Legal

Privacy Policy

Last updated: 18 July 2026

1. Who we are

Qiela is a location-based chat application centered around salons, managing user accounts, profiles, map discovery, location-bound chats, and presence validation. You can contact us at hello@qiela.app.

2. Information we collect

Depending on how you use Qiela, we may collect:

• Account information: phone number, verification status, account identifiers, and session information.
• Profile information: real name, public handle, email address, birthdate, profile image, and optional profile details you choose to add.
• Salon and access data: salon memberships, invite links, QR tokens, location-based access checks, and presence session records.
• Messages and media: chat messages, reactions, poll votes, and the media you send (photos, voice messages, and videos) in salons and private conversations.
• Location data: your device’s location (precise, or approximate if you grant approximate access), including in the background if you enable proximity notifications, and presence records (which salon you are in and your last location) while a salon session is active.
• Push notification tokens: a device token used to deliver notifications, if you enable them.
• Sign-in providers: if you sign in with Apple or Google, the link between your account and that provider (the provider and its subject identifier) and the verified email address it provides.
• Subscription and purchase information: if you use Qiela Plus, the store (Apple or Google), product and billing period, test or production environment, purchase and subscription status, renewal or expiry dates, and encrypted store transaction identifiers needed to validate, restore, reconcile, and prevent one purchase from being linked to two Qiela accounts. Qiela does not receive or store your payment-card or bank details.
• Moderation and safety records: reports you file or that are filed about you, bans, and related admin audit log entries.
• Device and technical data: app version, device type, IP address, server logs, and basic security events.
• Communications: feedback you send in the app (Settings → Send feedback), and messages you send to us by email or support channels.
• App activity: your online and last-seen status, your read position in conversations, and which conversations or announcements you have hidden or muted, used to show presence, unread badges, and your chosen layout.
• GIF and sticker activity: search terms are sent through Qiela to Klipy but are not stored by Qiela. Klipy receives your device’s IP address and the specific previews or sent media fetched from its content-delivery network, as described below.
• QR adoption activity: the sticker placement, QR/link open, salon landing-page view, and app-availability link tap. Before you sign in these events use only a random visit identifier for deduplication and are not linked to an account. If you newly join through that sticker, we associate the completed join — and derive whether a first salon message followed — with the placement. We do not store a cookie, advertising identifier, IP address, user agent, or device fingerprint in these adoption-event records.

3. Verification and sign-in

Qiela may use SMS one-time passcodes to verify phone numbers during signup or login. We use a third-party provider, currently Twilio, to send and verify these messages. The provider processes the phone number and verification metadata needed to deliver and validate the code.

If you use Sign in with Apple or Sign in with Google, we store the identity link between your Qiela account and that provider — the provider name and its subject identifier — together with the verified email address the provider gives us.

4. Messages, media, and encryption

Chat messages and the media you send (photos, voice messages, and videos) are stored on our servers so your conversations work across your devices. Messages are encrypted at rest with keys held by Qiela. This is not end-to-end encryption: Qiela can access message content where needed for moderation and legal compliance.

5. Location and presence

Salons are tied to real places, so Qiela uses your device’s location (precise, or approximate if that is all you grant) to check that you are where a salon is. If you enable proximity notifications, this includes location collected in the background. While a salon session is active, we keep presence records: which salon you are in and your last location.

6. Push notifications

If you enable notifications, we store a push token for your device so we can deliver them. Tokens are passed through the Expo push service to Apple (APNs) or Google (FCM). We delete your push tokens when you delete your account or disable notifications.

7. How we use information

We use information to:

• create and secure user accounts;
• verify phone numbers and prevent abuse;
• manage salon access, invites, QR links, and presence sessions;
• store and deliver messages, media, and profile images;
• deliver push notifications you have enabled;
• when Qiela Plus is used, validate, restore, reconcile, and support subscriptions and prevent duplicate or cross-account claims;
• moderate content, handle reports, and keep the service safe;
• operate, debug, and improve the service;
• measure which salon sticker placements lead to landing views, completed joins, and participation, using first-party analytics without an advertising identifier or third-party analytics SDK;
• respond to support, security, and legal requests.

8. Legal bases

Where EU or UK data protection law applies, we rely on legal bases such as performance of a contract, legitimate interests in operating and securing the service, consent where required, and compliance with legal obligations.

9. Sharing with service providers

We share limited data with service providers that help us operate Qiela. The main ones are:

• Twilio — sends SMS one-time codes and receives your phone number to do so;
• Resend — sends verification emails and receives your email address;
• Expo, Apple, and Google — deliver push notifications to your device;
• Apple App Store and Google Play — if you purchase Qiela Plus, process the purchase and provide subscription status, transaction identifiers, lifecycle notifications, and account-association values used for validation and fraud prevention;
• our S3-compatible object-storage host — stores the media files you upload;
• Klipy — our GIF and sticker provider; when you search for GIFs or stickers your query is sent to Klipy, and your device loads previews and sent GIFs/stickers directly from Klipy’s servers, so Klipy receives your device’s IP address and which GIFs/stickers you view and send. No Qiela account identity is sent with the query.
• Charon — when automated media moderation is enabled, receives photos and videos when you post them in salons to screen them for adult content. If you use the optional Verify Me feature, Charon also receives your live verification capture and public profile photo. Posting media to a direct message does not invoke Charon.

We may also use hosting providers, database providers, email/support tools, and security or logging services. These providers are used only as needed to provide and secure the service.

10. Moderation and safety

To keep Qiela safe, we keep moderation and safety records: reports you file or that are filed about you, bans, and an admin audit log. These records are retained even after account deletion, on safety and legal grounds.

11. Retention

We keep personal data only as long as needed for the purposes described above, including account operation, security, backup, audit, and legal requirements. Some technical logs may be retained for a shorter period than account information. Moderation and safety records are kept longer, as described above.

User-linked QR join conversions are deleted when the account is deleted. Anonymous QR scan, landing-view, and app-availability events are retained to measure sticker adoption. Because these records do not contain an account identifier or other stored device identifier, deleting an account does not identify or remove them.

When Qiela Plus is used, purchase intents are transient and are deleted with the account. The normalized subscription record, encrypted store-identifier lineage, and billing-event evidence are retained in pseudonymized form on the deleted-account tombstone after deletion. The store identifiers remain encrypted but can still be decrypted by Qiela to reconcile with Apple or Google, so this billing evidence stays pseudonymous personal data — it is not anonymous. We retain this evidence for as long as necessary to validate subscriptions, process renewals or refunds, prevent duplicate claims, meet accounting or legal obligations, and resolve disputes.

12. Security

We use reasonable technical and organizational measures to protect Qiela, including access controls, encryption at rest for stored messages, environment-separated secrets, HTTPS, and restricted production access. No online service can guarantee absolute security.

13. Your choices and rights

Your salon-membership list is hidden from your profile by default. You can opt in or out in Settings. When enabled, public salons may appear to people who can view your profile; private or unlisted salons appear only to people who already share that salon with you.

Online and last-seen visibility is shared only between contacts and is reciprocal: if either person turns it off, neither sees the other’s status. You can change this in Settings.

You may contact us to request access, correction, deletion, restriction, portability, or objection where applicable. You can also delete your account yourself, directly in the app — see “Account deletion” below. Where applicable, you may lodge a complaint with your local data-protection authority. Contact hello@qiela.app.

14. Account deletion

You can delete your account at any time in Settings. Deletion is immediate and permanent:

• your profile (name, handle, email, phone number, birthdate, bio) and your photos are erased;
• all your private conversations are erased, on both sides;
• messages you posted in salons remain, but they are no longer linked to your identity — they appear as an anonymous placeholder;
• your phone number, handle, and email become immediately reusable for a new account.
• any user-linked QR join conversion is deleted; anonymous QR visit events were never linked to your account.

A few records are kept after deletion: moderation reports, the admin audit log, and pseudonymized billing evidence, as described above. A late Apple or Google notification may update that pseudonymized billing record, but it does not recreate your account or transfer the subscription. If the account was permanently banned, the phone number and sign-in identity stay blocked to prevent ban evasion.

Deleting your Qiela account does not cancel an active App Store or Google Play subscription. Cancel it in the store account that bills you before deleting your account.

You can also review how to request deletion, including without opening the app, on our data deletion page.

15. Children

Qiela is intended for individuals 16 and older. We do not knowingly collect information from children or allow under-16 accounts. If you believe a child has provided personal data, contact us.

16. International transfers

Qiela and its providers may process data in countries other than your country of residence. Where required, we use appropriate safeguards for international transfers.

17. Changes

We may update this Privacy Policy as Qiela develops. The updated version will be posted on this page with a new “Last updated” date.