Privacy Policy

Effective August 11, 2026 Last updated August 11, 2026

Plain summary

Cyca is a messaging, calling, and live-shopping app. Your account is your phone number, and we store your messages and media so they can be delivered even when the other person is offline. Your data is encrypted in transit and stored on private, access-controlled infrastructure. Call and live-stream audio and video are relayed in real time and are never recorded by us.

If you turn on contact sync, we upload your address book — including numbers of people who are not on Cyca. If you open Live Market, we use your approximate location while it is open to show you nearby sellers. If you order, we collect the delivery details needed to fulfil it.

We do not sell your data, show ads, or use third-party advertising or tracking.

Who we are

In plain English: Cyca is operated by OCARRY LLC in Texas, USA.

Cyca (“Cyca,” “we,” “us”) is a messaging, calling, and live-commerce application operated by OCARRY LLC, Webster, Texas, USA. This Privacy Policy explains what information the Services collect, why we collect it, and what happens to it.

“You” means the person using Cyca. “Services” means the Cyca mobile application, the Live Market and its web viewer, and the servers that operate them. We would rather over-explain than surprise you.

What we collect

In plain English: Account and profile, contacts (if you allow it), messages and media, call records, live-shop and order details, your approximate location while Live Market is open, device and connection data, usage telemetry, and push tokens.

We collect the following categories of information:

Account	Your phone number, which is your identity on Cyca; the one-time verification code used to confirm it; and the profile you choose to set — display name, about text, birth year, and profile photo.
Contacts	If you consent to contact sync, we upload the names and phone numbers in your address book to determine which of your contacts use Cyca. This includes the numbers of people who are not Cyca users — we retain those as “shadow entries” so that a connection can be made if that person later joins. Those people have not themselves consented. Contact sync is optional and can be skipped entirely.
Messages and media	Your messages, photos, videos, voice notes, and status updates are stored on our servers so they can be delivered, including while the recipient is offline. Media files are held in private storage reachable only through short-lived, per-user authorized links.
Calls	Call metadata: who called whom, when, whether the call was answered, its duration, and whether it was voice or video. Call audio and video are relayed in real time and are not recorded or stored by us.
Live Market and orders	If you use Live Market: your shop details if you sell; live session records; comments, reactions, and viewer counts; and, when you place an order, the buyer name, buyer phone number, delivery address (including its coordinates), quantity, price, payment type, order status, and any rating you leave after delivery.
Location	When you open Live Market, the app uses your location while Live Market is in use to work out your approximate area, so it can show you nearby sellers and let buyers find sellers near them. We use it for proximity only — we do not build a location history or track your movements — and access stops when you leave Live Market. You can decline or revoke it in your device settings; declining limits location-based discovery. We also derive an approximate location from your IP address when you register and connect.
Delivery, read, and presence data	Per-message delivered and read state, whether you are currently connected (“online”), who viewed your statuses, your blocked list, and your settings.
Device and connection information	Device model, operating system, and application version; your IP address; and the approximate location derived from it.
Usage telemetry	Events describing how the app is used — opening the app, sending a message and its type, making or answering calls, posting or viewing statuses, syncing contacts, browsing Live Market, changing settings, or blocking someone — with timestamps. Telemetry describes your activity, not the words inside your messages.
Push notification tokens	A device token issued by Apple that allows our servers to send you notifications.

How we use it

In plain English: To run the Services, connect you with your contacts, operate Live Market and orders, improve the app, and keep it safe.

To operate the Services: delivering messages and calls, syncing your profile, showing presence, sending notifications, and keeping your conversations in order.
To connect people: contact sync exists solely to show which of your contacts are reachable on Cyca.
To operate Live Market: using your approximate location to show nearby live sellers, running live sessions, and processing and fulfilling orders — which requires sharing your delivery details with the seller you ordered from.
To improve the app: telemetry tells us which features are used, how often, and whether they work — particularly on the weak networks Cyca is designed for.
To keep the Services safe: rate-limiting abuse, investigating reports, and enforcing our Terms and Community Guidelines.

We do not sell your data. We do not show advertisements. We do not share your data with advertisers, data brokers, or third-party analytics or tracking services.

Who we share it with

In plain English: Apple for push delivery, the seller when you place an order, other users as your settings allow, and authorities only where the law genuinely requires it.

Apple	When we send you a push notification, its content — for example a sender's name and a short preview — passes through Apple's notification service. You can reduce this by turning notifications off.
Sellers	When you place an order, the seller receives the information needed to fulfil it: your name, phone number, delivery address, and order contents. Sellers are bound by our Seller & Commerce Terms to use it only for that purpose.
Other users	People you message see what you send them. Your presence, profile details, and statuses are visible according to your privacy settings (everyone / my contacts / nobody). Comments you post in a live stream are visible to everyone watching, including web viewers.
Infrastructure	Your data resides on servers we operate, including our database, private media storage, and call and live-streaming relays. We do not hand it to third-party analytics or advertising services.
Legal	We may disclose information where the law genuinely requires it. See Legal Contact for how such requests are handled.

How long we keep it

In plain English: Messages stay until deleted; statuses self-delete after 24 hours; order records are kept for business and tax purposes; deleting your account removes your identity.

Messages and media are stored until deleted. Deleting a chat hides that chat and its history for you; the people you wrote to keep their own copies.
Status updates delete themselves 24 hours after posting, along with their view records.
Verification codes expire after 5 minutes.
Call history and usage telemetry are retained while your account exists.
Order records — including delivery details and ratings — are retained after fulfilment for dispute resolution, accounting, and tax purposes, and are not removed by deleting your account.
Live streams are not recorded by us; comments attached to a session are retained with that session's record.

See Account Deletion for exactly what deletion removes and what it does not.

Security and encryption

In plain English: Encrypted in transit, private access-controlled storage, and real-time media that is never recorded.

Cyca is built to industry-standard security practices:

Encrypted in transit. All traffic between the app and our servers is encrypted using industry-standard transport encryption, and the web viewer for live sessions is served over HTTPS.
Private media storage. Photos, videos, voice notes, and profile photos are held in private storage that is not publicly listable, reachable only through short-lived links authorized for a specific user rather than permanent public URLs.
Calls and live streams are never recorded. Voice, video, and live-stream media is relayed in real time and is not recorded or stored by us. Only call metadata — who called whom, when, and for how long — is retained.
Access control. Message, media, and order data is scoped to the accounts entitled to it.
Short-lived credentials. One-time verification codes expire after five minutes.

We are actively strengthening this further, including work on end-to-end encryption for conversations. We will update this page and tell you in the app when it ships — we describe only protections that are actually in place at the date above.

Further detail is in Data & Security.

Your rights and controls

In plain English: You can change what you share, block people, delete chats, and delete your account in the app. You may have additional legal rights depending on where you live.

In the app: edit your profile; choose who can see your last-seen, profile photo, about text, and statuses; block people; delete chats; leave groups and communities; turn notifications off; revoke location access in your device settings; and delete your account entirely (Settings → Account).

Depending on where you live — for example under the GDPR or the UK GDPR — you may also have the right to access, correct, export, restrict, or erase your data, to object to certain processing, and to complain to your data-protection authority. Contact us and we will help.

If you are not a Cyca user and someone synced their address book containing your number, you may ask us to remove the shadow entries referencing it. Write to [email protected].

Children

In plain English: Cyca is not for children under 13.

Cyca is not intended for children under 13, and we ask your birth year during sign-up to enforce that. Where the law in your country sets a higher minimum age for services like this, that higher age applies. If you believe a child under 13 is using Cyca, contact us and we will remove the account.

Changes to this policy

In plain English: If what we collect changes, this policy changes with it — and we will tell you in the app before meaningful changes take effect.

If we change what we collect or how we use it, we will update this policy and the effective date above. For material changes we will notify you within the app before they take effect. The previous version of this policy was dated July 11, 2026.

Contact

In plain English: Write to us and we will respond within 30 days.

Questions, requests, or complaints: [email protected] — OCARRY LLC, Webster, Texas, USA. We aim to respond within 30 days. See Legal Contact for specific request types.