Privacy Policy

Effective Date: July 8, 2026 · Last updated: September 30, 2026

This Privacy Policy outlines how yarnnn ("we", "our", or "us") collects, uses, and protects your information when you use our services.

1. Information We Collect

We collect the following types of information:

• Account Information: Email address, name, and profile data from authentication providers (Google, etc.)
• Content: Documents you upload, notes and memories you save, workspace files you store, and tasks you manage — including anything you choose to save through a connected LLM assistant (see §5)
• Provenance & metadata: For each saved item, we record when it was written, which source contributed it (you, a connected assistant, or YARNNN itself), and its revision history. This attribution is core to the product
• Usage Data: How you interact with our services, features used, and work requests made
• Work Outputs: AI-generated content created through our agents and recurring tasks

2. How We Use Your Data

• Provide and improve our AI work platform services
• Generate context-aware outputs through autonomous agents and tasks
• Send service-related communications (e.g., daily updates or account notices)
• Maintain security and prevent abuse

We do not sell your personal data or share it with third parties for marketing purposes.

3. Data Storage & Security

Your data is stored using Supabase (PostgreSQL) with application and database access controls. All data transmission is encrypted via HTTPS. Connector credentials are encrypted where stored as credentials, and we continue to harden credential rotation, retention, and deletion coverage. For a plain-English overview of the architecture and its current limits, see our Privacy Architecture.

4. Third-Party Services

We use the following third-party services as data processors:

• Supabase: Authentication and database (PostgreSQL)
• Render: Application and connector hosting
• Vercel: Web hosting and analytics
• AI providers (Anthropic, OpenAI, Google, DeepSeek, xAI): when you ask an AI to work, the files needed for that task are sent to the provider running it. Which provider depends on the model chosen for the task. Content sent this way is processed under each provider's API terms, which do not use API content for training by default. We rely on those standard published terms — we do not hold a separately negotiated training prohibition with them
• OpenAI (search indexing): separately from the above, the text of your files is sent to OpenAI to build the embeddings that make your workspace searchable. This happens as files are written, not only when you ask an AI to do something
• Sentry: crash and error reporting, configured not to collect personal data
• Resend: transactional email delivery
• Lemon Squeezy: payments and billing

This list is the complete set of third parties that can receive your content or personal data. If we add one, we will update this page.

5. Connected LLM Assistants (MCP Connector)

YARNNN can be connected to LLM assistants you already use — such as ChatGPT, Claude, and others — through the open Model Context Protocol (MCP). This connection is established by you, through your assistant, using OAuth; you authenticate as yourself and the connection is scoped to your own workspace.

When a connected assistant is authorized, it acts on your behalf with the same reach over your workspace that you have. It can:

• Read your files, list and search your workspace, and view how any file changed over time
• Write new files and edit existing ones (attributed to that assistant)
• Move, rename, and delete files
• Share — mint a link to a file or the workspace, including links that grant full member access to whoever opens them

We state this plainly because it is a larger authority than "save and recall." Connect assistants you trust. Every action an assistant takes is signed with its name and kept in the file's revision history, so you can see what it did and walk it back.

What this means for your data: content you save through one assistant becomes part of your durable YARNNN memory and is therefore available to you through any other assistant you have connected, as well as in the YARNNN web app. The assistant's provider (e.g. OpenAI for ChatGPT) processes the request under its own privacy terms; YARNNN stores the resulting content and its attribution. We record which assistant contributed each item so this provenance is transparent to you. You can disconnect any assistant at any time from within that assistant's settings, which revokes its access to your workspace.

6. yarnnn for Chrome (Browser Extension)

The yarnnn extension for Chrome lets your yarnnn agent carry out web tasks you ask for in chat, in your own Chrome, using the sign-ins you already have there.

• What it can reach: only the tabs it opens itself, kept in a tab group named "yarnnn" that you can see. It does not read your other tabs, your browsing history, your clipboard or your screen.
• Pointing and pictures: when a page draws what your agent needs instead of labelling it (a calendar's grid, a canvas), the extension can drag, type and point in its own tab, and take a picture of that tab only. It does this through Chrome's debugger, attached to that one tab, so Chrome shows a bar saying yarnnn is debugging the browser while it works; closing the bar stops it in that tab. A picture is sent to yarnnn and the AI provider running your chat (section 4) for that one step, and is never kept.
• Your consent: you give it once, by adding the extension and connecting it to yarnnn. Your agent can then use any site except banking and payments, trading and crypto, password managers and account security pages, which are never allowed, and any site you keep it off. On those sites it does what you ask, as you — sending and posting included — and every step is listed in History. You can switch it off, or keep it off a site, at any time from its button in Chrome's toolbar.
• What leaves your computer: when your agent reads a page, the page's text and its buttons, links and fields (including what the fields contain) are sent to yarnnn, and to the AI provider running your chat (section 4), to carry out your request. The contents of a password field never leave the page. Your sign-ins are used where they are, in your Chrome. The extension never reads or sends your cookies or saved passwords.
• What we keep: a short record of each step (what was done, on which site, and whether it worked) is saved as the run it belongs to, which the other members of your workspace can see; the chat itself stays yours. Page content becomes part of your workspace only if your agent saves it into a file, where you can see it and its history like any other file.
• On your computer: your on/off setting, the sites you keep it off, and the connection key yarnnn gave it are stored in Chrome on that computer only. The key lets it fetch the web tasks you asked for from yarnnn — so they keep going when you close yarnnn — and you can disconnect it at any time; yarnnn keeps only a fingerprint of the key, never the key itself.
• Who can talk to it: only pages on yarnnn.com, and yarnnn's own servers over the connection you set up.

Data the extension handles is used only to carry out what you ask. It is never sold, never used for advertising, and never used to determine creditworthiness or for lending. yarnnn's use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

7. Google Workspace Connections (Gmail & Google Calendar)

When you connect Gmail or Google Calendar, yarnnn acts only as your hands: it reads or changes your mail and calendar when you ask for it in a chat, through your own Google sign-in, as you. Nothing is read or sent on a schedule, and no agent acts through your Google connection on its own — only a conversation you are present in.

• Gmail. With the gmail.readonly and gmail.compose scopes, and only when you ask in a chat, yarnnn can search your mail and read a thread, and draft or send a message as you. It never deletes mail, never changes labels, and reads nothing until you ask for it. What a message says is treated as text to report to you, never as an instruction to act on.
• Google Calendar. With the calendar.events scope, and only when you ask in a chat, yarnnn can list your events and create, change or remove one as you. It reads and writes events only; it does not change calendar settings or sharing.
• Where it goes. A request to Gmail or Calendar goes from yarnnn's server directly to Google, authenticated with your own token. It is not sent to any other third party. What a tool reads back is used to answer you in that conversation, and to the AI provider running your chat (section 4) for that request; it becomes part of your workspace only if you ask to save it into a file.
• Your token. Google's access and refresh tokens are held encrypted and are used only to make the calls you ask for. They are never shared, sold, or used for any purpose but carrying out your requests. You can disconnect Gmail or Calendar at any time from Agents → Connections, or revoke yarnnn's access directly in your Google Account permissions; disconnecting removes the stored token.

yarnnn's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, data obtained through the Gmail and Google Calendar scopes is used only to provide and improve the features you invoke; is not transferred to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition; is not used for advertising; and is not read by any human except with your explicit consent for support you request, to comply with applicable law, or in aggregated and anonymized form for internal operations. yarnnn does not use Gmail or Calendar data to train generalized artificial-intelligence models.

8. Your Rights

You have the right to:

• Access your personal data
• Request deletion of your account and data
• Export your content
• Opt out of non-essential communications

9. Data Retention

Nothing expires on a schedule. We do not run a retention timer: trash holds until you empty it, and no background process deletes your work after a fixed period. This is deliberate — a timer means the system destroying your work with nobody watching. If a timer is ever offered it will be a setting you turn on, not a default.

When you delete a file permanently, reset your workspace, or delete your account, removal is immediate rather than queued. Deleting your account removes your workspace files, their full revision history, and your account record. Some stored file contents may persist in backing storage after account deletion; completing that cleanup is named in our data page as current work. We retain what the law requires us to retain.

10. Changes to This Policy

We may update this policy and will notify you of material changes. Continued use after changes constitutes acceptance.

11. Contact Us

Questions about privacy? Contact us at admin@yarnnn.com