Privacy policy

In short

The map, search, routes and the navigator work without an account. We collect only what the service needs to work, we do not sell data and we do not show personalised advertising.

Trip tracks, app analytics and taps on the website are collected only with your separate consent, which you can withdraw at any time. How place view statistics are counted is described in “Place statistics”.

Website

• You do not need an account to use the website. The website has no advertising trackers and no third-party analytics.
• The website stores only functional cookies in your browser, for up to one year: language (lang), theme (theme), selected city (city) and the hidden app banner (app_banner). Your answer to the analytics notice is stored only in your browser (localStorage, key yalla.analytics.consent) and is not sent to the server; you can change it on this page. If your browser supports it, the website installs a service worker: it keeps the design, fonts, scripts, the “You are offline” page and recently opened pages in the browser cache so that the site opens faster and works offline. The cache stays on your device and can be cleared in the browser’s site settings.
• Search queries and route points you enter are sent to our servers to find places and build routes. On the website they are not linked to an account.
• The “My location” button asks for your browser’s permission. The coordinates are used to show you on the map and find places nearby, and are not written to logs.
• The home page picks a city from the approximate region that the Cloudflare delivery network derives from your IP address, and the “Show what’s near me” button uses your browser’s location (only when you press it or if you have already allowed it for this site); this data is used only to choose what to show and is not stored.
• The “Report an error” form sends the type of error and your comment. The IP address is used as a hash to limit the number of messages from one address. If the Cloudflare Turnstile check is enabled on the form, Cloudflare processes technical browser data to protect against bots.
• Our servers process the IP address and technical details of each request to deliver the page and protect against abuse. Logs contain no phone numbers, tokens or precise user coordinates and are kept for up to 14 days.

Place statistics

• Statistics help business owners see how often their place card is opened and how people contact them. They are not used for advertising and are not shared with third-party services.
• What is recorded: the type of event (card view, appearance in search, search query, a tap on “Call”, “Website” or “Route”), the place identifier, the channel (website, app or widget), the date and time, the normalised text of the search query and a session hash.
• The session hash is an HMAC of the IP address and the User-Agent with a secret salt that changes every day. The IP address itself is not stored, and events from different days cannot be linked.
• Card views and search appearances are counted on the server when the request is processed. Cards on the website are requested from the API by our web server, so these events carry the web server’s data, not yours.
• Taps on “Call”, “Website” and “Route” on the website are sent only after you allow analytics in the notice. If Do Not Track or Global Privacy Control is on in your browser, they are never sent.
• For a “Route” tap an approximate starting point may be stored — only a grid cell of about 1 km and only if you have already shared your location on that page; location is never requested for statistics. Place pages on the website do not send a starting point at the moment.
• Individual events are kept for 90 days; after that only daily totals without the session hash remain.
• Only verified owners of the business see the totals in their dashboard. Route starting points are shown only for cells with at least 5 different sessions.

App

• Navigation and camera alerts work with an anonymous device identifier, without a phone number.
• Signing in with a phone number (SMS code) is needed only for road reports, reviews and syncing saved places. The phone number is stored as a hash for lookup and encrypted for sending SMS; the interface and reviews show only a mask such as “User ··67”.
• Only you can see your saved places (home, work, favourites).
• Road reports are published without the author. Authorship is used only to protect against abuse and is anonymised after 12 months.
• Reviews and photos are published openly with the author’s mask and are moderated.
• Trip tracks — only with the “Tracks” consent, which you can withdraw at any time. Tracks help us estimate travel times more accurately; raw points are kept for no more than 7 days and then deleted, and aggregated road speeds contain no personal data.
• Analytics — only with the “Analytics” consent: anonymised app usage events without precise coordinates (location in them is coarsened to an area of a few square kilometres).

Consents

Consents to tracks and to analytics are given separately and stored with the text version and the date. You can withdraw a consent in the app settings at any time: collection stops immediately. If the consent text changes, the app will ask for your consent again.

Retention and deletion

• Account data is kept while the account exists.
• You can delete your account in the app. Saved places are deleted at once, sign-in sessions are revoked and devices are unlinked; after 30 days the phone number is irreversibly anonymised. Signing in again with the same number within those 30 days cancels the deletion.
• You can download a copy of your data in the app.
• Raw track points — no more than 7 days, server logs — up to 14 days, place statistics events — 90 days (then daily totals only).

Who receives data

We do not sell personal data or share it for advertising. Data is processed only by contractors the service cannot work without: the SMS provider (to send the sign-in code), hosting and, if the check is enabled on the form, Cloudflare. Data is disclosed to public authorities only on the grounds provided by the legislation of the Republic of Uzbekistan.

Your rights

You can find out what data about you is stored, get a copy, correct it, withdraw consents and delete your account. Most of this is available in the app; for anything else contact the operator using the details below. Data is processed in accordance with the personal data legislation of the Republic of Uzbekistan.

Changes

A new version is published on this page with the date of the update. If the changes concern consents, the app will ask you to confirm them again.

Operator and contacts

For questions about these rules and your data, contact the operator of the Yalla Maps service.