Privacy Policy

Last Updated: September 7, 2026

Welcome to yes&. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, a saved collection of AI art prompts.

1. Information We Collect

1.1 Information You Provide

Account Information

When you create an account using Google Sign-In, we collect:

• Email address
• Display name
• Profile picture (from your Google account)

Profile Information

You may choose to provide additional information such as:

• Custom display name
• Custom profile picture/avatar
• Bio/description

User-Generated Content

When you create and publish prompts, we collect:

• Prompt titles
• Prompt text/descriptions
• AI model used (e.g., Midjourney, GPT Image, FLUX)
• Uploaded images (output artwork and reference images)
• Source attribution (original author name and source URL, if provided)
• Category selection

Interactions

We collect information about your interactions with the platform:

• Prompts you save/favorite
• Prompts you create

Face Scan Data (Avatar Creation)

If you choose to create a personalized avatar in our mobile app, we collect the following during the optional guided face scan:

• Photos of your face (front, left, and right views)
• A short video of the scan (up to 30 seconds)

This data is used to generate your avatar and to improve avatar features. Your front-facing photo is shared with our AI generation partners solely to create your avatar (see Section 3). Face scan data is stored securely, is never used for advertising, facial recognition of others, or sold to third parties, and is deleted when you delete your account. The face scan is optional — you can skip it at any time and still use yes&.

Contacts (Optional)

If you grant our mobile app access to your contacts to find or invite friends, phone numbers are hashed (SHA-256) on your device before being sent to our servers. We only compare these hashes against hashes of registered users' phone numbers. We do not receive or store your contacts' names, plain-text phone numbers, or any other address book details, and we never contact anyone on your behalf without your action.

1.2 Information Collected Automatically

When you use yes&, we may automatically collect:

• Device information (browser type, operating system)
• A device identifier in the mobile app (on iOS, Apple's identifier for vendor), stored with your account so we can detect abuse of free credits — for example one device creating many accounts — and keep accounts secure. It is never used for advertising or cross-app tracking.
• Usage data (pages visited, time spent)
• Timestamps of account creation and content submissions
• Product analytics and crash diagnostics (collected via PostHog and associated with your account), such as feature usage, screens viewed, and app errors — used to improve the product, never for advertising

2. How We Use Your Information

We use the information we collect to:

• Provide and maintain the service: Display your profile, show your created prompts, and enable saving favorites
• Generate content you request: Process the prompts you write and the photos or videos you attach through our AI generation providers (see Section 3.2) to create the image or video you asked for
• Personalize your experience: Show your saved prompts and creations
• Improve our platform: Analyze usage patterns to enhance features
• Communicate with you: Send service-related announcements if necessary
• Ensure security: Protect against unauthorized access and abuse, including detecting one device or person creating many accounts to farm free credits

3. How We Share Your Information

3.1 Public Information

The following information is publicly visible on yes&:

• Your display name
• Your profile picture
• Your bio
• Prompts you publish (including title, prompt text, images, model used, and source attribution)

3.2 Third-Party Service Providers

We use the following third-party services:

Supabase

• Provides authentication, database, and file storage services
• Stores user data, prompts, and uploaded images
• Supabase Privacy Policy

AI Generation Providers

When you create content with yes&, the prompt text you write and any photos or videos you attach are transmitted to third-party AI service providers that perform the generation on our behalf — currently Google, OpenAI, fal.ai, and ByteDance. This data is used solely to process your generation request:

• What is sent: your prompt text and any media you attach to a generation request
• What is not sent: your name, email address, or other account details
• These providers act as our data processors: they are required to protect your data with safeguards equivalent to ours and may not use it for their own purposes
• In the yes& mobile app, we ask for your permission before your content is first shared with these providers

Google (OAuth)

• Provides authentication services
• We receive basic profile information when you sign in with Google
• Google Privacy Policy

3.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities.

4. Data Storage and Security

• Your data is stored securely using Supabase's infrastructure
• Images are stored in secure cloud storage (Supabase Storage)
• We implement appropriate technical and organizational measures to protect your personal information
• However, no method of transmission over the Internet is 100% secure

5. Your Rights and Choices

5.1 Account Information

You can:

• Update your display name and bio through your profile settings
• Change your profile picture at any time
• Delete prompts you have created
• Remove prompts from your saved collection

5.2 Account Deletion

To delete your account and associated data, please contact us at contact [at] yesand.ai.

5.3 Data Access

You may request access to the personal information we hold about you by contacting us.

6. Children's Privacy

yes& is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

7. International Data Transfers

Your information may be transferred to and processed in countries other than your own. By using yes&, you consent to such transfers.

8. Cookies and Tracking

We use essential cookies and local storage for:

• Authentication (keeping you logged in)
• Session management

We do not use third-party tracking or advertising cookies.

9. Third-Party Links

yes& may contain links to third-party websites or services (such as source links for prompts). We are not responsible for the privacy practices of these external sites.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by updating the "Last Updated" date at the top of this policy. We encourage you to review this Privacy Policy periodically.

11. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

• Instagram: @yesand_ai
• X (Twitter): @yesand_ai
• TikTok: @yesand.ai
• Threads: @yesand_ai

Summary of Data We Collect

By using yes&, you acknowledge that you have read and understood this Privacy Policy.