Yell to the World — Privacy & PDPA notice

1. Who we are

Regacity Enterprise (201803315236 (002881246-M)), 6-6-4, Queen's Avenue Blok 6, Jalan Shelley, Cheras, 55100 Kuala Lumpur, Malaysia. Email: hello@yelltotheworld.com.

2. What we collect

• Your seat. When you open the site, your browser gets an anonymous account: a random identifier, an Echo number, and the flag you choose (the Earth until you choose one). You don't give a name, email or phone number to yell.
• If you link your seat to Google or an email address: that email address, and the basic profile Google shares at sign-in (such as your name and picture). We use it only so you can sign back in. Passwords are handled by Google's Firebase Authentication; we never see them.
• What you yell: the words, when you yelled, which rooms it went to, any effects, name or link you added, and which yell it replies to. Our automated check adds English and Chinese translations, a mood (happy, angry, sad or hopeful), whether it's a wish or a complaint, its moderation result, and whether it may be about self-harm, so its sender can be shown where to find help.
• Names and cards: a name you choose for paid yells, a World shower or your card, and the one link on your card (a social media handle or a website). For a website, our server fetches its icon from that website to show as its logo.
• Purchases: Stripe collects your card details; we never see your full card number. We keep the payment's reference, the amount, the 📣 it added, and a record of how your 📣 were spent.
• Reports you make: what you reported and when.
• From your browser: its language settings, to choose the app's language; and with each yell, your clock's difference from UTC, used only to count at what hour of the day yells are sent. It isn't stored with the yell.
• While the sky is open: a short-lived note that your seat is online and which flag it flies, used to count people online and visitors per day. Each day's list is deleted once that day's numbers are counted; only the numbers are kept.
• What we don't collect: we don't work out your location from your IP address or your browser, we never ask for your position, and we use no advertising or analytics tools.
• Technical details our providers see: like every website, the site's providers receive the IP address and browser details your device sends. Google keeps them in our server's logs for 30 days, Stripe receives them when you pay, and Google's reCAPTCHA uses them to check visits for abuse. Our own code doesn't read them.

3. Where it comes from

From you and your browser, from our automated check, from Stripe (whether a payment went through) and from Google (if you link your seat to Google).

4. What we use it for

• running the sky: showing yells, translations, rooms, boards and your own list of yells;
• keeping it safe: automated moderation, reports, and stopping abuse and fraud;
• selling and delivering 📣, and handling refunds and disputes;
• publishing the public pages: each day's page, each yell's page and the State of the World counts;
• keeping the site working and its costs under control;
• meeting our legal obligations, including keeping financial records.

We don't sell your data, we don't use it for advertising, and we don't send marketing.

5. Who else handles it

• Google (Firebase and Google Cloud): hosting, databases, server functions, sign-in and security checks (App Check with reCAPTCHA).
• Google Gemini: the automated check that moderates and translates yells, names and card links.
• Stripe: payments.
• Our email provider, if you write to us.
• The public: yells, names shown on paid yells and World showers, cards on the Loudest board, and the counts on the State of the World page are public by design.
• Authorities, where the law requires it.

6. Where it's stored

In Google Cloud's Singapore region. Google and Stripe may also process data in other countries, including the United States. By using the site, you agree to this.

7. How long we keep it

• Yells stay until you take them back from My yells. They then leave the sky at once and the public pages within about half an hour. A yell stays on the site after its seat is removed.
• Seats that aren't linked, haven't been used for 30 days and never bought 📣 are removed, with their profile, scores and list of yells.
• Payment and 📣 records are kept for as long as the law requires for business records.
• The automated check's results for a piece of text are reused for up to 90 days after they were last needed, then deleted. Taking a yell back deletes its result at once.
• Our server's logs at Google: 30 days.
• Reports: as long as we need them to handle abuse.

8. Do you have to give it?

You don't need to give any personal data to yell. Linking an email or Google account is optional, but without it your seat can't be recovered if its browser data is lost. Card details (given to Stripe) are needed to buy 📣.

9. Your rights

Under the PDPA you can ask to see the personal data we hold about you, have it corrected, withdraw your consent, have it sent to you or another service, and limit how it's used. You can also complain to the Personal Data Protection Department (pdp.gov.my).

Because seats are anonymous, we can act on a request only when we can tell the seat is yours — for example, through the Google account or email linked to it. To take back a yell, use My yells.

To make a request, email hello@yelltotheworld.com with "PDPA request" in the subject. We may need to confirm the seat is yours, and we aim to reply within 21 days.

10. Security

Encryption in transit; database rules that let each seat reach only its own data; App Check against automated abuse; and every payment and moderation decision made on our servers, never in your browser. No system is perfectly secure. If a breach is likely to cause significant harm, we'll tell the authorities and the people affected, as the law requires.

11. Age

Yell to the World is for people aged 16 and over; buying 📣 needs 18, or a parent's or guardian's permission. If you believe someone younger is using it, please write to us.

12. What's stored in your browser

The site keeps your seat, your language choice and similar settings in your browser. Google's reCAPTCHA sets its own cookies for security. There are no advertising or tracking cookies.

13. Changes

We'll update this notice when our practices change. The date at the top shows the latest version, and important changes are noted on the site.

14. Language

This notice is in English, Bahasa Malaysia and 简体中文. If they differ, the English version applies.