Privacy Policy

Account information

• Email address and a password (stored only as a secure hash), or, if you sign in with Google, your name, email address, and profile picture from your Google account.
• An optional display name and avatar/cosmetic preferences you choose.

Content you provide

• Study sources you upload or link (documents, PDFs, images, web links) so we can generate a course from them.
• Generated and study content: the courses, flashcards, quizzes, and notes created for you, plus your study progress, scores, streaks, and messages you send to the Yoki tutor.

Billing information

• Subscription and credit-purchase records, and a customer identifier from our payment processor. We do not store your full card details; payments are handled by Stripe.

Technical and usage information

• Authentication session cookies, basic device/browser information, IP address (used for rate limiting and abuse protection), product analytics events (for example, which features are used), and session recordings of how the app is used to help us improve it. Recordings have all form inputs masked(we never capture what you type, such as passwords, email, or your study prompts), and card details are entered on our payment provider's own page, never within our recordings.

• To create your account and provide the Service (build courses, run study tools, the tutor).
• To process payments, manage subscriptions and credits, and prevent abuse.
• To send you essential service emails (sign-in, password reset, billing).
• To understand how the Service is used so we can improve it, and to keep it secure.

If you are in the EU/EEA, we process your personal data under the following legal bases (Art. 6 GDPR):

• Performance of a contract - to create your account and provide the Service you signed up for (building courses, the tutor, study tools, processing payments).
• Legitimate interests - to secure the Service, prevent abuse and fraud, and understand and improve how it is used, balanced against your rights.
• Consent - for non-essential analytics and session replay, which we only run where you have agreed; you can withdraw consent at any time.
• Legal obligation - to keep records we are required to keep, such as billing and tax records.

Yoki is an AI-powered learning tool. To generate courses, answer tutor questions, and grade practice answers, the sources and prompts you provide are sent to third-party AI model providers through our AI gateway (OpenRouter) to produce the requested output. We tag these requests with a user identifier for usage monitoring and cost tracing (via Langfuse). We do not use your private content to train our own models, and our providers process it to return your result, not to advertise to you.

We share personal data only with service providers that help us run Yoki, each bound to protect it and use it only on our instructions:

• Supabase - database, authentication, and file storage.
• Vercel - application hosting.
• Stripe - payment processing and subscription billing (merchant of record).
• OpenRouter and the underlying AI model providers - generating course and tutor content.
• Google - sign-in with Google (only if you choose it).
• Cloudflare Turnstile - bot and abuse protection.
• Resend - transactional email delivery.
• PostHog - product analytics and session replay (with form inputs masked); Langfuse - AI usage/cost tracing.

We do not sell your personal data, and we do not share it for third-party advertising.

We use strictly necessary cookies to keep you signed in and to secure the Service; these are always on and need no consent. Analytics and session replay only run if you choose "Allow"on our cookie banner, and they capture nothing until you do. We never use advertising cookies. You can change your mind any time by clearing cookies (which also signs you out), and we honour your browser's Global Privacy Control / Do Not Track signal.

We keep your account data while your account is active. Uploaded source files are processed into your course and then deleted from storage shortly after; storage is a pipe, not a warehouse. When you delete a course it is removed; when you delete your account we delete your personal data, except where we must retain limited records (for example, billing records) to meet legal obligations.

Some of our providers process data outside your country, including in the United States. Where that happens, transfers are protected by appropriate safeguards such as the EU Standard Contractual Clauses.

Depending on where you live (and in particular under the EU/UK GDPR), you have the right to access, correct, delete, or export your personal data, to restrict or object to certain processing, and to withdraw consent at any time. You can manage your profile and delete content in the app, or contact us at [email protected] to exercise any right. We respond within one month, as required by the GDPR. You also have the right to lodge a complaint with your local data protection authority. In Romania that is the National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro).

We protect your data with encryption in transit, row-level access controls so each user can only reach their own data, hashed passwords, and rate limiting. No method of transmission or storage is perfectly secure, but we work to keep your data safe and to respond quickly if something goes wrong.

Yoki is not directed to children under 16, and we do not knowingly collect their data. If you believe a child has provided us personal data, contact us and we will delete it.

We may update this policy as the Service evolves. We will post the new version here with an updated date, and for material changes we will give you reasonable notice.

Questions about your privacy or this policy? Email us at [email protected]. See also our Terms of Service.