Effective 31 August 2026

Privacy Policy

What Ya knows about you, why it needs that information, and what you can do with it.

Individual Entrepreneur Daniel Tcytkin (ID 343575410), registered in Georgia, operates ya.danielcreates.xyz and is responsible for personal data processed by Ya. Privacy questions and requests can be sent to hello@ya.danielcreates.xyz.

1. The short version

Your materials are private by default. Ya uses them to provide the features you choose—not for advertising. Ya is currently built and operated by one developer, not an advertising department in disguise. I do not read your personal content as part of normal operation. Limited technical access may happen only when needed for support you request, security, incident response, or a legal obligation.

2. Information Ya keeps

Depending on what you use, Ya may keep your email address, password hash, account and consent records, sessions, temporary audio, transcripts, notes, questions, cards, terms, analyses, AI-generated material, psychologist comments, AI-credit and payment records, exports, deletion requests, and limited device, network, authentication, error, rate-limit, and security data.

Your content may reveal health, relationships, beliefs, sexuality, and other sensitive parts of your life. Ya asks for explicit consent before processing this sensitive information.

3. Audio and transcripts

Raw audio is stored privately only while it is needed for transcription. It is deleted after successful transcription, when you replace it with your own transcript, or one hour after upload—whichever happens first. Transcripts and other account content remain until you delete them or delete your account.

You are responsible for having the legal right to record a conversation and for obtaining any consent the law requires.

4. Why this information is used

Ya uses personal data to create and secure your account; store and organise your content; run features you request; perform optional AI analysis; share selected material with a psychologist when you ask; provide exports and deletion; manage AI credits and future payments; prevent abuse; fix problems; and comply with law.

The legal basis depends on the activity: performing the agreement with you, your explicit consent for sensitive data and optional AI processing, legal obligations, or legitimate interests in keeping the service secure and reliable.

5. AI

Storing something in Ya does not send it to an AI provider. Data is sent only when you choose an AI feature. Depending on that feature, this may include audio, a transcript, notes, analyses, terms, or other context needed to produce the result. Passwords and unrelated account content are not intentionally included.

Ya connects directly to the OpenAI API. OpenAI states that API inputs and outputs are not used to train its models unless the API customer opts in. Ya does not opt in and does not use your personal content to train its own models.

For text analysis, Ya disables OpenAI's application-state storage for each request. OpenAI may still keep request and response content in security and abuse-monitoring logs for up to 30 days under its standard API controls. OpenAI currently states that its audio transcription endpoint does not retain content for abuse monitoring or application state. These are OpenAI's current provider rules, not a promise that Ya has technical control over OpenAI's systems.

If Ya ever offers model training using personal content, it will be a separate, optional choice with a new notice and explicit consent. Saying no will not prevent you from using the core service.

6. Sharing with a psychologist

Nothing is shared by default. You may give a psychologist access to selected sessions, analyses, and terms. They may view those materials and leave comments. Access remains active until you revoke it. Revocation stops future access but cannot undo information someone has already lawfully viewed or separately recorded.

7. Service providers and transfers

Ya currently uses Vercel for hosting and private file storage, Neon for the database, and OpenAI for optional AI processing. If payments are enabled, Paddle is intended to process purchases as Merchant of Record. These providers receive only the information needed for their role and process it under their terms and applicable agreements.

Data may be processed outside your country. Where the law requires safeguards for an international transfer, Ya will use the required contractual or legal mechanism. Email me if you need current provider information relevant to your data.

8. How long data stays

Account content stays while your account exists, unless you delete it sooner. An account deletion request blocks access promptly, and permanent deletion is completed within 10 working days. Residual protected backups expire within 30 days. Security and technical logs are normally kept for up to 90 days. Payment, fraud, dispute, or legal records may be kept longer when the law requires it or a claim needs to be resolved.

9. Your choices and rights

You can request a machine-readable JSON or ZIP export, correct your information, delete individual materials, or delete your account. Depending on the law that applies to you, you may also ask for access, restriction, portability, or details about processing; object to certain processing; withdraw consent; and complain to a competent data-protection authority.

Withdrawing consent does not undo processing already completed lawfully, but it stops new consent-based processing unless another legal basis applies. I may need to verify your identity before completing a request.

10. Cookies

Ya does not currently use advertising cookies, tracking pixels, or optional analytics cookies. It uses only storage needed for login, security, language choice, and core operation. See Cookie settings for details.

11. Security

Ya uses technical and organisational safeguards designed to limit access and protect confidentiality, integrity, and availability. No online service can promise perfect security. If you think your account or data may be at risk, email hello@ya.danielcreates.xyz promptly.

12. Changes

This Policy may change when the service, providers, or law changes. The updated date will appear on this page, and material changes will receive additional notice where required.