Privacy Policy

Last updated October 17, 2026

BWYA (“Bitch, where you at?”) helps two friends find each other in person. It's made by Rostyslav Dzhohola (“we”, “us”), an individual developer in Texas, USA. This policy covers the BWYA iPhone app, including beta builds on Apple's TestFlight, and this website. Contact: support@bitchwya.app (or rosty.build@gmail.com).

What stays on your phone

• Your first name. You type it in during setup. It goes only to your friend's phone, inside an encrypted message when you pair.
• Your location. While you're in a session, BWYA uses your precise location, including in the background, to point you at your friend and to share it with your friend's phone, encrypted. It leaves your phone only that way and only while you're sharing.
• Motion, compass, Bluetooth and ultra wideband readings. Used on your phone to point the arrow and measure the distance to your friend.
• Camera. On iPhones that need it, Apple's camera assist helps point at your friend up close while the app is open. Nothing is recorded or leaves your phone.
• The session. The keys made when you pair, your friend's name, when sharing ends and your friend's last-known spot are kept in your iPhone's Keychain, on this device only and never synced to iCloud. BWYA deletes them when the session ends.
• A diagnostic log. The app keeps a technical log on your phone (the most recent 14 days, up to 20 MB): how the radios, sensors and connection behaved, including the distance and direction measured to your friend's phone, GPS accuracy and speed, and battery level. It holds no coordinates, names or keys. It stays on your phone unless you send it (see Send logs).

What goes between your two phones

Your positions, Buzzes and changes to your sharing travel straight between the phones over Bluetooth when you're close, and through our server when you're apart. Either way they're encrypted on the sending phone (AES-GCM, with keys agreed in person using X25519 and HKDF through Apple's CryptoKit), and only your friend's phone can open them. The keys never leave the two phones.

What our server sees

Our relay server is hosted by Railway. For each session it holds, in memory only:

• Each phone's latest position and a short queue of Buzzes and sharing changes, all encrypted. It can't read them.
• Each phone's Apple push token, so it can wake your friend's phone when you start looking. The push carries nothing about you.
• Random session identifiers derived from your pairing, so it knows which two phones belong together.

The encrypted data and push tokens are deleted as soon as the session ends. If that message never arrives, everything is deleted 25 hours after the session started. A small marker that the session ended stays for 10 more minutes so the other phone hears about it. Nothing is written to disk, and the server keeps no history of where anyone has been.

The server also sees what it can't help seeing: when and how often a phone sends, how large the encrypted data is, the app's build number, and the IP address of a request, which it uses only in memory to limit abuse and does not store or write to its logs. Its technical logs record the route, response time, an anonymous session tag and the app build, never positions, names, push tokens or IP addresses. Railway, as our host, may keep its own standard network logs.

Send logs

If you tap Send logs, BWYA opens an email to us (or your share sheet) with the diagnostic log described above attached. Nothing is sent unless you send it. We receive the email address you send it from, and use the log and your address only to fix problems and reply to you. In beta builds the email's subject also includes your first name, so we can tell testers apart; the App Store version leaves it out. Ask us and we'll delete what you sent.

Beta builds (TestFlight only)

Beta builds on TestFlight also upload diagnostics to our server automatically: up to the last three hours of the diagnostic log, a recording of motion-sensor and radio readings, battery level, phone model, app build and a random ID for that install. They never include coordinates, names, keys, tokens or pairing codes. Uploads are kept in a private folder and deleted after 30 days; the developer may download copies to study them and deletes them on request. TestFlight feedback and crash reports reach us through Apple. The App Store version does none of this.

This website

This site uses no cookies, analytics or ad trackers. Our host, Vercel, keeps standard server logs, such as IP addresses and pages requested, to run and protect the site. If you email us, we use your address only to reply.

Who else is involved

• Apple: the App Store, TestFlight, maps, and the push service that wakes your friend's phone.
• Railway: hosts our relay server.
• Vercel: hosts this website.

We don't sell or rent your data, share it with advertisers or data brokers, or use it to track you.

Your choices and rights

• Pick how long you share when you pair, and stop sharing any time.
• Turn off location, Bluetooth or notifications in Settings; BWYA tells you what stops working.
• Delete the app to remove its data. iOS can keep an app's Keychain items after the app is gone; if you reinstall, BWYA clears a session that has ended.
• Ask us at support@bitchwya.app (or rosty.build@gmail.com) what we hold from you (normally nothing, or logs you emailed us), or to delete it. Depending on where you live, including California, you may have further rights, and we'll honour them.

Children

BWYA is for people 13 and older. We don't knowingly collect data from children under 13. If you think a child has sent us something, tell us and we'll delete it.

Changes

If we change what BWYA collects, we'll update this page and the date at the top before the change reaches the app.