Privacy Policy

Last updated: [DATE] · Effective for the hosted Yokolo service.

Template. This is a starting point, not legal advice. Replace every [bracketed] value and have it reviewed before you accept real customers or payments.

1. Who we are

Yokolo is operated by [LEGAL ENTITY NAME], [ADDRESS] ("we"). Contact: REPLACE-ME@example.com.

2. What we collect

• Account data: your email address and a salted, hashed password (we never store the password itself).
• Your content: the conversations, messages, tags, snippets, and settings you create. In the hosted service these are stored in a database dedicated to your account on our servers.
• Usage data: basic request/usage counters needed to run and limit the service.
• Payment data: handled by our payment provider(s) ([PROVIDER]). We do not store card numbers.
• Technical data: IP address and request logs for security and abuse prevention.

3. Model provider keys

Yokolo uses your model provider key ("bring your own key"). Your key is used solely to make requests to your provider on your behalf. Where it is stored and how it is protected is described in [WHERE THE KEY IS STORED].

4. How we use it

• To provide and operate the service.
• To authenticate you and keep your account secure.
• To prevent abuse and enforce usage limits.
• To send transactional email (verification, password reset, receipts).

We do not sell your data, and we do not use your content to train models.

5. Sharing

We share data only with processors necessary to run the service: hosting ([HOST]), email ([EMAIL PROVIDER]), payments ([PAYMENT PROVIDER]), and your chosen model provider when you send a message. [LIST SUB-PROCESSORS + LOCATIONS].

6. Retention

We keep your content until you delete it or delete your account. Deleting your account removes your data from our servers ([STATE THE BACKUP RETENTION WINDOW]).

7. Your rights

• Export: download your data from your account page or via GET /api/backup/download.
• Deletion: delete your account from your account page.
• Access, correction, objection, portability: contact us at the address above.

8. Security

Passwords are hashed with scrypt. Sessions use HttpOnly cookies. Traffic is encrypted in transit. No system is perfectly secure; report issues to the contact above.

9. Changes

We will post material changes here and update the "last updated" date.