Privacy policy

Last updated: 11 November 2026

Joya keeps your wishlists on your phone. They travel to the friends you choose end-to-end encrypted: our server cannot read your lists, items, notes, prices, links, photos, claims or profile. It only sees your username and who exchanges messages with whom.

Who we are

Joya is made by Maximiliano Schulkin. Contact: max@schlk.in.

What stays on your phone

Your lists, items, photos, claims, friends and display name are stored on your device in an encrypted database. Your recovery phrase is shown once and never stored or sent anywhere; your keys are derived from it.

What our server stores

Your account: username, a random account id, your public keys, an account counter that changes when you restore on a new phone, and when the account was created or deleted.
Encrypted messages waiting for a friend's phone to collect them. They are deleted once collected, or after 30 days.
Encrypted photos, deleted once every recipient has downloaded them, or after 30 days.
Login sessions, valid for 24 hours.

The server cannot decrypt messages or photos: the keys exist only on your and your friends' phones.

What our server can see

To deliver messages the server necessarily sees which accounts send messages to which, when, and how large they are, and the IP address of each connection. IP addresses are used only in memory to limit abuse (rate limiting) and are not logged or stored. We do not keep request logs.

Backups

The server database is backed up nightly. Backups are encrypted with a key that is not on the server, kept for 14 days on the server and for 30 days in a separate encrypted copy.

Where

The server runs at Hetzner Online GmbH in Helsinki, Finland (EU).

Sharing

Your lists go only to the friends you share them with. We do not sell or share data with anyone, show no ads, and use no analytics or tracking. The app contains no third-party SDKs that send data. If you allow it in your phone settings, Google may share anonymous crash statistics with developers through Google Play.

Your choices

Change your username or display name in Settings.
Remove or block people at any time; removed people's apps delete their copies of your lists.
Delete your account in Settings → Delete account. See how account deletion works.
Questions, data requests or complaints: max@schlk.in. If you are in the EU you may also complain to your data protection authority.

Children

Joya is not intended for children under 13.

Reporting abuse

Use Report in the app or write to max@schlk.in. Because content is end-to-end encrypted we cannot see it; please describe what happened.

Changes

We will update this page and its date when this policy changes.