EDYOU Legal

Privacy Policy

EDYOU Phase 1 Privacy Policy · Effective August 17, 2026 · Last updated August 17, 2026 · Version 1.0

This Privacy Policy explains how EDYOU LLC collects, uses, discloses, retains, protects, and deletes personal information in connection with the EDYOU Phase 1 iOS application and related support pages (the “Service”).

1.Who We Are and Scope

EDYOU is operated by EDYOU LLC (“EDYOU,” “we,” “us,” or “our”).

Business and legal-notice address: 399 West Neck Road, Lloyd Harbor, New York 11742.

General support, privacy, and safety email: social@edyouapp.com.

EDYOU Phase 1 is a verified college-student social application for eligible users in the United States. Phase 1 does not include paid marketplace or transactional functionality.

2.Eligibility and Age

You must be at least 18 years old, able to form a binding contract, actively enrolled at an approved United States college, university, community college, or other approved postsecondary institution when you create your account, and lawfully entitled to use the college-issued .edu email address used for verification.

EDYOU does not collect or store your exact date of birth in Phase 1. During registration, you must affirmatively confirm that you are at least 18 years old and that you are currently enrolled at an eligible institution. EDYOU uses Apple’s privacy-preserving Declared Age Range capability to request an age range rather than an exact birthdate. If the age information available to EDYOU indicates that you are under 18, you may not create or maintain an EDYOU account.

EDYOU does not knowingly permit anyone under 18 to create or maintain an account. If we learn that an account belongs to a person under 18, we may suspend or delete the account and associated information, subject to lawful safety, evidence-preservation, and record-retention requirements.

A user who later graduates may be permitted to retain an account and may be identified as an alumnus, graduate, or former student. EDYOU may investigate suspected fraud, impersonation, unauthorized use of a college email address, or misrepresentation of age, identity, school, or enrollment.

3.Information We Collect

Registration, Eligibility, and Profile Information

• College-issued .edu email address and related verification status.
• Required 18+ and current-student affirmations and an Apple-provided age-range eligibility result. EDYOU does not collect or store your exact date of birth in Phase 1.
• Selected school and verified school affiliation.
• Username, display name, biography, and profile photograph.
• Internal account/user identifiers and authentication references used by Amazon Cognito.

Passwords are handled through Amazon Cognito. EDYOU does not intentionally store plaintext passwords.

User Content and Social Activity

• Image posts and UClips/short-form videos.
• Captions, accessibility descriptions, visibility settings, and comments.
• Likes and other engagement, follows, saves, shares, leaderboards, referrals, and related social activity.
• Reports submitted about content or users and moderation/enforcement records.

Device, Technical, Security, and Diagnostic Information

• Apple Push Notification service (APNs) device token when notifications are enabled.
• Installation identifier, app environment, user agent, request identifiers, and operational telemetry.
• Source IP address in security/audit context and service or network logs.
• Security and administrator audit events.
• Server-side error logs, metrics, and operational diagnostics. Apple may separately provide diagnostics according to the user’s device settings.

Usage and First-Party Analytics

EDYOU collects first-party product and feed events used to operate, secure, measure, and improve the Service, including app opens, feed impressions/pages, content opens and playback milestones, engagement actions, shares, notification activity, and similar first-party usage events.

Information Not Collected in Phase 1

• Exact date of birth.
• Direct or group message content because messaging is not part of Phase 1.
• Precise or approximate device location through an iOS location permission.
• Contacts, calendar, Bluetooth, health, motion, or fitness data through device permissions.
• Identifier for Advertisers (IDFA) for advertising or cross-company tracking.

4.How We Use Information

• Create, authenticate, verify, secure, and administer user accounts.
• Determine age eligibility and confirm college/student eligibility.
• Provide profiles, feeds, social interactions, leaderboards, referrals, and other Phase 1 features.
• Store, process, display, transcode, deliver, and moderate User Content.
• Deliver in-app and optional push notifications.
• Provide reporting, blocking, content-safety, moderation, appeals, and enforcement.
• Measure and understand product usage through first-party analytics.
• Detect, prevent, and investigate fraud, abuse, security incidents, and technical problems.
• Provide support, comply with law, respond to lawful requests, preserve evidence when specifically required, and establish, exercise, or defend legal claims.

5.How We Share Information

EDYOU does not sell personal information, share personal information with data brokers, or use personal information for cross-company behavioral advertising in Phase 1.

EDYOU may disclose information only as reasonably necessary for the following purposes:

• Service providers that process information on EDYOU’s behalf to provide authentication, email delivery, hosting, database, storage, content delivery, media processing, notifications, content moderation, logging, security, and related operations.
• Other verified users, to the extent you choose to make profile information or User Content available through EDYOU’s audience and visibility settings.
• Legal, safety, security, and enforcement purposes when EDYOU reasonably believes disclosure is necessary to comply with law or legal process, enforce agreements, investigate fraud or security issues, or protect rights or safety.
• Business transfers involving a merger, acquisition, financing, reorganization, or sale of assets, subject to applicable privacy obligations.

6.Service Providers

Current Phase 1 infrastructure and service providers include Apple and Amazon Web Services (AWS). EDYOU uses:

• AWS Amplify Swift and Amazon Cognito for authentication and email verification.
• Amazon Simple Email Service (SES) for transactional and verification email.
• Amazon Aurora PostgreSQL for database services.
• Amazon ECS / AWS Fargate for application hosting.
• Amazon S3 for object and media storage and Amazon CloudFront for content delivery.
• Amazon SQS and SNS for queues and messaging infrastructure, and Amazon DynamoDB where used by production services.
• AWS Elemental MediaConvert for media processing.
• Amazon CloudWatch for logging and metrics and AWS Secrets Manager for secrets management.
• Apple Push Notification service (APNs) for push notifications.
• AWS-managed content-safety and moderation services for the production screening pipeline.

EDYOU requires service providers to process personal information consistently with their contractual obligations and applicable privacy and security requirements. EDYOU’s App Store privacy disclosures are intended to reflect data collected by EDYOU and its integrated third-party services.

7.Device Permissions

EDYOU requests device permission only when you attempt to use the related feature: camera access for profile photographs, image posts, or recording a UClip; microphone access for UClip audio; photo-library access for selecting media; and optional notification permission for push notifications.

Declining an optional permission does not prevent use of unrelated features.

EDYOU Phase 1 is not configured to request device location, contacts, calendar, Bluetooth, health, motion, or fitness permissions.

8.Tracking and Advertising

EDYOU Phase 1 is not configured to access IDFA, present an AppTrackingTransparency prompt, track users across other companies’ apps or websites, combine EDYOU data with outside data for targeted advertising, share personal information with data brokers, or sell personal information.

9.Content Visibility

Information you choose to make available through EDYOU, such as profile fields and User Content, is shared with the verified audiences permitted by the Service and the visibility controls you choose. EDYOU is designed as an authenticated college community; ordinary User Content is not intended to be openly searchable by the general public.

Other users may capture, save, quote, or share content outside EDYOU. EDYOU cannot control screenshots, recordings, downloads, or redistributions made by another user or third party.

10.Data Retention, Content Expiration, and Legal Holds

EDYOU follows a data-minimization approach. The default is deletion rather than indefinite archival. User Content is retained only for the period selected by the user or until the user deletes it, subject to narrow legal, safety, security, moderation, or evidence-preservation exceptions.

• 24-hour posts and videos. EDYOU removes the content from active display at expiration and permanently deletes the active database record and associated S3 media as part of the expiration process, subject only to a specific legal hold or required preservation obligation.
• 7-day posts and videos. EDYOU removes the content from active display at expiration and permanently deletes the active database record and associated S3 media as part of the expiration process, subject only to a specific legal hold or required preservation obligation.
• User-deleted posts, photos, and videos. EDYOU removes them from active display promptly and permanently deletes them from active systems as soon as technically practical.
• Content designated “permanent.” EDYOU retains it until the user deletes it, the account is deleted, or EDYOU removes it under the Terms or Community Guidelines.
• Account deletion. Account access is disabled through the deletion process, and associated active User Content and personal information are deleted or permanently de-identified as soon as technically practical, generally within 30 days, except for narrowly retained records described below.
• S3 media, thumbnails, and processing derivatives. EDYOU deletes them when the underlying User Content is deleted or expires. The deletion process is designed to prevent orphaned media files from remaining in active storage.
• CloudFront/CDN copies. EDYOU invalidates them or allows them to expire as part of the deletion process.
• Backups containing deleted content. EDYOU maintains only a rolling backup cycle and ages deleted content out within 30 days. Deleted content is not restored to active use except for disaster recovery or a specific lawful preservation requirement.
• Application and security logs. EDYOU retains them for 90 days unless a longer period is specifically required for an active security investigation, dispute, or legal hold.
• User-linked analytics. EDYOU retains them for up to 90 days and then deletes or permanently de-identifies them so the information is no longer reasonably linked to an identifiable user.
• APNs tokens and device-linked notification records. EDYOU deletes or disassociates them as part of account deletion and token invalidation processes, except for short-lived technical cleanup records.
• Moderation and report evidence. EDYOU retains it for 12 months after the related case is closed unless a longer period is required for an active safety matter, dispute, law-enforcement preservation request, or legal hold.
• Account-deletion completion records. EDYOU may retain a minimal record showing that deletion was requested and completed for 7 years for audit, dispute, and compliance purposes. This record does not include the deleted user’s posts, photos, or videos.
• Terms, Privacy Policy, and Community Guidelines acceptance records. EDYOU may retain minimal acceptance records, including account identifier, document/version, acceptance action, and timestamp, for 7 years for contract and audit purposes.
• Legal holds. Only records specifically identified as relevant to an actual legal, safety, regulatory, or preservation matter are placed on hold. Those records are retained only until the hold is released or the applicable legal obligation ends, after which the ordinary deletion schedule resumes.

EDYOU may preserve a restricted copy of specific information when required by law, a valid legal hold, a law-enforcement preservation request, a safety investigation, a DMCA or TAKE IT DOWN matter, or another documented legal obligation. A legal hold is an exception to EDYOU’s ordinary deletion rules and is not a basis for retaining all user content indefinitely.

11.Access, Correction, and Account Deletion

Users can review and update available profile information through account controls and can remove User Content using available content controls.

EDYOU provides an in-app method to initiate permanent account deletion without first requiring a telephone call or support email. The deletion process may require reauthentication and final confirmation.

When an account is deleted, EDYOU deletes the account and associated personal data and User Content that EDYOU is not legally required to maintain. This includes user-generated photos, videos, text posts, and related account content. Limited audit, security, moderation, or legal records may remain only as described in Section 10.

Users may also contact social@edyouapp.com with privacy questions or requests.

12.Security

EDYOU uses reasonable administrative, technical, and organizational safeguards designed to protect personal information. Current technical controls include encrypted transport using HTTPS/TLS, encryption at rest for core AWS database and object-storage services, access controls, and logging.

No method of electronic transmission or storage is completely secure. EDYOU cannot guarantee that unauthorized access, loss, or misuse will never occur.

13.Users Under 18

The Service is intended only for individuals age 18 or older. EDYOU does not knowingly permit persons under 18 to maintain accounts. If we learn that a person under 18 has created an account, we may suspend or delete the account and associated information, subject to applicable legal preservation requirements. If you believe a person under 18 is using EDYOU, contact social@edyouapp.com.

14.United States State Privacy Rights

Depending on where you reside, applicable United States state privacy laws may provide rights concerning your personal information, which may include rights to access, correct, delete, or obtain a copy of certain personal information and rights to appeal certain privacy-request decisions. EDYOU does not sell personal information or use personal information for cross-company behavioral advertising in Phase 1.

To submit a privacy request, contact social@edyouapp.com. EDYOU may take reasonable steps to verify your identity and authority before fulfilling a request, as permitted by applicable law. EDYOU will not unlawfully discriminate against a user for exercising applicable privacy rights.

15.Changes to This Policy

EDYOU may update this Policy when reasonably necessary. The updated version will display a new Last Updated date and version identifier. EDYOU will provide reasonable notice of material changes and will seek renewed affirmative acceptance when appropriate. Changes apply prospectively.

16.Contact Us

For immediate danger, contact emergency services. EDYOU is not an emergency-response service.