Privacy Policy

Information we collect

Account and profile information. We collect your name, email address, account identifier, sign-in details, and any profile information you provide, such as a photo, nickname, birth year, timezone, onboarding answers, and reminder preferences.

Your content. We store the goals, waypoints, journal entries, mood selections, achievements, reflection answers, and images you add, along with generated suggestions, postcards, and reports. Voice features send audio for transcription and may save the recording and transcript in your account. You choose what to share, which may include sensitive personal information. Only add content you have the right to provide, including information about other people.

Payments and messages. Payment providers, including Stripe and Apple, handle your payment details. We receive information needed to manage your subscription, such as customer identifiers, plan, and payment status. We do not store full payment card numbers. When you contact us or send feedback, we receive your message and related account information.

Technical and usage information. We and our providers receive information such as IP addresses, device and browser details, sign-in activity, feature usage, and error reports to run and protect YearCraft and manage plan limits. When you arrive from a link or an ad we published, we also keep which one brought you here.

Signing in through another service

If you choose Google or Apple sign-in, we receive the account identifier, email address, and available profile details that the provider shares with us. We use these to create or identify your account and sign you in. We may keep tokens that support the connection. Google sign-in does not give us access to your Gmail, Drive, contacts, or calendar.

We do not sell Google account information or use it for advertising or to train general-purpose AI models. You can revoke sign-in access through your provider’s account settings. Revoking access does not delete your YearCraft account.

How we use information

We use information to save and display your content, personalize your experience, provide AI features, manage accounts and subscriptions, send reminders and service messages, respond to support requests, understand use of YearCraft, measure our own marketing, improve reliability, prevent abuse, and meet legal obligations.

We do not sell your journal, recordings, goals, or anything else you create, and we never share that content for advertising. We do share limited website, device, and purchase information with Meta to measure our ads, as described under cookies and device storage.

AI features

With your permission, YearCraft uses two third-party AI providers, OpenAI and OpenRouter, to support Juniper and other features. We send the information needed for each feature, which may include your name, goal titles and descriptions, waypoints, journal text, reflection answers and activity totals. Voice features send recordings and transcripts. OpenAI helps with suggestions, reflections, postcards, transcription and transcript cleanup. OpenRouter helps with transcription by passing voice recordings to Microsoft’s speech-to-text model on Microsoft Azure and returning the text.

We also use OpenAI to check Juniper’s generated suggestions and reflections for harmful content before showing them.

Before sharing, we ask you to review this processing and record your choice with the disclosure version and date. If you allow it, onboarding suggestions and reflections and titles for untitled journal entries can be generated automatically. You can decline and continue writing, setting goals and tracking achievements without AI. You can change your choice in Settings. Turning sharing off stops new AI requests; it cannot recall information already sent to a provider.

Your content is not used to train AI models. We do not train models on it, OpenAI does not use content we send through its API to train its models, and OpenRouter neither trains on it nor routes our requests to model providers that do. According to their published data practices, OpenRouter does not keep recordings once it has passed them on, and Microsoft’s speech service processes them without storing them. Our AI providers process requests under their service terms and may retain information for service operation, security, or legal reasons. AI results can be inaccurate, so review them before relying on them.

When we share information

Service providers help us run YearCraft. These include Cloudflare for hosting, file storage, and email; PlanetScale for database hosting; Sentry for error and performance monitoring; PostHog for product and website analytics; Meta for advertising measurement; Stripe and Apple for payments; and the AI providers described above. They receive information needed for their work. We require these providers to protect personal information at least as well as described in this policy. We and our providers may access account content when needed to provide features, help with support, investigate problems or abuse, or comply with law.

If you connect an outside assistant or app, it can receive YearCraft information and perform the actions allowed by the connection. Depending on the connection, this can include reading your account and profile information and your content, or adding, changing, and deleting content. That service handles information under its own privacy policy. You can ask us to revoke access; revocation stops future authorized access but does not erase copies the other service already received.

We may also share information when reasonably necessary to comply with law, protect people or rights, or address fraud or security issues. Information may transfer as part of a merger, sale, or similar business change, subject to applicable law and the protections in this policy.

Cookies and device storage

In the iPhone app, we use Apple’s AdServices to learn whether Apple attributes an app download to one of our ads. We send Apple’s temporary attribution token to Apple and keep the campaign identifiers and attribution details it returns. A random identifier stored within the app lets us count the first observed open and connect it to your account when you sign in. We use this information with onboarding and subscription records to measure our campaigns. We do not send Apple your journal, goals, or account information for this measurement. Unlinked installation records are deleted after 90 days; linked records are included in account export and deletion.

We use cookies and device storage for sign-in, security, and preferences. When you arrive from a link or an ad we published, a first-party cookie remembers which one brought you here for 30 days, and we keep that note with your account if you sign up, so we can tell which of our own efforts work. We use PostHog to understand page visits, feature use, and conversions across our website and apps. Analytics may include an account identifier, device information, and campaign information. We exclude journal text, recordings, and other content you create. To opt out, email support@yearcraft.com. You can manage cookies in your browser, although blocking essential cookies may prevent features from working.

We advertise on Meta’s platforms and use Meta’s tools to measure those ads. On our website, Meta’s pixel runs on marketing, sign-up, and checkout pages, never on your journal, goals, or other content pages, and may receive the page visited, Meta’s browser and click identifiers, and your device and browser information. When you create an account or buy Pro, our server sends Meta that event with the amount and plan, matched using a hashed email address, a hashed account identifier, and the same browser identifiers. In the iPhone app, Meta’s SDK counts installs, sign-ups, and verified purchases in aggregate; we do not ask for Apple’s tracking permission and do not use your device’s advertising identifier. We never send Meta your journal text, recordings, goals, or other content. To opt out of measurement for your account, email support@yearcraft.com; the same request stops product analytics.

Our website does not currently change its behavior in response to a browser’s Do Not Track signal.

Push notifications

If you enable push notifications, we collect a device notification token and related device and account identifiers. We send notification content and delivery information through Expo and Apple’s or Google’s notification service. You can turn push reminders off in the app or your device settings.

Your choices and privacy requests

You can edit supported profile information and content in the app, manage reminders in notification settings, and export available account data from Settings. We email a download link for a ZIP archive containing structured records and available recordings, postcards and profile photos. Its export record identifies media included in the archive; unavailable files may be omitted. Contact us if you need help accessing your information.

You can control microphone permissions through your device or browser. Turning off reminders does not stop essential account, security, or billing messages. Some reminders may include goal or waypoint details, so consider who can see your email or device.

You can request account deletion through Settings or by emailing support@yearcraft.com. We schedule account deletion for 72 hours after you confirm your request. Until that time, you can cancel the request or export your data. We confirm when deletion is complete.

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, object to or restrict certain uses, or withdraw consent where we rely on it. Email us to make a request or raise a concern. We may need to verify your identity. We will respond within the time required by applicable law and will not discriminate against you for exercising your rights. Where applicable, you may appeal a decision by replying to us or complain to your privacy regulator.

How long we keep information

We keep information for as long as reasonably needed to provide YearCraft, manage your account, and meet the purposes described in this policy. The period depends on the type of information, your choices, and legal requirements.

Removing an item from view in the app may not erase its underlying record or attached media immediately. When we complete an account deletion request, we delete account information and content from our active systems, except information we need to keep for legal, accounting, security, or dispute purposes. Backups and records held by providers may remain for a limited period before they are removed under the relevant retention practices.

Security and where information is processed

We use reasonable safeguards, including access controls and encryption in transit, to protect personal information. No online service is completely secure. YearCraft and its providers may process information in the United States and other countries, where privacy laws may differ from those where you live.

Age eligibility

YearCraft is for people aged 13 and older, subject to any higher minimum age required where you live. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided information, contact us so we can investigate and delete it as appropriate.

Changes and contact

We may update this policy as YearCraft changes. We will update the effective date and provide additional notice of material changes as required by law.

For privacy questions or requests, contact Saqbach, LLC at support@yearcraft.com or write to Saqbach, LLC, PO Box 220020, Brooklyn, NY 11222, United States.