Privacy Policy

1. Information We Collect

We collect:

• Account information — email address, hashed password, authentication tokens
• Profile data — display name, avatar, preferences
• Usage data — feature usage patterns, error logs, app configuration
• Device information — operating system, app version, device identifiers for license validation

We do NOT collect or access:

• Your AI conversation content
• Your personal contacts
• Your financial portfolio data
• Your messaging content

These are stored locally on your device only.

2. How We Use Your Data

We use your data to:

• Provide and maintain the Service
• Authenticate your identity and manage your account
• Validate software licenses
• Send essential service communications (e.g., security alerts, account verification)
• Improve the Service through aggregated, anonymized usage analytics

We do NOT sell, rent, or share your personal data with third parties for marketing purposes.

3. Data Storage & Security

Account data is stored on Cloudflare infrastructure with encryption at rest and in transit (TLS 1.2+). Passwords are hashed using industry-standard algorithms and are never stored in plaintext.

Your AI conversations, contacts, and personal data are stored locally on your device and are not transmitted to our servers unless you explicitly initiate a sync or backup. API keys you configure are stored locally on your device and encrypted at rest.

4. Third-Party Data Processors

We use the following categories of third-party processors:

• Cloud infrastructure (Cloudflare) — for hosting, CDN, and data storage
• Authentication providers (Google, Apple) — only when you choose OAuth sign-in, limited to email and profile name
• AI model providers — when you configure AI agents, your prompts are sent to the provider you select (e.g., Anthropic, OpenAI, Google, DeepSeek). Each provider's privacy policy governs their handling of this data.

We do NOT share your data with any third parties beyond what is strictly necessary to operate the Service.

6. Messaging Integration Data

If you use messaging integrations (e.g., WhatsApp), all messaging data (contacts, messages, media) is processed and stored locally on your device. Message content is never transmitted to or stored on our servers. You are responsible for complying with applicable messaging platform terms of service and privacy regulations.

7. Financial Data

If you use financial data features (stock tracking, market analysis), your watchlists and portfolio configurations are stored locally on your device. Market data is fetched from third-party providers in real time and is not stored on our servers. We do not have access to your brokerage accounts, trading history, or financial holdings.

8. Your Rights

You have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate personal data
• Erasure — request deletion of your account and all associated data (GDPR Article 17 / right to be forgotten)
• Data portability — receive your data in a structured, machine-readable format
• Withdrawal of consent — withdraw consent for data processing at any time
• Objection — object to processing based on legitimate interests

To exercise these rights, use the data management options in the app settings or contact us at privacy@yauyau.ai.

9. Data Retention

We retain your account data for as long as your account is active. Upon account deletion, we will delete or anonymize your personal data within 30 days, except where retention is required by law. Anonymized usage analytics may be retained indefinitely as they cannot be linked back to you.

10. Security Measures

We implement industry-standard security measures including:

• Encryption in transit (TLS 1.2+) and at rest
• Secure password hashing
• HMAC-signed license caches
• Input sanitization to prevent injection attacks
• Path traversal protection
• Regular security reviews

While we strive to protect your data, no method of electronic transmission or storage is 100% secure.

11. Children's Privacy

The Service is not intended for users under 18 years of age. We do not knowingly collect personal data from children. If we learn that we have collected data from a child under 18, we will promptly delete it.

12. International Data Transfers

Your data may be processed in jurisdictions outside your country of residence, including through Cloudflare's global network. We ensure appropriate safeguards are in place for international data transfers in compliance with applicable data protection laws.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or via email. Your continued use of the Service after notification constitutes acceptance of the updated policy.

14. Contact Us

For privacy-related inquiries, contact our data protection team at privacy@yauyau.ai.