YOo
Effective 29 July 2026
Privacy policy
This describes what YOo does with information, written to match how the service actually works — including the parts that protect you less than you might expect.
The short version
We cannot read your messages. Message content, files, photos and calls are end-to-end encrypted. The keys are on your devices and never leave them. This is not a promise about our conduct; it is a property of how the system is built.
Four things are not protected, and you should know them now: registering requires WhatsApp, so Meta learns you signed up; looking up who else uses YOo is not private; there is no backup or recovery if you lose your phone; and our servers record the IP address you connect from. Each is explained below.
Who we are
YOo is operated by CREATIVE ADVANCED TECHNOLOGIES Co., a company registered in Dubai, United Arab Emirates, at Office 1104, Bay Square 01, Business Bay. We are the controller of the personal data described here. You can reach us at support@theyoo.app.
We are not Signal. YOo is built on Signal's open-source software but is a separate service on separate servers, not affiliated with or endorsed by Signal Messenger LLC or the Signal Technology Foundation.
What you give us
Your phone number
Your phone number is your account. There is no username and no password. To register, you receive a one-time code on WhatsApp and enter it. We keep the number for as long as the account exists, because it is what lets other people reach you.
The code arrives on WhatsApp, sent through our own gateway. You need WhatsApp on that number in order to register — there is currently no other way to receive the code.
Two things follow from that, and both are worth knowing before you register. The message is encrypted in transit by WhatsApp, so unlike an SMS it cannot be read by your mobile operator. But Meta, which runs WhatsApp, receives your phone number and the message in order to deliver it, and so learns that this number was sent a YOo code. And your YOo account is only as well protected as your WhatsApp account — anyone who can read your WhatsApp messages can complete a registration for your number.
Your messages, files and calls
These are end-to-end encrypted. We receive them only as ciphertext and have no way to decrypt them. Your message history lives on your own devices, not on our servers.
When we cannot deliver a message immediately — the recipient's phone is off, say — we hold the encrypted message until it is delivered, and for at most 30 days if it never is. Files and photos are stored encrypted, with keys we do not hold.
Finding people you know
When your app checks whether a phone number belongs to a YOo account, our server receives that number in the clear. Signal avoids this using sealed hardware enclaves that keep the lookups hidden even from Signal itself. We have not built that, so we could, in principle, see which numbers you look up.
We do not store these lookups in a database. They can appear in our servers' request logs, which are described below.
There is no backup and no recovery
YOo does not offer a PIN, and there is no encrypted backup of your contacts, groups or settings on our servers. This means we hold less about you. It also means that if you lose your phone, your messages are gone. We cannot restore them, because we never had them.
If you write to support
We keep what you send us for as long as it takes to deal with the issue and to answer any follow-up. Please do not send us anything sensitive that we do not need.
What we record automatically
Our servers write request logs. A log line contains the IP address your device connected from, the time, which endpoint was called, and which app version you are using. We use these to keep the service running and to detect abuse.
These logs rotate: once they reach a fixed size the oldest is discarded. We do not archive them and we do not build profiles from them.
We also hold a push notification token for each device, so we can tell your phone that something is waiting.
YOo contains no advertising, no analytics and no tracking. We do not sell, rent or trade personal information, and we do not share it for advertising.
This website behaves the same way. It sets no cookies, runs no analytics, and loads nothing from anyone else — the fonts, images and stylesheet all come from our own server, so reading these pages tells no third party that you did.
The other companies involved
Running YOo means other companies handle some information on our behalf. We require each to protect it to the standard set out in this policy.
| Who | What they receive | Why |
|---|---|---|
| Meta (WhatsApp) | Your phone number and the verification message | Delivering your registration code. The gateway that sends it is our own; WhatsApp carries it. |
| Cloudflare | Your IP address and browser characteristics, at registration only | The anti-automation check before a code is sent |
| Apple (APNs) | A device token, and that something is waiting | Notifications on iPhone and iPad |
| Google (FCM) | A device token, and that something is waiting | Notifications on Android |
| Amazon Web Services | Encrypted account records, in Frankfurt | The database the service runs on |
| Vultr | Encrypted files and photos, in Amsterdam | Storage for attachments |
Apple and Google may be able to connect a device token to your Apple or Google account, even though we cannot. You can turn notifications off in your phone's settings; YOo will still work, but it will not alert you until you open it.
Where information is kept
Account records are in Frankfurt, Germany. Encrypted files are in Amsterdam, the Netherlands. Both countries have data protection law that meets the standard required for transfers out of the UAE.
How long we keep things
| What | How long |
|---|---|
| Your account and phone number | Until you delete the account |
| An undelivered encrypted message | Until delivered, or 30 days |
| A registration session and its code | 10 minutes, held in memory only |
| Registration recovery records | 300 days |
| Request logs | Rotated by size; not archived |
| Support correspondence | As long as the issue is open, and a reasonable period after |
When we would share information
We share information outside the companies listed above only where we must: to comply with a binding legal obligation, to enforce our terms, or to address fraud, abuse or a threat to someone's safety.
It is worth being precise about what such a request could reach. We cannot produce the content of messages or calls, because we cannot decrypt them. What we hold is the information described above — an account's phone number, and connection records. Our company is subject to the law of the United Arab Emirates; our hosting providers are subject to German and Dutch law.
Your choices and your rights
We process your information because it is necessary to provide the service you asked for. You can:
- Have your account deleted at any time, by asking us. See how to request it and what deletion erases.
- Ask what we hold about you, and ask for a copy.
- Ask us to correct anything inaccurate.
- Ask us to restrict or stop processing, or object to how we handle your information.
- Turn off notifications in your phone's settings.
Write to support@theyoo.app. We will ask you to verify control of the phone number before acting on a request about an account, because otherwise anyone could make one about you.
We do not run YOo on consent: we process your phone number because it is necessary to provide the service you asked for, not because you ticked a box. So there is no consent to withdraw. If you want us to stop processing your information altogether, ask us to delete the account — that is what withdrawal amounts to here, and it erases what we hold.
Security
Message content is protected by end-to-end encryption, which is the strongest protection here and the one that does not depend on us behaving well. Connections use TLS. Files are encrypted before they reach storage.
What this does not protect: anyone with access to your unlocked phone can read your messages, and someone with access to your WhatsApp could register your number. Use your phone's screen lock, and protect your WhatsApp account with its own two-step verification PIN.
Children
YOo is not intended for children under 13. We do not knowingly create accounts for them. If you believe a child has registered, write to us and we will remove the account.
Changes
If we change this policy we will change the date at the top and note what changed. If a change materially affects what we do with your information, we will say so in the app before it takes effect.
Contact
CREATIVE ADVANCED TECHNOLOGIES Co., Office 1104, Bay Square 01, Business Bay, Dubai, United Arab Emirates. support@theyoo.app · +971 54 578 0487