Privacy Policy
Version 1.1 — Effective July 25, 2026 Last reviewed: July 25, 2026
ChatYAML ("we", "us", "our") operates the ChatYAML platform at chatyaml.com. This policy explains what personal data we collect, how we use it, your rights, and how we comply with privacy laws across all jurisdictions where our platform is available.
Quick Summary
| What | Detail |
|---|---|
| We collect | Email, username, profile info, post content, reading behaviour, subscription status |
| We do not | Sell your data, use it for advertising, or share it with third parties for their own purposes |
| We use | Supabase, Stripe, Upstash Redis, Vercel, Google Fonts (and optionally New Relic) |
| You can | Access, correct, delete, or export your data at any time |
| Contact | Use the contact form at /contact |
1. Who We Are and How to Contact Us
Controller / Responsible Party / Data Fiduciary: ChatYAML
For privacy enquiries or to exercise your rights, use the contact form at /contact.
We respond to all privacy requests within the timeframe required by the law applicable to your location (see Section 11).
2. Data We Collect
2.1 Account Data
When you create an account, we collect and store via Supabase Auth:
- Email address — for authentication and transactional notifications
- Password — hashed by Supabase Auth; we never see or store your plaintext password
- Username — your unique public identifier (3–20 characters)
- Display name, bio, avatar image — optional public profile fields
2.2 Content You Create
- Post content — stored as plaintext in our database. Posts are public content and are not encrypted at rest; they are protected by HTTPS in transit
- Post metadata — title, URL slug, publish status, publication date, view count, and optional SEO overrides (custom title, meta description, social image URL)
- Comments — the text of comments you post, linked to your account
- Emoji reactions — which emoji you used on which message bubble, linked to your account
- Publication data — names, descriptions, and logos for publications you create
2.3 Reading and Engagement Data
For authenticated users — per reader, per post (one row, updated to reflect your best session):
- Number of "Next" button taps (bubble clicks)
- The furthest bubble you reached in the conversation
- Total number of bubbles in the post
- Whether you completed the post
- Seconds spent while auto-play was active
For guest visitors — the same metrics are tracked using a randomly generated session ID stored in your browser's localStorage key chatyaml_guest_session_id. This UUID persists across page loads on your device but cannot be linked to any identity. You can clear it by clearing your browser's local storage.
We use engagement data solely to provide authors with analytics about how their posts are read. We do not profile readers or use engagement data for advertising.
2.4 View Tracking
Every page load of a published post is recorded:
- Authenticated visitors: one record per user per post — repeat visits are not double-counted
- Guest visitors: each page load is counted separately — we cannot identify the same guest returning
- Whether you were an active paying member at the time of the visit is recorded alongside the view
2.5 Notification Data
When activity occurs on your posts (a comment, reaction, or follow), we store:
- Who triggered the notification
- Which post it relates to
- Whether you have read the notification
- Timestamp
2.6 Subscription and Payment Data
If you subscribe, we store in our database:
- Stripe's customer identifier (
stripe_customer_id) - Stripe's subscription identifier (
stripe_subscription_id) - Subscription status: one of
none,active,past_due,canceled, ortrialing
We never store card numbers, CVVs, or any other payment details. All payment processing is handled by Stripe. We receive only the outcome of payment events via Stripe webhooks.
2.7 Application Logs
Significant platform events are logged for security, debugging, and auditing:
- Event type (e.g.
post.published,auth.login,admin.user_promoted) - Your user ID (where applicable)
- The relevant post ID (where applicable)
- Contextual metadata (post title, error messages)
We explicitly never log passwords, encryption keys, session tokens, JWT contents, email addresses, IP addresses, or post content in logs. Logs are sent to our monitoring provider (New Relic) rather than stored in our database; a defence-in-depth sanitiser strips sensitive fields before any log leaves the server.
2.8 Encrypted Vault
If you use the encrypted vault feature, your vault data is stored as AES-GCM ciphertext. We store only the encrypted blob, the initialisation vector (IV), and a salt. We do not hold your decryption key and cannot read your vault contents.
2.9 Browser Local Storage
We store the following in your browser locally. Nothing in this list is sent to our servers:
| Key | Purpose |
|---|---|
chatyaml_guest_session_id |
Anonymous engagement tracking ID for guests |
3. Legal Basis for Processing
The legal basis we rely on depends on the activity and the law applicable to you.
| Processing Activity | Legal Basis (GDPR / UK GDPR) | LGPD (Brazil) | PIPEDA (Canada) | DPDP Act (India) | Other Jurisdictions |
|---|---|---|---|---|---|
| Providing the service (account, posts, subscriptions) | Contract performance (Art. 6(1)(b)) | Contract performance (Art. 7, V) | Consent / contract | Consent (Section 6) | Consent or contract |
| Reading and engagement analytics for authors | Legitimate interests (Art. 6(1)(f)) | Legitimate interest (Art. 7, IX) | Implied consent | Consent | Consent / legitimate purpose |
| Guest engagement tracking | Legitimate interests (Art. 6(1)(f)) | Legitimate interest (Art. 7, IX) | Implied consent | Consent | Consent / legitimate purpose |
| Application logs and security | Legitimate interests (Art. 6(1)(f)) | Legal obligation / legitimate interest | Implied consent | Legitimate use (Section 7) | Legitimate purpose |
| Subscription and payment processing | Contract performance (Art. 6(1)(b)) | Contract performance (Art. 7, V) | Contract | Consent | Contract |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) | Legal obligation (Art. 7, II) | Legal obligation | Legitimate use (Section 7(c)) | Legal obligation |
We do not rely on consent as our primary basis for core service delivery under GDPR. Where we rely on legitimate interests, you have the right to object (see Section 9).
4. Third-Party Services
| Service | Purpose | Data Shared | Their Privacy Policy |
|---|---|---|---|
| Supabase | Database, authentication, file storage | All user data | supabase.com/privacy |
| Stripe | Payment processing, subscriptions | Email, subscription events | stripe.com/privacy |
| Upstash Redis | Caching (post content, settings, feeds) | Same data as main database, temporarily | upstash.com/privacy |
| Vercel | Frontend hosting and deployment | Request metadata | vercel.com/legal/privacy-policy |
| Google Fonts | Typography via Google's CDN | Browser IP and user agent | policies.google.com/privacy |
| New Relic (if logging enabled) | Application and request logging/monitoring | Event metadata and user/post IDs (no emails, tokens, or IP addresses) | newrelic.com/termsandconditions/privacy |
Caching
Post content, reactions, profiles, platform settings, and feed results are temporarily cached in Upstash Redis. Cache entries hold the same data as our main Supabase database — never additional data. Entries expire automatically (60 seconds for settings, up to 24 hours for post content).
No Data Sales or Advertising
We do not sell, rent, or share your personal data with third parties for their own marketing or advertising purposes. We have no advertising relationships and do not build behavioural profiles for commercial targeting.
5. Public vs. Private Data
Publicly visible (no login required)
- Published post content, title, author username, participant names, and categories
- Your public profile: username, display name, bio, avatar, and published posts
- Reaction counts and comments on published posts
- Publication names and descriptions
Private (only you and admins)
- Draft post content
- Your email address
- Reading engagement history
- Subscription status and Stripe identifiers
- Application log entries
- Encrypted vault data (admins cannot decrypt this)
Visible to post authors (aggregate only)
Authors see aggregate analytics for their own posts: total views, unique authenticated viewer count, member vs. non-member split, total bubble taps, average completion rate, and total reading time. Authors cannot see who read their posts — only the numbers.
6. Data Retention
| Data | Retention Period |
|---|---|
| Account and profile data | Until you delete your account |
| Published and draft posts | Until you delete the post or your account |
| Comments and reactions | Until you or an admin delete them, or your account is deleted |
| Reading engagement records | Until the associated post is deleted |
| Post view records | Until the associated post is deleted |
| Guest engagement records | Until the associated post is deleted |
| Application logs | Sent to our monitoring provider (New Relic) and retained per its policy; admins view them through that provider, not our database |
| Stripe event deduplication records | 7 days (automatically purged) |
| Redis cache | 60 seconds to 24 hours per entry; not a permanent store |
When you delete your account, deletion is permanent and irreversible. We do not retain "soft-deleted" records.
7. International Data Transfers
Our infrastructure is hosted globally using Supabase and Vercel. Your data may be processed in data centres outside your country of residence.
We transfer data internationally using the following safeguards:
| Destination Region | Safeguard |
|---|---|
| EU / EEA | No restriction; adequate protection under GDPR |
| UK | UK adequacy regulations or UK International Data Transfer Agreement (IDTA) |
| US (Supabase, Stripe, Vercel) | Standard Contractual Clauses (EU SCCs) or Data Privacy Framework |
| Other countries | Standard Contractual Clauses or contractual obligations of equivalent effect |
Brazil (LGPD): Transfers rely on ANPD-approved standard contractual clauses (Resolution CD/ANPD No. 19/2024) where applicable.
China (PIPL): If you are located in China, cross-border transfers of your data require separate consent under Art. 39 PIPL after receiving information about the destination country's data protection system. We implement this before processing your data.
Japan (APPI): Before transferring your data internationally (other than to EU/UK which have PPC adequacy recognition), we provide you with information about the destination country's protection system and obtain your consent as required by Art. 28 APPI.
India (DPDP Act): We transfer data internationally in accordance with Section 16 of the DPDP Act. We apply appropriate contractual safeguards with all overseas recipients as best practice.
Canada (PIPEDA): We remain accountable for your personal information when transferred to third parties for processing, as required by PIPEDA Principle 1 (Accountability). We ensure comparable protection through contractual means.
8. Security
- Passwords are hashed by Supabase Auth — we never see them
- All data in transit is encrypted via HTTPS/TLS
- Post content is stored as plaintext (it is intended to be publicly readable)
- SMTP credentials for the contact form mailer are encrypted at rest with AES-256-GCM
- Vault data is encrypted client-side before storage; we hold only ciphertext
- Row-Level Security (RLS) is enforced across all database tables
- Admin operations use a server-side service role key never exposed to browsers
- JWT tokens are verified locally on the server without a network call on every request
- We conduct periodic security reviews of our infrastructure and dependencies
9. Your Rights
The rights available to you depend on the privacy law applicable in your jurisdiction. We honour all rights listed below regardless of your location.
9.1 Rights Available to Everyone
Right of access — Request a summary of the personal data we hold about you and how we use it.
Right to correction — Request correction of inaccurate or incomplete data. You can also correct your profile directly in Settings → Profile.
Right to deletion / erasure — Request deletion of your personal data. Go to Settings → Danger Zone → Delete my account for a full, immediate, permanent deletion. This deletes:
- Your account credentials
- Your profile
- All your posts (and their associated reactions and comments)
- Your subscription record
- Your encrypted vault data
- Your notification records
Right to object — Where we rely on legitimate interests as our legal basis, you have the right to object to that processing.
Right to withdraw consent — Where processing is based on consent (including subscription), you may withdraw at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
Right to complain — You have the right to lodge a complaint with the supervisory authority in your jurisdiction (see Section 10).
9.2 Jurisdiction-Specific Rights
| Right | Jurisdictions | How to Exercise |
|---|---|---|
| Data portability | EU/UK (GDPR Art. 20), Brazil (LGPD Art. 18, V), Singapore (PDPA Part VIB), Australia (2024 reforms) | Contact us via /contact |
| Right to restrict processing | EU/UK (GDPR Art. 18) | Contact us via /contact |
| Right not to be subject to automated decisions | EU/UK (GDPR Art. 22), Brazil (LGPD Art. 20), Japan (APPI Art. 24) | Contact us via /contact |
| Right to know categories of data shared | California (CCPA §1798.110), Canada (PIPEDA Principle 9) | Contact us via /contact |
| Right to opt out of sale/sharing | California (CCPA/CPRA §1798.120) | We do not sell data; no opt-out needed |
| Right to limit sensitive PI use | California (CPRA §1798.121) | Contact us via /contact |
| Right to nominate a representative | India (DPDP Act Section 14) | Contact us via /contact |
| Right of deceased persons' relatives | Japan (APPI Art. 49) | Contact us via /contact |
| Right to request explanation of processing rules | China (PIPL Art. 48) | Contact us via /contact |
9.3 Response Timeframes
We respond to privacy requests within the following timeframes:
| Jurisdiction | Timeframe |
|---|---|
| EU / UK (GDPR) | 1 month (extendable to 3 months for complex requests) |
| California (CCPA/CPRA) | 45 days (extendable to 90 days) |
| Brazil (LGPD) | 15 days for access/confirmation requests |
| China (PIPL) | Without undue delay (within 15 business days) |
| Canada (PIPEDA) | 30 days |
| Japan (APPI) | Without delay (typically 1–2 weeks) |
| Australia (Privacy Act) | Within 30 days |
| India (DPDP Act) | Within prescribed period (30 days target) |
| South Africa (POPIA) | Reasonable time period |
| Singapore (PDPA) | 30 days |
10. Supervisory Authorities
If you are not satisfied with our response to a privacy request or concern, you have the right to complain to the relevant supervisory authority in your jurisdiction:
| Jurisdiction | Authority |
|---|---|
| EU member states | Your national Data Protection Authority (list at edpb.europa.eu) |
| UK | Information Commissioner's Office (ico.org.uk) |
| USA / California | California Privacy Protection Agency (cppa.ca.gov) |
| Brazil | Autoridade Nacional de Proteção de Dados — ANPD (gov.br/anpd) |
| China | Cyberspace Administration of China — CAC (cac.gov.cn) |
| Canada | Office of the Privacy Commissioner of Canada (priv.gc.ca) |
| Japan | Personal Information Protection Commission — PPC (ppc.go.jp) |
| Australia | Office of the Australian Information Commissioner — OAIC (oaic.gov.au) |
| India | Data Protection Board of India — DPBI (once operational) |
| South Africa | Information Regulator (inforegulator.org.za) |
| Singapore | Personal Data Protection Commission — PDPC (pdpc.gov.sg) |
| South Korea | Personal Information Protection Commission — PIPC (pipc.go.kr) |
| Thailand | Personal Data Protection Committee — PDPC (pdpc.or.th) |
| Nigeria | Nigeria Data Protection Commission — NDPC (ndpc.gov.ng) |
| UAE | UAE Data Office (tdra.gov.ae) |
11. California-Specific Disclosures (CCPA / CPRA)
This section applies to California residents.
Categories of Personal Information Collected
| Category | Examples | Collected |
|---|---|---|
| Identifiers | Email address, username | Yes |
| Internet/network activity | Post page loads, reading engagement | Yes |
| Commercial information | Subscription plan, payment status | Yes |
| Inferences | Reading completion patterns (for author analytics only) | Yes |
| Sensitive personal information | Account login credentials (password hash only) | Yes |
We Do Not Sell or Share Your Personal Information
We do not sell your personal information as defined under CCPA/CPRA. We do not share your personal information for cross-context behavioural advertising. Therefore, no "Do Not Sell or Share" opt-out is required — the right does not apply to us as we do not engage in these activities.
Retention Periods
See Section 6 above for retention periods per data category.
Your CCPA/CPRA Rights
California residents have the right to know, delete, correct, and limit use of sensitive personal information. Submit requests via /contact. We respond within 45 days, extendable by an additional 45 days where necessary. We will not discriminate against you for exercising your rights.
12. EU and UK Disclosures (GDPR / UK GDPR)
Lawful Bases
Our lawful bases for processing are set out in Section 3. Where we rely on legitimate interests, our interest is in providing a functioning, secure, and improving publishing platform. We have assessed that this does not override your fundamental rights and freedoms.
Data Protection Impact Assessments (DPIAs)
We conduct DPIAs for high-risk processing activities, including guest engagement tracking and any future automated decision-making that affects users.
No Automated Decision-Making with Legal Effect
We do not make any decisions that produce legal or similarly significant effects on you solely through automated processing without human involvement.
International Transfers
See Section 7. Transfers to the United States are covered by EU Standard Contractual Clauses (Module 2: Controller to Processor) with supplementary measures where required following the Schrems II judgment.
13. Brazil Disclosures (LGPD)
This section applies to data subjects in Brazil.
We process your personal data under the following legal bases of Lei 13.709/2018:
- Art. 7, V (contract performance) for providing the platform service
- Art. 7, IX (legitimate interest) for reading analytics and platform security
- Art. 7, II (legal obligation) for compliance with applicable law
You have the right under Art. 18 LGPD to: confirm processing, access your data, correct inaccurate data, anonymise/block/delete unnecessary data, request portability, delete consent-based data, obtain information about sharing, and revoke consent. Requests are processed within 15 days.
International transfers from Brazil use ANPD-approved standard contractual clauses where applicable (Resolution CD/ANPD No. 19/2024).
14. China Disclosures (PIPL)
This section applies to natural persons within the People's Republic of China.
Processing of your personal information by ChatYAML constitutes processing activities aimed at providing services to natural persons within China under Art. 3(2) PIPL. We comply with the Personal Information Protection Law (effective 1 November 2021).
We collect and process your personal information based on your consent (Art. 13(1) PIPL) for the purposes described in this policy. You may withdraw consent at any time; withdrawal does not affect prior lawful processing.
Before transferring your personal information outside China, we will: provide you with information about the destination country's data protection system, the recipient's identity, the data transferred, the purpose, and how to exercise your rights in relation to the transfer; and obtain your separate consent (Art. 39 PIPL).
You have the right to: know and decide, access and copy, correct and supplement, delete, and request explanations. You also have the right to refuse automated decision-making. Requests are processed without undue delay.
15. India Disclosures (DPDP Act 2023)
This section applies to data principals in India.
We process your personal data as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023). Processing is based on your consent (Section 6) collected before or at the time of first use of the platform. Our privacy notice is available in English.
You have the right to: access information about processing (Section 11), correction and erasure (Section 12), grievance redressal (Section 13), and nomination of a representative (Section 14).
Our Grievance Officer for India-related requests: contact us via /contact.
We will notify you and the Data Protection Board of India of any personal data breach likely to cause harm to you, in accordance with Section 8(6) DPDP Act.
16. Children's Privacy
ChatYAML is not directed at children under 13 (or under 16 in the EU, 18 in India under the DPDP Act, or 18 in Australia under the Children's Privacy Code).
We do not knowingly collect personal information from children. We do not track, behaviourally monitor, or target advertising at minors. If you are a parent or guardian and believe your child has provided us with personal information, contact us immediately via /contact and we will delete it.
In jurisdictions where parental consent is required for users under a specified age (EU: 16, US: 13 under COPPA, India: 18), we require verifiable parental consent before allowing access.
17. Data Breach Notification
In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will:
- Notify the relevant supervisory authority within 72 hours of becoming aware (GDPR / UK GDPR); as soon as reasonably possible for other jurisdictions
- Notify you directly where the breach is likely to result in high risk or significant harm to you
- Document all breaches in our internal breach register regardless of whether notification is required
18. Changes to This Policy
We will update this page when our practices change or when regulations require it. The effective date at the top reflects the most recent revision. For material changes, we will notify active account holders via an in-app notification.
Version History
| Version | Date | Summary of Changes |
|---|---|---|
| 1.1 | 2026-07-25 | Corrected the subscription status values (removed the non-existent "paused" state — the payment-failed state is "past_due"); removed references to deprecated reading-mode localStorage keys (chatyaml_read_mode, chatyaml_guided_prompt_dismissed); clarified that application logs are sent to our monitoring provider (New Relic) rather than stored in-database; added this version history. |
| 1.0 | 2026-06-26 | Initial comprehensive multi-jurisdiction privacy policy. |
Previous versions of this policy are available on request via /contact.
19. Contact and Requests
To exercise any right described in this policy, report a privacy concern, request data deletion, or ask a question about how we handle your data:
- Contact form: /contact
We will acknowledge your request promptly and respond within the timeframe required by the law applicable to your location (see Section 9.3).
This privacy policy was prepared based on direct analysis of the ChatYAML source code — including all database migrations, authentication flows, analytics tracking, caching layers, third-party integrations, and data storage patterns — combined with the requirements of applicable privacy laws across the EU, UK, USA, Brazil, China, Canada, Japan, Australia, India, South Africa, Singapore, South Korea, Thailand, and Nigeria.