Your face.
Your privacy.

Updated October 9, 2026. For privacy questions or requests, contact Support@yapslap.xyz.

This privacy policy covers the Yap Slap iPhone game, its online services and yapslap.xyz. It explains information processed for gameplay, optional features, safety and support. Availability depends on your app version, device, account restrictions and region.

Service operator and privacy contact

The service operator is Ihor Sokolov, Carrer del Turó de la Trinitat, 119, Sant Andreu, 08033 Barcelona, Spain. Send privacy questions and requests to Support@yapslap.xyz.

TrueDepth, ARKit and face controls

Yap Slap requires camera access for gesture controls in every battle mode, including local play. After your local face-control agreement and iOS camera permission, Apple ARKit face tracking uses the iPhone TrueDepth camera to provide facial-expression coefficients and head pose. Measurements include jaw opening, lip puckering, cheek puffing, eyebrow raising and lowering, smiling and blinking, and head yaw, pitch and roll. Face processing calibrates controls and turns your movements into game commands. These live measurements are processed temporarily in device memory. We do not store or upload a face mesh, depth map or history of raw ARKit measurements.

The ARKit coefficients read are jawOpen, mouthPucker, cheekPuff, browInnerUp, browOuterUpLeft, browOuterUpRight, browDownLeft, browDownRight, mouthSmileLeft, mouthSmileRight, eyeBlinkLeft and eyeBlinkRight. Head yaw, pitch and roll are derived from ARFaceAnchor.transform; ARFaceAnchor.isTracked indicates tracking quality. Blink values are live measurements and are not saved as calibration thresholds.

We save a derived calibration profile: neutral head yaw and pitch, head-movement ranges and direction, and activation and release thresholds for the supported gestures. This numeric profile is face-derived data, even though it contains no face image or raw measurements. It is stored locally in app preferences (UserDefaults) and, for a signed-in player, the device Keychain so the controls can be reused. A completed training battle can send game commands and its result to confirm progress; this is separate from calibration sync.

We do not use face measurements, calibration profiles, camera images or report screenshots to identify people, for advertising, marketing, behavioral analytics or data mining. We do not send them to RevenueCat or game or website analytics services.

Optional calibration sync and recipients

Sync calibration is off by default and requires a separate in-app opt-in. If you enable it in Settings, we send only the derived numeric calibration profile to your signed-in game account over HTTPS so it can be restored for your controls. Camera permission, the local face-control agreement, training and video consent do not enable this sync.

Synced profiles and consent records are stored in our game database on Contabo hosting in the United States. Contabo provides the hosting infrastructure; authorized service personnel may access this information only to operate the service or handle your request. Opponents do not receive your calibration profile. The separate recipients of optional camera images are described under Live video and Reporting and evidence below.

Face-data retention, withdrawal and deletion

Live facial-expression and head-pose measurements are transient; tracking stops when you choose Withdraw face controls in Settings. Your derived local calibration remains until you reset it or request account deletion. Withdrawing the local agreement does not delete a separately synced server profile; turn Sync calibration off or reset calibration for that. Keychain entries can survive uninstalling the app, so uninstalling alone is not a reliable way to erase calibration. Reset calibration in Settings clears the local profile and its Keychain copy and requests deletion of the synced profile.

A synced calibration profile remains until you turn Sync calibration off, reset calibration or delete your account. Turning sync off keeps your local controls and requests removal of the server profile; when offline, removal is completed after your signed-in device reconnects. Keep the app installed and reconnect to the same account until server deletion is confirmed; reinstalling can lose a pending deletion request. Contact support if you cannot reconnect. Encrypted database backups may retain an older profile for up to 35 days. Before a backup is restored into service, our recovery procedure clears all restored calibration profiles and disables their sync consent; you must opt in again. Raw facial measurements are not in these backups. Report screenshots have the separate seven-day maximum below. Photos recordings remain under your control.

Camera images and local recordings

ARKit also provides ordinary color camera images. These are separate from the numeric TrueDepth face measurements. They can show an identifiable face and may be shared with an opponent or sent as report screenshots only through the separate video and safety choices described below. The app does not request microphone access or transmit microphone audio.

Record fight and Photos

If you turn on Record fight and confirm the system recording request, Apple ReplayKit records the game screen and game audio locally. The microphone and ReplayKit camera overlay are disabled. You can choose to save a completed recording to Photos, which requires permission to add the video. Yap Slap does not automatically upload these recordings to its game server. The recording can include face video displayed on the game screen, including an opponent’s video. Copies you save or share remain in Photos or the chosen service until you delete them and are subject to that service’s terms; account deletion does not remove them.

Accounts and online play

Online features use Game Center identity information, including your player identifier and display name, and Apple identity verification. We also process internal player, device and session identifiers and App Attest security information. We do not receive your Apple ID password.

The service stores information needed for friends, invitations, blocks, matchmaking, game commands, results, ratings, rewards, inventory, purchases and reconnecting to a match. If you enable notifications, we process an Apple push notification token.

Live video and consent

Allowing camera access in iOS does not by itself start video sharing or send safety screenshots. The separate in-app video choice explains sharing your live image with your opponent and, when enabled, sending safety screenshots to our servers before any report.

Both players must be eligible for video and consent before it starts. Ranked requires video consent and readiness to enter; in Casual and friend battles you can decline and play with avatars. Protective hiding or blocking does not erase a ranked result. Video travels over an encrypted WebRTC connection, directly or through our TURN relay according to the match mode. The relay forwards encrypted packets. When safety screenshot capture is enabled, the separate temporary buffer described below is required for video.

Your opponent receives the live image you choose to transmit. Keep personal documents, location clues and other people out of view. The service does not offer a public video feed.

Supported devices can use Apple’s on-device Sensitive Content Analysis to warn about or hide incoming video. Analysis results, warnings, blocks and decisions to continue remain on the device. They are not sent to our servers, logs, analytics or moderation records.

Reporting and evidence

When enabled and consented to, the app sends three screenshots per second from your outgoing camera during an active video battle. The server keeps up to 45 images covering at most the latest 15 seconds in temporary memory. No audio or screenshot files are saved on your device. This sampling begins before a report is submitted. Turning off camera transmission stops both outgoing video and screenshot capture; gesture controls may use the camera locally.

Opening a report hides the opponent’s video on your device and requests available screenshots from the preceding 15 seconds. Your own camera remains enabled until you turn it off. The frozen draft lasts no more than five minutes and is discarded on cancellation or expiry. Sending the report may save encrypted evidence accessible only to authorized moderators, with every read audited. It expires no later than seven days after report creation; retries do not extend expiry. A report does not automatically block the opponent, and cancelling or failing to send it does not reveal the hidden video. Images are excluded from ordinary backups. Samples may have gaps and are not proof of exactly what the recipient saw. You can report without screenshots.

A report also contains the selected reason, the match and player references, and its moderation status. An appeal contains your statement and the decision it concerns. These records help review complaints, explain restrictions and handle appeals. The screenshot limit does not mean that the associated complaint or decision disappears at the same time. Do not put passwords, payment information or unrelated personal details in a report or appeal.

Purchases

Apple handles billing and payment-card information. Yap Slap processes signed transaction information, product identifiers and entitlement status to verify purchases, restores, refunds and reversals.

In versions using RevenueCat, our purchase service provider receives the internal game-account UUID, Apple purchase and transaction information, product identifiers, and app/device platform information to process purchases, synchronize purchase records and provide purchase analytics. Billing remains with Apple; game balances and inventory remain on Yap Slap's servers. We do not send RevenueCat your Game Center display name, contacts, face data, camera images or advertising identifier. See RevenueCat's privacy policy.

A purchase is linked to the signed-in game account so that currency and hero entitlements can be delivered and duplicate transactions do not grant the same purchase twice. We do not receive your complete payment-card number or Apple Account password.

Operation and security

We process technical information such as IP addresses, request identifiers, timestamps, software versions and security events to operate the game, prevent abuse and diagnose problems. Logs are designed to exclude access tokens, raw face data and ordinary battle video. We do not sell player data or use it for cross-company advertising tracking.

Apple processes information for Game Center, App Attest, notifications, purchases and platform safety under its own terms. Hosting infrastructure and authorized support or moderation personnel process information needed to operate the service. Information may also be disclosed when legally required.

Messages to support

If you email us, we receive your email address and the message, technical details and attachments you choose to send. We use them to respond, investigate the issue and handle account, privacy or safety requests. We may ask for limited information to verify account ownership. Do not send Apple passwords, verification codes or payment-card details.

Retention and your choices

Optional game analytics

Where enabled, you can opt in after signing in to Game Center using Help improve Yap Slap in Settings. Collection also requires a recent Game Center indication that the account is not underage; this is not proof of being 18 or older. We collect selected game actions, progress, session and account identifiers, app build, and confirmed purchase or reward outcomes in our own service. No external game analytics SDK is used. Camera images, face measurements, safety analysis, report contents, payment receipts and access tokens are excluded from these events.

Linked behavior is retained for up to 90 days and anonymous statistical summaries for up to 13 months. An account-bound device queue is limited to seven days and 2 MiB. Turning analytics off stops collection on that device immediately. Once our server receives your withdrawal, linked history becomes inaccessible and is scheduled for deletion within 24 hours. An offline withdrawal is sent when you reconnect while signed in to that account. Signing out clears the device queue. Re-enabling analytics does not restore deleted history. Required financial and security records have separate purposes and are not removed by analytics withdrawal. Individual behavior history is accessible only to the service owner and access is audited.

Website analytics

With your consent, this website uses Google Analytics to measure page views, traffic sources and interactions such as scrolling and outbound link clicks. Google receives technical information about your browser and device and uses analytics cookies. These website measurements do not include in-game face controls or opponent video. Advertising personalization and Google signals are disabled.

Analytics is off until you accept. Use Cookie settings in the footer to decline or withdraw consent; this disables measurement and removes this website’s Google Analytics cookies. We remember your choice in your browser for up to 180 days. Learn more about Google’s privacy practices.

Game data and choices

Sessions expire or are revoked when you sign out or request account deletion. A deletion request covers personal progress, game currency, inventory, bags, quests, settings and outgoing social connections. The retention policy preserves the other player’s settled match result and their block or hidden-video choice until they remove it or delete their account, including if you create a new profile. See the current availability notice below.

Where applicable accounting law requires it, we retain the minimum purchase and refund accounting records for six years from the last accounting entry. These may include transaction identifiers, product, monetary amount and currency, dates and refund status. Proof of a purchased hero is kept while the entitlement remains valid so that it can be restored and a refund can be respected. This does not preserve your deleted game progress or spendable currency.

Our retention policy treats open complaints, appeals and active safety restrictions separately. You may appeal within six calendar months of the first decision. Closed case records are due for deletion 90 days after the later of that deadline or the final decision, once no appeal or active sanction remains. A timely appeal stays open until it is resolved. Closed cases without a decision, sanction or appeal are due for deletion 90 days after closure. Active sanctions are retained until they expire or are revoked; indefinite sanctions are subject to annual review. Report screenshots still have the seven-day maximum described above.

You can play offline, decline video in Casual and friend battles, change camera and notification permissions in iOS Settings, block or report a player, restore purchases, disconnect online play or request account deletion. You can ask support for access, correction or deletion of your information, or to exercise other rights available to you. Depending on your location, these may include a copy of your data, limits on its use, withdrawal of consent and a complaint to the relevant privacy authority. Withdrawing optional consent does not undo processing that already occurred; it stops the affected optional feature as described here.

Hiding an opponent without reporting stops video in both directions for that account pair. This saved choice applies to later encounters until removed, but does not prevent another Casual or Ranked match or request evidence. Blocking a player prevents subsequent Casual and Ranked matches between the pair in either direction until the block is removed. An already started match continues with avatars and keeps its mode and result for both players. These protective actions are not a surrender. Reconnecting does not reveal hidden video, and manual show controls cannot override an active automatic safety restriction.

Voluntarily withdrawing your own required transmission after a Ranked battle starts is a separate action that can result in a loss. A technical interruption is not a voluntary withdrawal. Removing camera permission prevents gesture-controlled play.

How to request account deletion

Current availability: automatic completion tracking and a new profile after deletion are not yet active on the public service. An accepted in-app request disables access; signing out does not confirm complete deletion. Contact support for your request’s actual status before trying to register again.

While connected to your Game Center profile in the app, open Settings, expand Account, choose Delete player account and confirm. If you cannot access that screen, email Support@yapslap.xyz for help with an account deletion or data request. Include your in-game display name and a description of the access problem; do not send your Apple sign-in credentials.

For the upcoming release, the deletion policy provides up to 24 hours for processing, a saved request confirmation and completion status, and access to that confirmation for 35 days after completion. It covers device registrations, attestation keys, push tokens, friends, invitations and linked game analytics as well as personal progress. The release will allow a new, empty Game Center profile after completed deletion and restoration of an eligible purchased hero through Apple. Deleted progress, currency and earned rewards will not return. Deleting during an active Ranked battle will count as a loss, preserving the other player’s settled result.

Limited financial and safety records follow the retention rules above. Backup copies follow a separate retention schedule; contact support about the copies affected by your request. The retention policy keeps a deletion recovery record until all affected backups and archives are destroyed, plus 35 days, so deletion can be reapplied after a restore. Completion of a game-profile request does not certify erasure of every retained accounting or backup record. This does not delete your Apple Account, Game Center account or recordings saved to Photos. Uninstalling the app or disconnecting online play does not request server-side deletion, and deleting an account does not itself request an Apple refund. Contact support for help with your request or retained information.

Family and platform restrictions

Yap Slap uses Apple’s Declared Age Range with thresholds of 13 and 18 before online account registration, online play or purchases. You can inspect or retry the check using Age eligibility in Settings. We store an age category, the signal source, relevant restrictions and receipt time linked to your account and device. We do not request or store your date of birth. A declined, failed or unknown age signal does not grant access to online features. Game Center’s “not underage” status alone does not establish age eligibility.

Eligible players aged 13–17 can stream and join the same Ranked queue as adults, subject to platform restrictions and necessary parental and regional permissions. Players under 13, or with an unknown age, can play locally without an online profile; online play, video and purchases are unavailable. Declared Age Range does not replace required parental consent. If a necessary permission cannot be established, video stays unavailable. The in-game threshold is separate from the App Store age rating and availability in each country.

The current app does not provide a separate process for obtaining verifiable parental consent. An age-range response, parental download control or purchase approval is not by itself consent to all of the online collection described here. Where parental consent is required, it must be established before the affected collection or feature is used.

Local camera processing is different from online collection: eligible avatar-only multiplayer still uses account, device and gameplay information. A parent or guardian can contact Support@yapslap.xyz to ask about a child’s information, request access or deletion, or ask to stop further collection where applicable. We may need to verify the relationship and the account before disclosing information. Do not send a child’s identity document or date of birth with an initial request.

Contact and changes

Send privacy or security questions to Support@yapslap.xyz. We will update this page when our data practices change. See also our terms and fair-play information and our support instructions.