Document 1
Huyuka is an end-to-end encrypted messaging and calling app: your personal one-to-one and group messages and calls are unreadable to us. We built it to collect as little as possible about you. One channel is different by design — a shop inbox, the business-messaging channel between a buyer and a shop, is not end-to-end encrypted, so that those messages can be moderated; the app marks this clearly wherever it applies. This policy explains what we do collect, why, how long we keep it, and the narrow circumstances in which we disclose it. It is written to comply with the Philippine Data Privacy Act of 2012 (RA 10173) and, for users in those regions, the EU GDPR, Japan's APPI, and applicable Middle East data-protection laws.
Huyuka (the "Service", "we", "us") is operated by Huyuka based in the Philippines, acting as the Personal Information Controller. Our Data Protection Officer can be reached at dpo@huyuka.com; privacy requests go to privacy@huyuka.com.
Where the GDPR applies, we rely on: performance of a contract (to provide the Service you signed up for), legitimate interests (security, abuse prevention, keeping the Service reliable), consent (optional email; any optional features), and legal obligation (responding to lawful requests). Under the Philippine DPA we process on the equivalent bases of contract, legitimate interest, and legal obligation.
We do not sell your data. We share limited data only with service providers who help us run Huyuka, under contract and only for that purpose:
Because we operate from the Philippines and use providers abroad, your data may be processed in other countries; we rely on the providers' safeguards and, where required, standard contractual protections for international transfers.
Because we require a verified phone number, we can, on valid legal process, tell law enforcement which phone number registered an account — a trail that helps in cases where a user is victimized. We disclose only what we actually hold: we cannot provide the content of personal messages or calls, because they are end-to-end encrypted and unreadable to us. Messages sent through a shop inbox are not end-to-end encrypted and are readable to us; those we could disclose on valid legal process, like any other data we actually hold. Our full approach, including what process we require and how requests are submitted, is in our Law Enforcement Guidelines. Where lawful and not counterproductive to an investigation, we aim to notify affected users.
You may access, correct, or delete your personal data, object to certain processing, and (where GDPR applies) request portability. You can delete your account in-app at any time. To exercise other rights, contact privacy@huyuka.com; we respond within the timeframes the DPA and GDPR require. You may also complain to the Philippine National Privacy Commission (or your local authority).
Huyuka is not intended for children under 13 (or the minimum age of digital consent in your country, where higher — for example 16 in parts of the EU). We do not knowingly collect their data; if we learn we have, we delete it.
Beyond end-to-end encryption of personal messages and calls, we hash passwords, encrypt sensitive data (including phone numbers) at rest, restrict internal access, and run the Service on hardened infrastructure. No system is perfectly secure, but minimizing what we hold is our first line of defence.
We'll post material changes here and, where appropriate, notify you in-app. Continued use after a change means you accept the updated policy.
Document 2
These Terms govern your use of Huyuka. By creating an account you agree to them. If you don't agree, don't use the Service.
You must be at least 13 (or the higher minimum age required in your country) and legally able to agree to these Terms. You must provide a valid mobile phone number and complete verification. You're responsible for activity on your account and for keeping your credentials and recovery phrase safe. One person should not run large numbers of accounts to evade limits or bans.
Huyuka exists so people can communicate safely. You agree not to:
You own the content you create. Because your personal messages and calls are end-to-end encrypted, we can't access their content; you are responsible for what you send. For content that is not encrypted to us (e.g. a public profile or listing, or a message you send through a shop inbox), you grant us the limited licence needed to host, display, and — where applicable — moderate it within the Service.
We operate a reporting, warning, and suspension system. We may warn, restrict, suspend, or terminate accounts that breach these Terms, and we may remove content we're able to act on. Where abuse is serious or unlawful, we may retain relevant account data (such as the verified phone number) and disclose it under valid legal process as described in our Privacy Policy and Law Enforcement Guidelines.
Huyuka is provided "as is" and "as available," without warranties of any kind, whether express or implied. To the maximum extent permitted by law, we are not liable for indirect, incidental, special, or consequential damages, for loss of data, or for content exchanged between users.
To the maximum extent permitted by law, our total aggregate liability for all claims arising out of or relating to the Service or these Terms will not exceed the greater of (a) the amounts you paid us for the Service in the twelve months before the event giving rise to the claim (which is zero for a free account), or (b) PHP 5,000.
Nothing in these Terms limits or excludes liability that cannot be limited or excluded under applicable law — for example, liability for fraud, for willful misconduct, or for death or personal injury caused by negligence. Some jurisdictions do not allow certain exclusions or limitations, so parts of this section may not apply to you; in that case our liability is limited to the smallest amount permitted by law.
To the maximum extent permitted by law, you agree to indemnify, defend, and hold harmless Huyuka and the people who operate it from and against any claims, demands, losses, liabilities, damages, costs, and expenses (including reasonable legal fees) arising out of or related to: (a) content you submit, post, transmit, or otherwise make available through the Service; (b) your use of or activity on the Service; (c) your breach of these Terms; or (d) your violation of any law or of any third party's rights. This obligation survives the termination of your account and of these Terms.
You may stop using Huyuka and delete your account at any time. We may suspend or end access for breach of these Terms or where required by law.
These Terms are governed by the laws of the Republic of the Philippines, without regard to conflict-of-laws rules, and disputes are subject to the courts of Metro Manila, unless a mandatory local law that applies to you provides otherwise.
We may update these Terms; we'll post the new version with a new effective date and, for material changes, notify you in-app.
Document 3
This page explains what data Huyuka holds, what we require to disclose it, and how to submit a request. It reflects our obligations under Philippine law and our commitment to users' privacy and due process.
We cannot provide the content of personal messages or calls. Personal one-to-one and group messages and calls on Huyuka are end-to-end encrypted; we do not possess the keys and cannot decrypt them. No legal order can compel us to produce content we are technically unable to access. Shop-inbox messages are not end-to-end encrypted — the business-messaging channel between a buyer and a shop is readable to us for moderation — and, like other data we actually hold, may be disclosed on valid legal process.
Subject to valid process, we may be able to provide basic subscriber information we hold, which can include: the account's verified phone number and verification timestamp, username, account creation date, the optional email if provided, and limited technical logs (such as recent IP connection records) still within our retention window. The phone number itself identifies a person only through the carrier, which you would approach separately with appropriate process.
Where there is a genuine, imminent risk of death or serious physical harm, we will review an emergency request on an expedited basis and may disclose the limited data necessary to help prevent that harm, consistent with law. Send emergencies to privacy@huyuka.com with "EMERGENCY" in the subject and a description of the risk and the authority making the request.
We aim to notify users of requests for their data before disclosure, so they can seek to protect their rights, except where prohibited by law or a court, or where notice would be counterproductive in a genuine emergency (such as an ongoing threat to a victim).
Send requests to privacy@huyuka.com (attn: Data Protection Officer) on official letterhead, with the legal instrument attached, the specific account identifier, the data sought, and a contact for verification. We may take reasonable steps to authenticate the requesting authority before responding, and we respond within the timeframes the law requires. All requests are received and answered electronically — there is no requirement for the operator to appear in person to receive a request or to produce data.