Privacy

Your account. Your name, your email address and a hashed password. If you subscribe, Stripe holds your payment details — we never see a card number.

Your campaigns. Everything you write or import: people, places, factions, items, sessions, recaps, facts, notes and maps. This is the bulk of what we store and all of it is your own work.

How you use it. Which pages and features you open, how long they are on screen, and which buttons you press. Names, counts and timings — never the contents of your campaign.

Where you are and what you use. The country, region and city our host works out from your IP address (the address itself is not stored), your device type, browser, language and time zone, and the site or link that first brought you here. If you sign in with Google, we keep what Google includes in the sign-in: your name, address, profile picture, and your work or school domain if you use one. We never ask Google for more, and we do not ask your age or gender.

When you ask the assistant for something — a draft, a debrief, an import, an answer at the table — the relevant part of your campaign is sent to a model provider so it can answer. Today that is Google (Gemini) and, for some features, OpenAI. Nothing is sent unless you ask for something.

Both providers are used under terms that prohibit training on the content sent through their paid interfaces. We do not train any model of our own on your campaign, and we never will — if that changes, it would be an opt-in you are asked about, not a line added to this page.

Voice. When you dictate or record a debrief, the audio is sent for transcription and discarded immediately afterwards. Only the text is kept, and only where you put it.

Our own usage records stay with us, in the same database as your account. A page address is recorded with its ids taken out, a button by the label printed on it, and text typed into the app is never recorded. Where a button sits inside a list of your campaign’s things, its text is not recorded either. They are kept for thirteen months.

In Brazil, the European Union, the European Economic Area, the UK and Switzerland we ask first, and nothing is recorded until you say yes. Everywhere else it is on unless you turn it off. Either way you can change your mind at any time from Privacy choices at the bottom of any page or on your account page, and a no also stops PostHog and Google Analytics.

If your browser sends Global Privacy Control or Do Not Track, none of this is recorded, whatever else is chosen.

We use PostHog to see which parts of the app get used and where people get stuck. It receives event names, counts and timings — signed up, import committed, debrief completed — along with your plan and a user id.

It never receives the contents of your campaign. There is a fixed list of properties allowed to leave the app and campaign content is not on it, which is enforced in the code rather than by anyone remembering.

Session recordings are captured with every text field and every piece of page text masked, because a recording of the debrief screen would otherwise be a recording of your campaign.

Only the services needed to run the thing:

• Google Cloud — the Gemini models
• OpenAI — some model features
• MongoDB Atlas — where your campaigns are stored
• Stripe — payments and invoices
• SendGrid — the emails we send you
• PostHog — product analytics

We do not sell data to anyone, and there are no advertisers because there are no adverts.

Your campaigns stay until you delete them or close your account. Closing your account schedules everything for erasure in thirty days, and signing in during that window cancels it. After thirty days it is gone and we cannot get it back.

Detailed records of assistant use are kept for ninety days and then summarised; page and button records for thirteen months. Invoices are kept as long as the law requires, which is generally seven years.

A copy of everything we hold about you, a correction, or deletion. Deletion you can do yourself from your account; for the rest, write to us and we will do it.

If you are in the UK or the EU, the lawful bases we rely on are contract (running the service you are paying for) and legitimate interest (keeping it working and knowing which parts are used). You can object to the second at any time.

Yarnfold is not intended for anyone under 16, and we do not knowingly hold data about anyone under 16. If you believe we do, tell us and we will remove it.

If this page changes in a way that matters, we will email you rather than quietly updating the date at the top.

Questions, requests or complaints: write to us. We would rather hear from you than have you guess.