Privacy policy

Draft of 4 November 2026, awaiting review by a lawyer. It describes what the service does today, and it is not yet legal advice or a final text. Items in [square brackets] are still to be filled in.

Who we are

YaMAR is operated by [legal name and address of the operator]. Contact: support@yamar.app.

What the account service stores

• Email: your address, and for each way you sign in, the provider's name, your account number with that provider and the address it gave.
• Consents: whether you agreed to news, with the date and the version of the text you saw. News is off until you turn it on, and one click unsubscribes.
• Devices: one record for each signed-in app, holding only hashes of its sign-in tokens and when they expire.
• Plan: which plan you are on. There are no paid plans yet, so today this holds nothing.

For a short time it also holds a hash of a sign-in code (10 minutes), and your IP address and the address you typed next to a count of attempts, to limit abuse (about two hours). This applies to an address that never becomes an account too. Backups hold a copy of these as well, for as long as a backup is kept. The web server keeps no log of requests.

What it never stores

Your code, your prompts and your provider keys. They stay on your machines and do not reach our servers.

What we use it for

To sign you in, to keep one account per verified address, to limit abuse, to write to you about your account, and to send news if you asked for it. We do not sell your data and show no ads.

Sign-in with Google and GitHub

From Google we ask only for your email address, whether it is verified, and your Google account number. From GitHub we ask for your public profile and your email addresses, and keep the account number and the address. We use these only to sign you in. We do not read your repositories, files or anything else in those accounts.

YaMAR's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Google user data is not used for advertising, not sold, not used to train AI models, and not shared except with the service providers below, as needed to run the sign-in.

Who else handles it

• Google Cloud hosts the service, on a server in [region to be confirmed].
• Resend delivers sign-in codes and letters, so it sees your address and the letter.
• Google and GitHub, if you choose to sign in through them.

[Transfers outside your country, and the legal basis for each use: to be set by the lawyer.]

How long we keep it

Until you ask us to delete your account. Backups of the database are kept for about 30 days, so a deleted account leaves them within that time. Signing in again after a sign-out is possible for as long as the account exists.

Your choices

You can see your ways in, unlink one, and turn news off in the app's settings. To get a copy of your data or have your account deleted, write to support@yamar.app. The app does not have a button for this yet. [Rights under applicable law, and how to complain to a regulator: to be set by the lawyer.]

This site

This site sets no cookies and has no analytics.