Privacy Policy

Scope

This policy covers the Yotara marketing site at yotara.website and the hosted beta at beta.yotara.website. The Beta is currently operated by the Yotara project maintainer as an individual. It does not govern an independently operated Yotara installation. For a self-hosted installation, the person or organization operating that instance is responsible for its data practices, providers, cookies, logs, security, retention, and legal notices.

Hosted Beta Data

To provide the beta, we may process your name, email address, password and authentication records, sessions, email-verification and password-reset information, account preferences, tasks, projects, labels, descriptions, notifications, and other content you choose to store in the service.

We may also process technical and security information such as IP addresses, user-agent information, request and service logs, rate-limit records, blocked-address records, and email-delivery records. We use this information to authenticate accounts, deliver transactional messages, operate and secure the beta, prevent abuse, troubleshoot issues, and comply with applicable law.

Do not submit information to the beta that you are not comfortable storing on an experimental service. Beta data may be reset, deleted, or lost as described in the Beta Terms of Service.

Cookies and Storage

The hosted Yotara app uses an essential, HTTP-only session cookie to keep you signed in. It is used for authentication, not advertising or cross-site tracking. The app may also use browser local storage for local preferences such as theme and interface settings.

The marketing site does not use advertising cookies or tracking cookies. It uses one localStorage value to remember whether you dismissed the privacy notice. Cloudflare may process connection information when delivering the marketing site and hosted beta.

Hosting and Third-Party Services

The hosted beta runs on infrastructure provided by Amazon Web Services (AWS) and uses Cloudflare for network delivery, proxying, TLS, caching, and related security or operational services. Cloudflare analytics or performance services may be enabled for the beta and may collect connection or usage information according to Cloudflare's own policies.

The beta uses an email-delivery provider, currently Resend, to send account-verification and password-reset messages. That provider receives the information needed to deliver those messages and may retain delivery and abuse-prevention records under its own policies.

These providers operate independently and may process information in locations outside your country. Their services, policies, security, availability, and retention practices are outside our complete control. The provider set may change as the beta develops.

The marketing site is served through Cloudflare's CDN. Its fonts, stylesheets, and images are self-hosted, and it does not intentionally load Google Fonts or advertising scripts.

Self-Hosted Yotara

The open-source Yotara software is designed so an operator can keep application data on infrastructure they control. An independent operator chooses the hosting provider, email service, analytics, reverse proxy, backups, logs, retention periods, and access policies. That operator is responsible for giving their users an appropriate privacy policy and other legal notices.

The software does not automatically send data to Yotara merely because it is installed. Optional services or deployment changes made by an operator may change that behavior. This privacy policy does not apply to those independent deployments.

Retention and Choices

We retain hosted-beta information for as long as reasonably necessary to operate the beta, maintain security, meet legal obligations, resolve disputes, and preserve limited operational records. Because this is a beta, retention periods and deletion processes may change, and copies may remain temporarily in backups, logs, or provider systems after an account or service deletion.

You may stop using the beta and request account deletion through the available account controls. Transactional email is required for account verification and password recovery. For privacy questions or requests, contact us using the channels below. We may need to verify identity and may be unable to fulfill requests where a legal or security exception applies.

Security

The beta uses measures such as password hashing, secure session cookies, authentication controls, rate limiting, and account-abuse protections. Passwords are stored as hashes, not as plain text. No online service or deployment is guaranteed to be completely secure. Keep your credentials private and report suspected vulnerabilities through the Yotara security policy.

For self-hosted installations, the operator is responsible for keeping the server, containers, dependencies, secrets, reverse proxy, and backups secure and up to date.

Contact

If you have questions about privacy or security, open an issue on GitHub or email privacy@yotara.website.