Privacy Policy

Yapy (“Yapy”, “we”, “us”) operates yapy.ai, an AI content coach for software founders. Yapy learns a founder’s voice, watches what they ship and how their audience responds, and drafts platform-native posts that the founder reviews and approves before anything goes out. This policy explains what we collect, why, and how it’s protected.

• Account information — your name and email address when you sign up.
• Voice sources — a website URL you give us to crawl, past posts you paste in, and answers to an onboarding questionnaire (goals, topics, competitors, current launch).
• Voice exports — for platforms we can’t read via API (LinkedIn, X), you may upload your own data-export ZIP. These files are parsed in your browser; only the extracted post text is uploaded to us, never the raw archive.
• Billing information — handled directly by our payment processor, Polar. We store your subscription status and plan, not your card details.

When you connect a social platform (Bluesky, LinkedIn, X, Reddit, YouTube, TikTok, Threads, or Instagram), you grant Yapy permission, through that platform’s own OAuth flow, to read what that platform’s API allows: your own recent posts, replies and comments on them, and basic engagement metrics. Where a platform allows it and you’ve turned publishing on, we also use that permission to publish drafts you’ve approved. We never see your platform password — you authenticate directly with the platform, and only an access token is returned to us.

Connected-account tokens are encrypted (AES-256-GCM) before storage, held in a database table with no read access for the application layer used to serve your own requests, and are only ever decrypted in memory, server-side, at the moment a job needs to call that platform’s API.

If you connect a GitHub repository, Yapy installs a GitHub App scoped to read-only access on the repositories you explicitly select:

• Repository metadata — read
• Repository contents — read
• Pull requests — read

We never request write, admin, Actions, secrets, or organization-level access. Pushes, merged pull requests, and releases on your selected repositories generate content ideas from commit messages, PR titles and bodies, and release notes.

Diff reading is opt-in and off by default. If you turn it on, Yapy reads a bounded diff for a given change, strips files matched by a denylist (secrets, credentials, lockfiles, binaries), redacts anything that looks like a secret or key, and sends the redacted diff to Google’s Gemini API for a plain-language summary. The diff itself — raw or redacted — is never written to disk or to our database. Only the resulting summary and a list of touched file paths are stored. When diff reading is off, Yapy works from commit messages, PR titles/bodies, and release notes only.

GitHub access is fully revocable at any time from GitHub’s own settings or from Yapy’s Connections screen; revoking it stops all related jobs immediately.

• To build and maintain your voice profile and generate content ideas.
• To draft platform-specific posts, which are sent to Google’s Gemini API for generation along with the relevant context (your voice profile, source signal, and a small number of your own past posts as style examples).
• To publish or schedule content you’ve explicitly approved, or to hand off a pre-filled draft for you to publish yourself where a platform requires it.
• To summarize comment themes and sentiment on your own posted content.
• To operate, secure, and improve the product, and to provide support.
• To process payments and manage your subscription.

By default, every draft requires your manual approval before it goes anywhere. You can turn on automatic publishing (“auto-approve”) independently for each connected platform; doing so is an explicit action you take in Settings, not a default we enable for you. There is no code path in Yapy that posts to a connected account without either your manual approval or your own opt-in.

We don’t sell your data. We share it only with the service providers needed to run Yapy, each acting on our instructions:

• Supabase — database, authentication, and file storage.
• Google (Gemini API) — content generation, research, and summarization, as described above.
• Polar — subscription billing and payment processing.
• Trigger.dev — background job execution (drafting, publishing, ingestion runs).
• Vercel — application hosting.
• Bluesky, LinkedIn, X, Reddit, YouTube, TikTok, Threads, and Instagram — only the platforms you personally connect, and only to read or publish within the permissions you granted.

We may also disclose information if required by law, or to protect the rights, property, or safety of Yapy, our users, or others.

We retain your account data for as long as your account is active. You can delete your account at any time from Settings; doing so removes your account, voice profile, drafts, ingested content, and connected-account tokens, and uninstalls any linked GitHub App installation. Some records may be retained briefly where we’re required to by law (for example, billing records) or where needed to resolve disputes.

Raw source code and raw diffs from GitHub are never persisted in the first place — see Section 4.

Every table in our database enforces row-level security, so one account can never read another account’s data. Connected-account tokens and the GitHub App private key are encrypted and inaccessible to the parts of our system that serve ordinary user requests. Service credentials are never exposed to the browser.

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, or to object to or restrict certain processing. You can exercise most of these directly from Settings, or contact us using the details below and we’ll respond within a reasonable time.

Yapy is a business tool intended for founders and professionals. It is not directed at, and we do not knowingly collect information from, anyone under 16.

Our service providers may process data in countries other than your own. Where they do, we rely on those providers’ own safeguards for cross-border transfer.

We may update this policy as the product changes. We’ll update the date at the top of this page, and if a change is material, we’ll let you know by email or an in-app notice.

Questions about this policy or your data? Email privacy@yapy.ai.