Wyst Privacy Policy
Wyst helps adults meet in person around shared interests, through group matching, events and chat. This policy explains what information Wyst collects, why, who it is shared with, how long it is kept, and the choices and rights you have. It applies to the Wyst app (Android and iOS) and the Wyst website.
Who we are
Wyst is operated by Wyst Labs Ltd, a company registered in England and Wales (company number 17478012), whose registered office is at 128 City Road, London, EC1V 2NX. Wyst Labs Ltd is the data controller for the information described here, and is registered with the UK Information Commissioner's Office (ICO) as a data controller, registration number ZC270637.
For any privacy question or request, email hr@wystapp.org.
What we collect, why, and our legal basis
UK data protection law (the UK GDPR) requires a legal reason for each use of your data. Ours are: contract (we need it to provide Wyst to you), legitimate interests (a reasonable need of ours, or of other users, that doesn't override your rights), and consent (you have agreed, and can change your mind at any time).
| What | Why | Legal basis |
|---|---|---|
| Your email address or phone number (and your Google account's email if you sign in with Google) | To create your account and sign you in | Contract |
| Name, date of birth, gender, bio, job title and up to ten interests | To build your profile, check you are 18 or over, and match you with suitable groups and events | Contract |
| Your general location, to about 100 metres, from your device or a place you choose | Wyst is built around meeting people nearby, so we use it to match you with groups and show you events near you. We round it when we store it and never keep your exact position. | Contract |
| The groups you're in and the events you host or join | To run your groups and events | Contract |
| Messages you send in group chats and direct messages, and your reactions to messages | To deliver them and keep your chat history | Contract |
| Your privacy settings, and when you were last online | To apply your choices, and (if you allow it) to show people you message when you were last online | Contract |
| People you block, reports you send, and reports others make about you | To keep blocked people away from you and to investigate and act on safety concerns | Legitimate interests (keeping people who use Wyst safe) |
| Your device's push notification token | To notify you about new groups, events and messages | Consent (your device's notification permission, which you can turn off at any time) |
| Which version of our Terms and this policy you agreed to, and when | To be able to show what you agreed to | Legitimate interests (keeping accurate records) |
| Simple usage counts, such as a group forming, an event being hosted or joined, or the WystPlus page being viewed | To understand how Wyst is used and decide what to build, including which WystPlus features to offer | Legitimate interests (improving Wyst) |
| Technical information our servers record, such as your IP address and the requests your app makes | To keep Wyst secure, prevent abuse (for example, limiting repeated sign-in attempts) and fix problems | Legitimate interests (security and reliability) |
We don't use advertising, we don't include advertising or analytics trackers in the app, and we don't sell your data.
What other people on Wyst can see
- In chats: your first name and the initial of your last name.
- If your profile is public (Settings → Privacy): your bio, interests and other profile details. If it's private, people you share a chat with see only your name.
- If you and they both allow it: when you were last online.
Other users never see your exact location, your email address, your phone number or your date of birth, and nobody can search for you by your email address or phone number. People can only message you once you share a group or event with them.
Who we share it with
We use a small number of service providers ("processors"). They act only on our instructions and only to run Wyst:
- Amazon Web Services (AWS), London region: hosts the Wyst servers, database and chat. Your data is stored in the UK.
- Google (Firebase Authentication, Google Sign-In, Firebase Cloud Messaging): signing you in and sending push notifications.
- Google Maps Platform: showing maps and turning a location you choose into a place name.
The Topics feed shows articles and pictures about your interests from other publishers and websites. To fetch them we send only the topic (for example "Football"), never anything about you. When your phone loads a picture or you open an article, that site receives your device's IP address, as with any website, and its own privacy policy applies once you are on it.
We may also share information if the law requires it, or where it is necessary to protect someone's safety.
International transfers
Our servers and database are in the UK. Google may process some data (sign-in, notifications and maps) in the United States. Where it does, the transfer is protected by the UK Extension to the EU–US Data Privacy Framework, under which Google is certified, and by Google's data processing terms, which include the UK International Data Transfer Addendum.
How long we keep it
| What | How long |
|---|---|
| Your account, profile, groups, events and settings | Until you delete your account, except for events, which are removed a day after they end |
| Event group chats | A day after the event ends, when the chat and its messages are deleted. The organiser can delete the chat for everyone sooner. |
| Messages you have sent | For as long as the chat they were sent in exists. Your messages are also part of the other people's conversations, so, as in most messaging apps, deleting your account doesn't remove them from those chats. Instead, they no longer say who sent them: they show as from "Deleted user", with nothing linking them to you. |
| Usage counts | 13 months |
| Reports you send | Kept while they may still need action. If you delete your account, they stay without your name attached. Once dealt with, they are deleted after 2 years. |
| Server logs | 30 days |
| Database backups | Up to 7 days, after which they are overwritten |
Your choices, in the app
- Download my data (Settings → Account): see and copy everything Wyst holds about you.
- Edit your profile at any time.
- Privacy switches (Settings → Privacy): public or private profile, and last-seen visibility.
- Location: Wyst needs your general location to work. You can turn off location matching (Settings → Privacy) or your phone's location permission, but you then won't be matched into new groups or see events near you.
- Notifications: turn them off at any time in your phone's settings.
- Block and report: block anyone from their profile or a chat; report a person, content or an event.
- Delete your account (Settings → Account): removes your profile, your place in groups and events, your reactions to messages, your usage data and your sign-in. Messages you sent stay in the chats they were sent to, shown as from "Deleted user". It cannot be undone.
Your rights
Under UK data protection law you have the right to:
- access your data and receive a copy (Download my data does this in the app);
- correct inaccurate data;
- have your data deleted;
- restrict how we use it, or object to our use of it where we rely on legitimate interests;
- receive your data in a portable, machine-readable format (Download my data provides it as JSON);
- withdraw your consent at any time, where we rely on it.
To exercise any right that the app doesn't already handle, email hr@wystapp.org. We will reply within one month. If our response doesn't resolve your concern, you can escalate to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.
How matching works
Wyst suggests groups automatically, based on the group size, age range, distance and interests you choose, and your general location. This doesn't have legal or similarly significant effects on you. Matching needs your general location, so with location matching turned off you won't be matched into new groups.
Sensitive information
We don't ask for information about your health, religion, ethnicity, sexuality or political views. Please think carefully before sharing anything like that in your bio or messages.
Keeping your data safe
Everything between the app and our servers is encrypted in transit. Our servers are in the UK, and access to them is restricted. If a breach ever puts your information at risk, we will tell you, and report it to the Information Commissioner's Office where the law requires.
Children
Wyst is for adults. You must be 18 or older to create an account; we check your date of birth when you sign up, and we don't knowingly collect data from anyone younger. If you believe someone under 18 is using Wyst, please tell us at hr@wystapp.org.
Changes to this policy
If we change how we handle your data, we will update this page and the "last updated" date above. For significant changes, we'll let you know in the app before they take effect.
Contact
Questions, requests or concerns: hr@wystapp.org
By post: Wyst Labs Ltd, 128 City Road, London, EC1V 2NX, United Kingdom