Yalape
ES

Legal

Privacy policy

Last updated: August 18, 2026

1. Introduction

Yalape is an Android app that helps you know whether a payment arrived. It does one thing:

  • It reads notifications from your payment apps (Yape and the apps from BCP, Interbank, BBVA, Scotiabank and Banco de la Nación, where Plin payments also land), recognises the ones that are an incoming payment, and records them in a local history with amount, time, who paid and which rail.
  • It groups whoever pays you. The same person arrives spelled differently depending on the rail, so you can create a contact and link those forms of the name to it.
  • It summarises your payments as statistics: how much came in, when and from whom.

Yalape is not a wallet and does not move money: it makes no payments or transfers and does not access your bank accounts. It only reads the alert the payment app already showed you in the notification tray. It only reads the payment apps you turn on — no messaging, no email, no social media.

2. Core principle

Your payments never leave your phone on our account. We have no servers that receive, store or process your payments, your contacts or the text of your notifications. All processing happens locally on your device.

The only exception is one you open yourself and is described in section 6: optional forwarding to your own server. It ships off, with no destination configured.

3. System permissions and their purpose

  • Notification access (NotificationListenerService): essential. It is what allows reading the payment alerts from your payment apps. From each notification we read only the app name, the title, the text and the time.
  • Push notifications (POST_NOTIFICATIONS): to tell you if the app stops recording payments, and to report the result of a backup.
  • Foreground service: keeps the notification reader alive so payments are not missed while the app is closed. It is the permanent, silent notice you see in the tray.
  • Internet: for sign-in, the subscription, ads and — only if you configure it — forwarding to your own server.
  • Biometrics: optional, to lock the app with fingerprint or PIN.

We do not request access to phone contacts, location, camera, microphone, external storage or call logs.

4. Data handled locally

All of this lives in the app's private storage, on your device:

  • Detected payments: amount, currency, the payer name exactly as the payment app wrote it, date and time, source app and rail (Yape, Plin or other).
  • Captured notifications: the original notification text, stored as it arrived. It exists so we can re-interpret it when detection improves, and so a payment that went unrecognised can be diagnosed. It never leaves the device and is not included in backups either. It is deleted automatically after 60 days.
  • Contacts you create: name, phone and note, if you choose to add them. They may contain a third party's phone number, and precisely for that reason they are never synced: they travel only in the backup you generate and store wherever you want.
  • Preferences: enabled apps, language, theme, backup settings and the forwarding setup. Stored encrypted.

5. Data stored in the cloud (only if you create an account)

The account is optional; the app works fully without it. If you create one, the following is stored in our services (Google Firebase):

  • Your email address and user identifier, to authenticate you.
  • Your subscription status: whether it is active and until when.

And nothing else. Not one payment, not one contact, not one notification text, not one statistic. There is no content sync between devices: to move your data to another phone, use the backup.

6. Forwarding to your own server (optional, off by default)

Yalape includes a feature for anyone who wants to wire it into their own system. If you turn it on, every payment notification the app captures is sent to the address you provide.

  • It ships off, with no factory destination. Nothing leaves your device through this route until you enter an address and flip the switch.
  • You choose the destination. It is your server, not ours: Yalape has no server that receives this information and keeps no copy of what was sent.
  • What is sent: the text and title of the captured notification, the app that emitted it, the date and time, and — if it was recognised as a payment — the amount, the currency and the payer name. Your contacts and your statistics are not sent.
  • How it is sent: over an encrypted connection only (https); unencrypted addresses are rejected. If you configure a secret key, each delivery is signed so your server can verify it came from your app.
  • You can audit it and stop it. The screen keeps a log of everything that went out — sent, pending or failed — and lets you see the exact content of each delivery. One switch stops it, and deleting your data or your account also removes the address and the key.

Because you initiate and direct this transfer, to a destination you choose, you are responsible for how your server processes that information.

7. Payments and subscriptions

Subscriptions are processed through Google Play Billing, with RevenueCat as the intermediary that validates purchase status. Yalape neither receives nor stores your card or payment method details.

8. Advertising (Free users)

The Free tier shows ads served by Google AdMob. To personalize and measure these ads, AdMob and its certified partners may process:

  • Android Advertising ID: a resettable identifier assigned by the operating system. You can view, reset or delete it from Device settings → Google → Ads.
  • Approximate location: derived from the IP address, not from GPS.
  • Ad usage data: impressions, clicks, view time.

The full list of Google-certified ad partners that may receive this information is available at support.google.com/admob/answer/9012903. Yalape does not share with AdMob or with those partners the content of your notifications, your payments or any additional personal data.

In regions with legal requirements (EEA, UK, Switzerland, California and other regulated US states), before loading ads we display the official form of Google's User Messaging Platform SDK so you can choose your consent level. You can change your choice at any time from Menu → Privacy → Privacy options.

9. Rights for EEA and UK residents (GDPR)

If you reside in the European Economic Area, the United Kingdom or Switzerland, the processing of advertising data described in section 8 is based on your consent (Art. 6(1)(a) GDPR).

You have the right to:

  • Access the personal data we process about you.
  • Request its rectification or erasure.
  • Object to processing or request its restriction.
  • Request the portability of your data.
  • Withdraw your consent at any time, without affecting the lawfulness of prior processing. You can do this from Menu → Privacy → Privacy options inside the app.
  • Lodge a complaint with the competent supervisory authority (in the UK, the ICO; ico.org.uk).

To exercise any of these rights write to hola@jjlp.dev.

10. Rights for California and other US-state residents

If you reside in California, Virginia, Colorado, Connecticut, Utah, Texas, Florida, Oregon, Montana, Delaware, Iowa, Tennessee or another state with equivalent privacy laws, you have additional rights under the California Consumer Privacy Act (CCPA/CPRA) and similar laws.

Categories of information that may be processed in connection with advertising (section 8):

  • Identifiers (Advertising ID).
  • Internet or application activity (interactions with ads).
  • Geolocation inferences derived from IP address.

You have the right to:

  • Opt out of the sale or sharing ("Do Not Sell or Share My Personal Information") of your personal information with advertising partners. You can exercise this right from Menu → Privacy → Privacy options; when you do, AdMob applies Restricted Data Processing and ads become non-personalized.
  • Know what personal information has been collected about you.
  • Request the deletion of your personal information.
  • Request correction of inaccurate information.
  • Not be discriminated against for exercising these rights.

To submit a verifiable request for access, deletion or correction, write to hola@jjlp.dev indicating the state where you reside.

11. Retention

  • Payments and contacts: kept for as long as you have the app installed. They are never deleted automatically and have no age limit. You can remove them at any time from Menu → Privacy → Delete all data.
  • Captured notifications: deleted automatically after 60 days, or sooner if they exceed 5,000. They are the most sensitive data the app stores, which is why they are the only thing with an expiry.
  • Account data: until you delete your account or request its removal.

12. Security

Local data lives in the app's private storage, protected by Android's app sandbox. Preferences — including the key for forwarding to your server — are stored encrypted. You can optionally enable biometric lock to require authentication when opening Yalape. Backups are signed with HMAC-SHA256 so you can verify they were not tampered with.

13. Your general rights

At any time you can: revoke notification access from Android settings, turn capture off from inside the app, delete all local data, delete your account, stop forwarding to your server and export your data as readable CSV.

14. Children

Yalape is not directed at children under 13 and we do not knowingly collect their data. If you believe a child has used the app, contact us so we can proceed with deletion.

15. Changes to this policy

When we modify this policy we will update the date at the top of the document and, if the changes are material, notify you inside the app.

16. Contact

For any questions about this policy or your data, email us at hola@jjlp.dev.