We built Yapr the way we'd want a tool built for us. That means: your audio is gone the moment transcription ends, we don't sell your data (ever), and we never snoop on your words. This policy spells out the details — but that's the spirit of it.

We keep it minimal. Here's exactly what we store when you use Yapr:

• —Your name and email — whether you sign in with Google, GitHub, email and password, or a passkey. Just enough to keep you in. Nothing more, we promise.
• —Usage numbers — how long you've recorded and how much quota you've used. Never the words you spoke.
• —Your preferences — chosen language, theme, and whether you want transcripts saved.
• —Referral info — if a friend invited you, we log that so they get their bonus.
• —Feedback you send us — if you use the in-app feedback form, we store your message so we can actually read it and get back to you. Revolutionary, we know.
• —Login security data — timestamps and outcomes of sign-in attempts. We use this to keep the bad guys out, not to keep tabs on you.

This one matters to us, so we want to be crystal clear.

When you record, your audio travels over an encrypted connection to our AI provider for transcription. The moment it's done, the audio file is deleted — automatically, immediately, permanently. We're not storing a copy. We're not archiving it. There is no backup. It's gone.

Transcript text is a different story — that's yours, and we save it only if you tell us to (in Settings). You can delete it any time.

Your data powers your experience. Nothing more, nothing less:

• —Signing you in and keeping your session active.
• —Tracking your transcription quota so the free tier works fairly.
• —Delivering your transcripts and (if you want) saving them for later.
• —Crediting referral bonuses when friends you invite sign up.
• —Keeping the service stable and fixing things when they break.

We're selective about who touches your data. Here's the full list:

• —AI provider (DeepInfra) — transcribes your audio. They receive the audio, return text, and that's it. No retention on their end.
• —Google / GitHub — handle OAuth sign-in. We only get your name and email. If you sign in with email/password or a passkey, these two aren't involved at all.
• —Cloudflare R2 — holds your audio in an encrypted buffer during transcription, then deletes it.
• —Neon / PostgreSQL — stores your account, quota, and (if opted in) your saved transcripts.
• —Resend — delivers our transactional emails (verification, password resets, the important stuff). They see your email address because — well, that's how email works. They don't market to you, and neither do we.
• —Umami — cookieless, privacy-first usage analytics. Tells us which pages people visit and which features get used. No personal data, no cross-site tracking. Doesn't even use cookies.
• —Microsoft Clarity — helps us understand how people interact with the interface (clicks, scrolls, where people get stuck). Runs under the heatmaps consent flag — off unless you say yes. No personal data collected.
• —Sentry — catches errors before you even notice them. May receive technical context when something breaks. Never your audio. Never your words.
• —Upstash Redis — powers our rate limiting to keep things fair and fend off bots. Processes hashed IP data briefly. Nothing personal, nothing permanent.
• —Google Analytics — tracks anonymized usage data (page views, feature clicks) to help us improve. No personal information, no audio, no transcripts.

Audio: under 60 seconds. Then it's gone.

Transcripts: as long as you want them. Delete from History anytime.

Account data: until you close your account. Email us at privacy@yapr.lol and we'll take care of it.

Usage logs: anonymized aggregates, kept up to 12 months for service health.

You have real rights over your data, and we want you to exercise them. Depending on where you live, that includes:

• —Access — ask us what data we have on you. We'll tell you, clearly and completely.
• —Correction — if something's wrong, let us know and we'll fix it.
• —Deletion — want everything gone? Your account, your transcripts, your history? Done.
• —Portability — want your data exported in a readable format? Just ask.
• —Opt-out (CCPA) — we don't sell personal data, so this one's already covered.

We use a session cookie to keep you signed in, plus a small set of experience-improvement tools to understand how people use Yapr and make it better. You choose whether to allow the experience tools when you first visit — your call, no pressure. Full details in our Cookie Policy.

All data travels over HTTPS with TLS 1.3 encryption. Audio is stored in encrypted buckets with time-limited access during transcription. We follow industry-standard security practices and ship security fixes as a top priority.

Found a vulnerability? Email security@yapr.lol. We take this seriously and respond promptly.

Yapr is designed for people aged 13 and older. We don't knowingly collect information from younger users. If you believe a child has created an account, reach out at privacy@yapr.lol and we'll handle it right away.

We'll update this policy when we need to. If it's something significant, we'll tell you — via email or a notice in the app — with enough time to decide if you're still comfortable. Small changes (typos, clarifications) won't require a heads-up.

Privacy questions, data requests, just want to talk? We're real people and we read everything.

Email: privacy@yapr.lol

Yapr Inc. 131 Hazelton Avenue, Yorkville Toronto, ON M5R 2E4, Canada