Privacy Policy

1. Understanding Anonymity on Y2ASK

Y2ASK operates as an anonymous messaging and Q&A platform. It is important to distinguish between anonymity to the recipient and technical information processed by our servers:

To the message recipient: You are anonymous. When you submit a question on a creator's public link (y2ask.link/[username]), the recipient cannot view your name, phone number, email address, or social media profile.
To the Y2ASK platform: Senders do not need to register or log in. However, to safeguard users and prevent automated abuse, our backend processes technical network signals (such as device headers) to generate a salted, one-way cryptographic hash.

2. Information We Collect

We collect only the minimum data necessary to operate our service:

A. Registered Creators (Account Holders)

When creating an account on the Y2ASK mobile application, we collect your chosen username, profile handle, avatar preference, and optional email address for password recovery and account verification.

B. Anonymous Senders

Senders are not required to create an account or provide personal credentials. We collect the submitted message text, prompt selection, emoji reactions, and submission timestamp.

C. Technical Data & Anti-Abuse Fingerprinting

Raw IP addresses are never stored in our message database. When a message is sent, the incoming IP address and browser headers are passed through a one-way salted cryptographic function (HMAC-SHA256) to generate an anonymous device identifier. This allows creators to block repeat harassment from the same device without exposing the sender's real-world identity.

3. How We Use Information

Service Delivery: To route and display anonymous questions to the intended creator's mobile inbox.
Safety & Moderation: To screen text using automated filters for prohibited content, including severe harassment, cyberbullying, and self-harm keywords.
Abuse Prevention & Rate Limiting: To enforce rate limits (preventing spam script flooding) and honor block lists set by creators.
Aggregated Hints: If a creator uses an optional hint feature, we provide generalized, non-identifying telemetry (e.g., broad device model family or general geographic region). We never reveal names, phone numbers, or exact coordinates.

4. Data Sharing & Third-Party Providers

We do not sell, rent, or trade your personal information to third-party data brokers or marketing networks. Information is only shared under the following limited circumstances:

Infrastructure Providers: Cloud database, server hosting, and network transit partners (such as Google Cloud and Firebase) who store and process data strictly on our behalf.
Legal & Law Enforcement Compliance: Where required by applicable law, valid court order, or formal subpoena. In emergency situations involving imminent danger of death or severe physical harm, we may disclose available technical logs to authorized law enforcement.

5. Data Retention & Deletion

Inbox messages remain visible to the creator until manually deleted by the creator or until the account is closed.

Account Deletion: You can delete your account at any time directly through the mobile app settings or by submitting an erasure request on our Delete Data page.
Deletion Timeline: Account records, username claims, and stored messages are scrubbed from production systems within 24 hours of request verification.
Limited Security Retention: Salted block-hashes and security audit records may be retained for up to 30 days solely to enforce active user blocks and prevent system abuse.

6. Security Measures & Limitations

We maintain physical, technical, and organizational measures to safeguard data, including HTTPS/TLS encryption in transit and one-way cryptographic hashing for device identifiers. However, no internet-based service can guarantee 100% impenetrable security against all potential vulnerabilities.

7. Your Privacy Rights & Contact Information

Depending on your location (including rights under GDPR and the India Digital Personal Data Protection Act 2023), you have the right to request access to, correction of, or permanent erasure of your personal data.

General Privacy Inquiries: privacy@y2ask.link

Grievance Redressal Officer: grievance@y2ask.link

Turnaround Commitment: Formal requests are acknowledged within 24 hours and addressed within applicable statutory timelines.