technical data

To deliver push notifications we store a device token, the platform (iOS or Android) and when the device was last seen. The token is issued by Expo Push and cannot be used to read anything on your device.

Our servers keep technical logs: IP address, device type, app version and request time. These exist for security, diagnostics and abuse prevention.

6.App permissions

The app asks for a permission at the moment it is actually needed. Declining limits that feature and nothing else.

• Contacts — to invite friends from your phone book.
• Photos and media library — to attach images to posts, wishes and your profile.
• Microphone — to record audio in video you attach.
• Notifications — to tell you about requests, comments, saves and shared gifts.

7.Processing through OpenAI

Three features use OpenAI services, and each sends a limited set of data:

• Link parsing: the product URL and the description extracted from the page are sent to work out the title, price, currency and image. The result is cached so the same link is not sent twice.
• Emoji generation: the title and description of a wishlist.
• Moderation: text and images you publish are checked automatically. Material scored as a clear violation is hidden without human involvement; borderline cases go to manual review.

8.Moderation and reports

Published content is checked automatically. Entries flagged as borderline are routed to an internal moderation channel that only authorised staff can access.

You can report a post, comment, user, wishlist, wish, showcase or product. We keep the fact of the report, its reason and the outcome of the review.

Content hidden by moderation is marked as hidden rather than deleted immediately — this is needed to handle appeals and to meet legal obligations.

9.Who we share data with

We do not sell your data. We use processors who handle data on our instructions:

• Meta (WhatsApp Cloud API) — delivering the one-time sign-in code. Your phone number and the code are sent.
• Amazon Web Services — storing and delivering uploaded images and video.
• Expo — delivering push notifications to devices.
• OpenAI — link parsing, emoji generation and content moderation.
• PostHog — product analytics: which screens are opened and which actions are taken.
• Sentry — collecting app and server errors and crashes.
• Telegram — the internal channel that receives material flagged by moderation.

10.Analytics on this website

syilyq.app sends anonymous events to PostHog: a page open and a click on an install button. Requests go through our own domain rather than directly to the analytics service.

The visitor id is generated fresh for each tab and is not kept between visits. There are no advertising trackers on the site.

11.How long we keep data

Account content is kept for as long as the account exists. Individual entries are removed when you delete them.

Stories stop being shown 24 hours after publication and are then removed by a scheduled job.

Contact invitations are valid for a limited time and then expire.

Link parsing results are cached so the same page is not fetched repeatedly.

12.Your rights

You can get a copy of your data, correct it, restrict processing, or ask for deletion. Most of this is available in the app itself: your profile and privacy settings can be changed at any time.

For anything else, write to privacy@syilyq.app. We respond within the time frame set by applicable law.

13.Deleting your account

You can delete your account from the app settings. After deletion your profile stops being visible to other users.

Note one important consequence: you will not be able to sign up again with the same phone number. This is deliberate, so that a new owner of a recycled number cannot inherit the previous owner's social connections.

If you need a full erasure rather than account deletion, write to privacy@syilyq.app.

14.Children

Syilyq is not intended for anyone under 13. If you believe a child has signed up, tell us and we will remove the account.

15.International transfers

The processors listed above are located outside Kazakhstan, so your data may be processed in other countries. We choose providers offering a comparable level of protection and send them only the minimum necessary.

16.Security

Connections to our servers are encrypted. Uploaded files are reachable only through signed URLs with a limited lifetime. Access tokens are held on your device in the operating system's secure storage.

No system is completely secure. If you find a vulnerability, tell us — we will investigate and will not pursue anyone for reporting in good faith.

17.Changes to this policy

We update this document when the way the app works changes. The date of the last change is shown at the top of this page. We announce material changes in the app.

18.How to reach us

Data questions: privacy@syilyq.app. General support: support@syilyq.app.

LARGEIS LABS LLP, https://syilyq.app.