Privacy Policy

1. What YUWAI Is

YUWAI is an Android notification management and DM-lock application built by Dreydan Software. It allows users to filter, mask, schedule, and protect notifications from messaging and social apps on their device. YUWAI also provides a DM lock feature that blocks access to direct message screens in Instagram, WhatsApp, and Messenger until a PIN or biometric verification is completed.

This Privacy Policy applies specifically to the YUWAI Android app.

2. What YUWAI Accesses and Why

Notification Access (NotificationListenerService)

YUWAI uses Android's NotificationListenerService to intercept notifications from apps the user selects to monitor. This permission must be granted manually by the user in Android system settings. YUWAI reads the notification content (such as the sending app, sender name, message preview text, and notification category) and uses it to perform its core functions: filtering notifications by app, masking sender names and message content when privacy mode is active, silencing notifications during scheduled DND windows, and displaying custom overlay notifications.

Accessibility Service (DM Lock)

In everyday life, people often hand their phone to a friend, family member, or colleague to share a photo, show a video, or let them use a social app. The DM Lock feature exists so that users can comfortably hand over their phone without worrying that the other person will open their private direct messages. By requiring a PIN before any direct-message screen can be viewed, YUWAI lets users share their device for casual use while keeping their personal conversations from being seen or read by anyone they do not choose to trust. It is a privacy safeguard designed for real, shared-device moments.

YUWAI uses an Android AccessibilityService to power its DM Lock feature. When the DM Lock feature is enabled by the user, the service monitors which screen is currently open in Instagram, WhatsApp, and Messenger by reading the on-screen UI structure (view hierarchy) of those apps. It looks for standard, static screen elements — such as inbox labels and message-composer fields — to determine whether the user is viewing a direct-message inbox or an open conversation thread.

When a direct-message screen is detected, YUWAI displays a full-screen overlay that blocks the content and requires the user to enter their PIN before the direct message can be viewed. When the user dismisses the overlay, the service performs a system-level back navigation (the Android "back" gesture) to return the user to the app's main feed. This is the only action the service takes on the host app; it does not tap buttons, type text, or modify any content.

The accessibility service does not read message text, conversation content, contact names, or any personal data from the host apps. It only inspects the structure of the screen to identify the type of screen (feed, inbox, or thread). All verification and overlay logic runs locally on the device.

Foreground Services

YUWAI runs the following foreground service when its related feature is enabled by the user:

• Overlay service — manages the display of custom overlay notifications and resets overlay state when the screen turns off.

YUWAI's notification interception uses Android's standard NotificationListenerService, which is kept active by the Android system while the user has granted the permission. It does not run a separate background service to keep itself alive.

Other Permissions

• Internet — used solely for loading advertisements (Google AdMob) and for Firebase Authentication and Firestore (account and subscription data).
• Boot completed — declared in the app manifest so the app can restart its notification features after a device reboot; in the current version, Android automatically restores notification interception when the device reboots, provided the user has granted the notification-listener permission.
• System alert window — required to display the custom overlay notification on top of other apps.
• Post notifications — required on Android 13+ to show the app's own notification-management UI and replacement notifications.
• Request ignore battery optimizations — used to request that the device not restrict YUWAI's background service, ensuring reliable notification interception.

3. What YUWAI Does Not Access

YUWAI does not access the following:

• Device identifiers (IMEI, Android ID, serial number)
• Location data (GPS, network-based, or otherwise)
• Contacts, call logs, or SMS messages
• Camera, microphone, or media files
• Calendar, phone state, or biometric data (the accessibility service does not read or store biometric information)
• Any data from apps the user has not selected to monitor

4. How Notification Data Is Handled

In-Memory Processing Only

When YUWAI intercepts a notification, it processes the notification data entirely on the device. The data is held in an in-memory cache (capped at 500 entries) that is used to track recently seen notifications and to restore them when a DND window ends or when the user taps to reveal a protected notification.

This in-memory cache is not written to disk, shared with other apps, or backed up. It is cleared automatically when the app process is killed or when the device restarts.

No Transmission to External Servers

YUWAI does not transmit notification content, sender names, message text, app names, usernames, or any other notification data to Dreydan Software, to Firebase, or to any third-party server. There are no analytics, crash reporting, or telemetry SDKs in YUWAI. The only network connections YUWAI makes are:

• Firebase Authentication (for Google sign-in)
• Firebase Firestore (for storing account profile and subscription status)
• Google AdMob (for loading advertisements)
• Google Play Billing (for processing subscription purchases)

None of these services receive notification data.

What YUWAI Does With Notification Data

YUWAI uses intercepted notification data for the following purposes only:

• Filtering — hiding non-messaging notifications (progress, media, status) from the notification shade.
• Privacy masking — replacing sender names and message text with filtered placeholders in the notification shade when privacy mode is enabled.
• Do Not Disturb scheduling — silently holding notifications during user-defined time windows and restoring them when the window ends.
• Notification protection — replacing notifications with a PIN-protected or biometric-protected notification that hides the content until verified.
• Custom overlay display — rendering notifications in a custom overlay UI instead of the standard notification shade.

5. What Data Is Stored Locally

YUWAI stores the following data locally on the user's device using Android SharedPreferences. This data never leaves the device:

• User preferences — which apps to monitor, privacy mode settings, DND schedule slots, notification styling, and overlay preferences.
• PIN and lock settings — a non-reversible representation of the user's PIN for the notification lock and DM lock, stored locally on the device. The PIN is never stored in plaintext.
• Account information — Google display name, email, profile photo URL, and Firebase UID, stored locally for the signed-in user session.
• Subscription state — whether the user has an active premium subscription, stored locally and mirrored in Firebase Firestore (under the user's account) so purchases can be restored across devices.
• Per-app privacy preferences — the privacy mode setting for each monitored app (hide message, hide sender, or hide both).
• Instagram DM studio drafts — locally saved draft messages for the DM studio feature.

None of this data is accessible to other apps on the device (except by root access or device backup, both of which are outside YUWAI's control).

6. Account and Authentication

YUWAI offers optional Google sign-in using Firebase Authentication. When a user signs in:

• A Firebase Authentication account is created using the user's Google credentials.
• A user profile document (email and registration date) is stored in Firebase Firestore under the user's Firebase UID.
• The user's display name, email, profile photo URL, and Firebase UID are stored locally on the device in SharedPreferences.

YUWAI does not collect or store any Google account data beyond what is shown above. Users may use the app without signing in, in which case no data is sent to Firebase.

7. Third-Party Services

YUWAI integrates the following third-party services:

• Firebase Authentication — Google sign-in. Operated by Google LLC. Firebase Privacy Policy.
• Firebase Firestore — cloud database for storing user profiles and subscription records. Operated by Google LLC. Firebase Privacy Policy.
• Google AdMob — serves banner, native, and rewarded advertisements. AdMob may collect device advertising identifiers for ad personalization. Users may opt out of personalized ads in their Google account settings. Google Privacy Policy.
• Google Play Billing — processes subscription purchases. Operated by Google LLC. Google Privacy Policy.
• Google User Messaging Platform (UMP) — manages GDPR consent for ad serving. Does not collect data independently. Google Privacy Policy.

YUWAI does not use analytics SDKs, crash reporting tools (no Firebase Crashlytics or equivalent), or any other third-party services beyond those listed above.

8. Children's Privacy

YUWAI is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

9. Data Retention

• Notification data — held in memory for up to 500 entries; automatically discarded when the app process ends or the device restarts. No notification data is retained on disk or in the cloud.
• Local preferences — retained on the device until the user clears app data or uninstalls YUWAI.
• Firebase account data — retained until the user requests deletion (see section 10).

10. Data Deletion

Users may delete their YUWAI account and all associated cloud data at any time:

• In-app: Open YUWAI → Settings → Account → Delete Account. This immediately removes your Firebase profile, subscription record, and Firebase Authentication account.
• Web: Visit dreydan.pages.dev/delete-account and submit a deletion request.

Data stored locally on the device (preferences, in-memory caches) is not affected by account deletion and is removed only when the app is uninstalled or its data is cleared through Android settings.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

Email: dreydan.dev@outlook.com

Studio: Dreydan Software

Website: dreydan.pages.dev