Privacy Policy

Who we are

Gyvio is a social app for posting, chatting, calling, meeting new people and earning Dash Coins. Gyvio is operated by Salesive Force Ltd, a company registered in Nigeria, of No 1 Eugene Oba Street, Agbani Road, Enugu 400252, Enugu State, Nigeria ("Gyvio", "we", "us"). Salesive Force Ltd decides how your personal data is used, which makes it the data controller under the Nigeria Data Protection Act 2023 (NDPA).

Our Data Protection Officer can be reached at support@salesive.com (subject: "Gyvio privacy").

This policy covers the Gyvio app (the web app you can install on your phone) and this website, www.gyvio.app. It works alongside our Terms of Service, Cookie and storage notice and Community Guidelines.

The short version

What we collect

When you sign in with Google or Apple

Gyvio offers sign-in with Google and with Apple. If you use Google, Google confirms who you are and sends us:

• a Google account ID that tells us it is you next time,
• your email address (we only accept accounts whose email Google has verified),
• your name, which becomes your starting display name, and your first name, which we use to suggest a username,
• your Google profile photo, which we copy into our own storage as your starting profile photo.

We do not get your Google password, contacts, files, calendar or anything else in your Google account.

If you use Sign in with Apple, Apple confirms who you are and sends us an Apple account ID that tells us it is you next time, an email address (your own, or, if you choose to hide it, a private address from Apple that forwards to you), and, the first time only, the name you choose to share, which becomes your starting display name. If the email Apple confirms is the same as that of a Gyvio account you already have, both sign-ins open that one account; a hidden Apple address is never used this way. We do not get your Apple ID password or anything else in your Apple account.

What you tell us when you sign up and later

• Name and username. Your display name and a username of 3 to 24 letters, numbers, dots or underscores.
• Country. We guess it from your phone's language and time zone settings so you can confirm it. We do not use GPS or your precise location.
• Date of birth. Required. You must be 18 or older. It is private.
• Gender. Woman, man or other. It is private. It is used to match you in Meet with the people you each want to meet, and to suggest a feminine or masculine face when you first set up your Gyvmoji (right after you sign up, or later in Settings). That suggestion is shown only to you, and only the face you choose and save is seen by others; your gender itself never is. You can change it once every 30 days.
• Profile photo (optional at sign-up, required to use Meet), bio (up to 160 characters) and city (optional, up to 40 characters).
• Settings, such as who can see your followers, your stories and your posts, whether your stories can be reshared, whether you get alerts when someone is typing to you or has read your message, your paid inbox price, and whether you accept tips and coins.
• A spending passcode, if you set one. We store only a scrambled form of it (a salted hash), never the passcode itself.
• Who invited you, if you joined through someone's invite link.
• Business details, if you switch to a business account: the business name, what it does, its city, phone, WhatsApp, email and website, which of these to show on your profile, the button beside Follow, and its registration number (in Nigeria, its CAC number). What you choose to show is public; the rest stays private. We check the registration number by hand against the public register.

The devices you're signed in on

For each phone or computer signed in to your account, we keep what kind of browser and system it is (for example "Chrome on Windows"), roughly where it signed in from (the country and city its network is in, not GPS), its network provider, and when it was last used. You see these in Settings › Linked devices, where you can log any of them out. When you link a computer to Gyvio Business by scanning its code, your phone shows you the same details about that computer before you approve it, so you can tell if it isn't yours.

What you create and send

• Posts: photos, videos and carousels, their captions and hashtags, and the sound used in a video. Sounds taken from your video can be reused by other people, credited to you.
• Stories (24-hour posts) and Flicks (photos and clips sent to friends that vanish after 24 hours).
• Comments (text, stickers or pictures), likes, reposts and stickers you upload.
• Messages in one-to-one chats: text, photos, voice notes, stickers, shared posts and replies to stories, with the time each message was delivered and read.
• Rooms: group chats you create or join, and the messages in them.
• Letters you write and receive: what they say, who they are to, whether they were sent anonymously, which letter a reply answers, who you let write to you and who you don't, whether and when they were read, any Dash Coins in them, and whether they were put away, reported or their writer stopped. When you send a letter anonymously, the person you wrote to is never shown who you are (not in the letter, the notification or their wallet), but we keep who wrote it so we can act on reports.
• Reports you make about other people or their content, with any note you add.

When you type or paste a link in a chat or room, our server visits that web page to build a preview (title, description and picture). This can happen while you are still typing, before you press send. The server identifies itself to that site as "GyvioBot".

While you type a message, the other person sees that you are typing. If they have Gyvio+, they also see a masked glimpse of your draft (only the first letter of each word, masked on your phone before it is sent). Nobody without Gyvio+ receives the draft at all.

Money

• Your Dash Coins wallet balance and every transaction: top-ups, tips, coins sent and received, paid first messages, giveaways, referral rewards and cash-outs.
• For cash-outs: your bank, account number and account name. We compare the account name with the name on your ID.
• For Gyvio+: the history of your Gyvio+ payments. If you paid for Gyvio+ by bank transfer before it moved to Dash Coins, also the name and phone number Paystack needed to give you your own bank account number to pay into.

Top-ups are paid on Paystack's own secure page, by card, bank, USSD or bank transfer. We never see or store your card number. See Dash Coins and payments for how money works on Gyvio.

How you use Gyvio

• Viewing. For each post you watch: how long you watched, how much of it, whether you replayed it and whether you skipped it. Who viewed each story, and when.
• Connections. Who you follow and who follows you (following each other makes you friends), who you block, and your streaks with friends.
• Presence. Whether you are online and when you were last seen.
• Profile views. When you open someone's profile, we record that you did, how many times and when you last did, for 30 days. If you have Gyvio+, we don't record your views at all.
• Calls. A record of friend calls: who called whom, voice or video, when, how long, and how the call ended.
• Notifications we have sent you.

Your device

• Push notification address. If you allow notifications, your browser gives us an address to send them to (up to 5 devices per account).
• Device fingerprint. When you sign up we record a scrambled summary (a hash) of your browser type, language, screen size and colour depth, time zone and number of processor cores. We use it to spot duplicate or fake accounts.
• Device ID. A random ID kept in a cookie in your browser (see the Cookie notice), so we can tell when several accounts are used on the same device.
• Network details. When you use the app, Cloudflare tells us your IP address, your network provider (for example your mobile network) and your country. We keep your IP address only in a scrambled form (a keyed hash), together with its network block (the first three parts of the address), the provider, the country and which version of the app you use. We record this when you sign up, sign in, reconnect and move money.
• Browser checks. Whether your browser says it is being controlled by automation software, and whether the app is installed on your home screen.
• The human check. When you sign up and when you cash out, we may ask Cloudflare Turnstile to check you are a person. Cloudflare looks at your browser and connection to decide, and tells us only whether the check passed.
• Things stored on your phone. The app keeps some data in your browser so it opens fast and works offline. See the Cookie and storage notice.

We do not ask for access to your contacts or your location. We ask for your camera and microphone only when you start a call, record a voice note or video, or use Meet.

Your ID, before your first cash-out

Before your first cash-out, our provider Didit checks your ID in its own secure page. You take a photo of your ID document and a short selfie. Didit checks the document is genuine, that the selfie is of a real person present at the time, and that it matches the photo on the ID. It may also check your device and network, and whether the same document or face has been used before, including across other companies that use Didit.

Didit tells us whether the check passed and what the ID says. From that we keep only:

• your name, date of birth and the country that issued the ID, to compare with your bank account name and to keep Gyvio 18+,
• a scrambled form (a keyed hash) of the document number, so we can tell if the same ID is used on a second account. We do not keep the number itself.

We do not keep the photos of your ID or your selfie. Didit keeps its own record of the check under Didit's privacy policy.

Meet and safety

Meet has its own section below: Meet and calls.

What other people can see

Profile views. If you look at someone's profile and they have Gyvio+, they can see that you did, and when, for 30 days. People without Gyvio+ see only how many people looked, not who. If you have Gyvio+ yourself, your visits aren't recorded, so nobody sees them.

Letters you write. The person you write to can turn your letter into a picture and post it, put it on their story, or share it outside Gyvio. It then shows what you wrote and, unless they leave it off, your first name (an anonymous letter says "Anonymous"). Once shared, it's theirs to show, like any post.

Your birthday. On your birthday your profile says it's your birthday, so people can write you a birthday letter. It doesn't show your age or your date of birth. You can turn this off in Settings › Letters › Birthday letters.

Your stories are seen by the people your story settings allow, and you can see who viewed each one. Messages are seen by the people in that chat or room. Anyone in a public room can read what is posted there.

Photos, videos, voice notes and other files you upload are kept at web addresses that are long and hard to guess, but they are not password-protected. Anyone who has the exact link to a file can open it. Please think about this before sharing something sensitive.

How we use it

We use your data only for the reasons below. Where the law asks us to name a legal basis, it is shown in brackets.

• To run Gyvio for you: your account, your profile, posting, chats, rooms, calls, Meet, streaks, letters, notifications and your wallet. (Needed to provide the service you asked for.)
• To show Gyvio+ members who viewed their profile, using the profile views described above. (Needed to provide Gyvio+, and legitimate interest in letting people see who is interested in them, balanced by keeping views for only 30 days and letting Gyvio+ members browse unrecorded.)
• To offer birthday letters, using your date of birth to show on your profile, on the day only, that it's your birthday. (Legitimate interest, and you can turn it off.)
• To keep Gyvio 18+, using your date of birth. (Legal obligation and legitimate interest in keeping minors off an adult platform.)
• To match you in Meet, using your gender, your country and the filters you choose. (Needed to provide Meet.)
• To suggest a face for your Gyvmoji, using your gender, on your own phone only, when you first open the Gyvmoji editor. Nothing is shared until you save, and you can pick a different face. (Legitimate interest in a sensible starting point, with your choice on top.)
• To choose what appears in your feed. We rank posts using who you follow and are friends with, and what you did with posts over the last 30 days: how much of each you watched and whether you watched it again or skipped it, likes, comments, shares, reposts, opening the creator's profile, following from a post, and "Not interested". We also use posts' hashtags and sounds, what our AI reads a post as being about and how well made it looks (see below), how fresh a post is, how posts do with the people they are shown to, what people who liked the same posts as you also liked, and whether the author is in your city. While you scroll, what you do in that session shapes the next posts, and we keep the session's list for 3 hours so either of our servers can carry on from where you are. We also pick which posts to offer the quick repost button on, from how often you and others repost. Posts by Gyvio+ members get a small boost. We do not build a profile of you for advertisers. (Legitimate interest in showing you posts you will enjoy.)
• To caption videos. When you post a video, it is sent to Deepgram, whose speech recognition writes out what's said in it, so the words can be shown over the video as it plays. Only the video's own sound is written out, never a sound added from Sounds. The captions are shown to everyone who can see the video, and anyone can turn captions off for themselves. From the video's options you can correct the words, or hide the captions from everyone. The captions are kept with the post for as long as the post is kept, and the AI described below also reads them to understand what the post is about. (Legitimate interest in making videos easy to follow with the sound off, and for people who are deaf or hard of hearing.)
• To understand posts and comments, and to review reports, with AI. Automated AI models read public posts (their pictures, a few still frames from videos, what's said in videos, the caption, hashtags and sound name) to work out what they're about, well-known public figures in them and the film, show or match a clip comes from, the words someone might search for them by, how well they're made, and whether they may break our Community Guidelines. We use this to rank your feed and search. A post that reads as clearly harmful is kept out of For You and search for people who don't follow its creator until one of our team looks at it. The words of comments are read to put the best first, and to hide abusive comments and spam from everyone except the person who wrote them. Stickers are read (their picture and any words on them) so sticker search can find them, and to keep sexual or hateful ones off the public sticker shelf. When something is reported, AI gives our team a first look: whether it seems to break the rules and why. For reports on chat messages, statuses, letters and Meet, the AI sees only the words, the reason given and, for Meet, your phone's own nudity-check scores: never the pictures, videos or Meet snapshot. It sees the reported account's name, username and bio only when the report is about that account. When our team looks into an account, AI may sum up the figures we keep about it (such as how many posts, which topics, how its posts do, what kinds of posts it watches, reports on it), never its name or anything it wrote. Only famous people (such as musicians, actors, athletes and politicians) are ever named, and only when the AI is sure; it is told never to name or guess anyone else, and no one's face is kept or matched against any list. The AI never takes anything down, bans anyone or changes your account by itself: a person decides. What it read is kept with the post, comment or report, for as long as that is kept. (Legitimate interest in showing you posts you will enjoy and keeping Gyvio safe.)
• To handle payments, cash-outs and Gyvio+, and keep accurate records of every coin that moves. (Needed to provide the service, and legal obligations such as financial record keeping.)
• To set your trust level and limits, which depend on things like your streak, account age, followers and strikes. See limits. (Legitimate interest in preventing fraud and abuse.)
• To keep people safe: reviewing reports, enforcing our Community Guidelines, spotting fake accounts and fraud, and responding to lawful requests. (Legitimate interest, and legal obligation where it applies.)
• To stop coin farming and fraud. Automated checks look at signals such as accounts used on the same device or paid out to the same bank account, money moving between linked accounts, how new the accounts paying someone are, and activity that looks automated. They can send your cash-outs to our team for review and hold rewards while we look, but they never stop you using Gyvio, and a person decides any ban. You can ask a person to look again at anything they affected. See Fraud checks. (Legitimate interest in preventing fraud, and to protect the money of people who use Gyvio.)
• To show sponsored posts, and pay ad rewards. Businesses on Gyvio can promote their posts. We choose who sees a sponsored post or link from the country and interests the business picked and the kinds of posts you watch (their hashtags), and never from your age, gender, what you write in chats or comments or any other private detail. Ads in chats and rooms are chosen without reading your messages, and a link ad's icon is our own copy, so seeing it never contacts the business's website. If you are a Gyvio+ creator with ads switched on, ads can appear in your posts' comments, your profile feed and on your stories, and we record the views there to pay you your share. We record which sponsored posts you were shown, how long you watched and what you did with them, to charge the business only for real views and to pay you ad rewards. Businesses see only totals, with any city under 10 viewers counted as "Other". You can see why you were shown a sponsored post, and hide promotions from any business. (Legitimate interest in running Gyvio's advertising fairly, and needed to pay you rewards.)
• To check your ID before your first cash-out, as described above. (Needed to provide cash-outs, and legitimate interest in preventing fraud.)
• To contact you about your account, for example when a passcode reset is requested. We do not send marketing email from the app.

We do not sell your personal data, and we do not give it to advertisers. Businesses that promote posts on Gyvio see totals only (views, what people did, cities with 10 or more viewers), never who you are.

Meet and calls

Friend calls

Voice and video calls between friends use WebRTC. The sound and picture travel directly between the two phones where the network allows it. When a direct link is not possible, they pass through a relay server run for us (a TURN server), which forwards the encrypted stream without recording it. Our servers only pass along the messages that set up the call. We never record calls.

Because a direct connection is made where possible, each phone can learn the other's IP address (the internet address of the network it is on), as with most video calling apps. This also applies in Meet.

What Meet is

Meet puts you in a live one-to-one video chat with a random adult you do not know yet. To use it you need to be 18 or older, have a profile photo and a gender set, and accept the Meet rules. New accounts may have to wait a few days before they can use Meet.

What the other person sees

Only the first word of your display name (up to 24 characters) and your country, plus your live video and sound. They do not see your photo, username, age, gender or city. If you both tap Add friend within 5 minutes of the chat, you become friends and each of you sees the other's username, display name and profile photo. If only one of you taps it, nothing is revealed.

How we match you

We match you with someone who is waiting and whose filters fit you as yours fit them ("Show me" and "From"). We never match you with someone either of you has blocked, or with someone you were matched with in the last 24 hours. There is no text chat in Meet, and nothing from a Meet chat appears in your chats, notifications or profile.

What is kept when a report is made

Anyone in a Meet chat can report the other person. When you report someone, your phone sends us:

• the reason for the report,
• one still picture of the video you were receiving at that moment (a small, low-resolution JPEG image of at most 80 KB).

The picture is stored privately in our database, not in the media storage used for posts, and only authorised members of our safety team can open them. It is deleted automatically 30 days after it is taken. The report record itself (who reported whom, when, and why) is kept longer, as described under How long we keep it. We also keep a basic record of each Meet chat (who was matched and how it ended) for 30 days.

Reporting someone in Meet also blocks them for you, so you will not be matched again.

We don't scan Meet video automatically today. We may add automated tools to help detect content that breaks our rules in future; if they process your data in a new way, we will update this policy first.

Who we share it with

We share personal data only with the service providers who help us run Gyvio, and only what each needs:

Gyvio's application, database and call relay (TURN) server are run by Salesive Force Ltd itself, on rented servers it also uses for its other products.

If you share a post to WhatsApp or another app, that app receives what you share under its own privacy policy.

Legal requests and safety. We may share data with police, regulators or courts when the law requires it, or when we believe in good faith it is needed to protect someone from serious harm, including the safety of a child. See law enforcement requests.

If Gyvio changes hands. If Gyvio is merged, sold or reorganised, your data may pass to the new owner, who must keep protecting it in line with this policy. We will tell you before that happens.

Where it is stored and how it is protected

Our application servers and database are hosted by Contabo in France. Uploaded files are stored in Cloudflare R2 and delivered through Cloudflare's network, from data centres around the world. Payments are handled by Paystack. The AI models are reached through OpenRouter, in the United States, and run by their providers wherever they operate. Videos are captioned by Deepgram, in the United States. This means your data is processed outside Nigeria, and possibly outside your own country. We apply safeguards consistent with applicable data protection law, including the NDPA, when transferring data internationally, such as contractual protections with these providers.

How we protect it:

• Traffic between the app and our servers is encrypted (HTTPS).
• Your sign-in is kept in a secure, httpOnly cookie that scripts on the page cannot read, and short-lived access tokens are kept only in memory.
• Your spending passcode is stored only as a salted hash, and locks after 5 wrong tries.
• Our team members sign in to a separate admin system with an emailed code and a second factor from an authenticator app. Every change they make is recorded in an audit log.
• Meet report pictures are kept out of public storage and are only visible to authorised staff.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the relevant authority where the law requires.

How long we keep it

Your choices and rights

In the app

• Edit your name, username, photo, bio, city and gender (gender once every 30 days) in your profile.
• Hide your follower and following lists, choose who can see your stories and your posts (and whether your stories can be reshared), and turn off alerts for typing and read messages.
• In Settings › Letters: turn on public letters (anyone can write to you any day; off, only on your birthday), turn off anonymous letters or birthday letters (and with them, your profile saying it's your birthday), choose who can write to you (everyone, your followers, your friends or only people you pick), and list people who can never write to you. People on that list aren't told.
• Put away or report a letter, or stop its writer writing to you. Stopping an anonymous writer doesn't tell you who they are, or them who you are.
• Delete your account, in Settings.
• Turn disappearing messages on or off in any one-to-one chat.
• Delete your posts, comments and messages you sent.
• Block people and report them.
• Turn notifications, camera and microphone access on or off in your phone's settings.

Your rights under data protection law

Under the Nigeria Data Protection Act 2023, you have the right to the things below. If you live outside Nigeria, the data protection law where you live may give you similar rights, and we will honour them as that law requires.

• get a copy of the personal data we hold about you,
• have wrong data corrected,
• have your data deleted,
• object to or restrict some uses of your data,
• receive your data in a portable format,
• withdraw consent you have given, such as for notifications,
• complain to the Nigeria Data Protection Commission (NDPC), or to the data protection authority where you live.

You can delete your account yourself in the app: see Delete your account. There is no download button for your data yet. To use any of the other rights, email support@salesive.com (subject: "Gyvio privacy") from the email address on your Gyvio account. We may need to confirm it is you, and we will answer within the time the law allows.

Gyvio is for adults

You must be 18 or older to use Gyvio. We ask for your date of birth when you sign up and do not create an account for anyone under 18. If we learn that someone under 18 has an account, we will close it. If you believe a child is using Gyvio, please tell us at support@salesive.com (subject: "Gyvio child safety").

This website and the waitlist

This website (www.gyvio.app) does not set cookies and does not use analytics. It loads fonts from Google Fonts. If you joined the waitlist before Gyvio opened, we hold your email address and whether you joined as a user, creator, brand or business. This is stored in Salesive Force Ltd's own systems and used only to tell you that Gyvio is ready for you and about getting started. You can ask us to remove you at any time at support@salesive.com (subject: "Gyvio privacy").

Changes to this policy

When we change this policy, we will update the date at the top. If a change is significant, we will tell you in the app before it takes effect.

Contact us

Salesive Force Ltd
No 1 Eugene Oba Street, Agbani Road, Enugu 400252, Enugu State, Nigeria
Privacy questions and our Data Protection Officer: support@salesive.com (subject: "Gyvio privacy")