Privacy Policy

This policy explains what personal data yothere processes, why, and the rights you have under the EU General Data Protection Regulation (GDPR / DSGVO). yothere is an open beta; this policy will be updated as the product matures. Where the honest answer is unflattering (see retention and deletion, section 8), we write the honest answer.

1. Controller

The controllers responsible for data processing are Philipp Wenger Lebron and Oscar Sanchez (see the Impressum for contact details). For any privacy request, contact [email protected].

2. Scope

This policy covers two surfaces:

• The marketing site at yothere.ai (this website).
• The hosted app at app.yothere.ai, the control plane for your agent fleet.

It does not cover what happens on your own machine. The agents run there, under your own coding agent CLI and your own model subscription (Claude Code from Anthropic, or the Codex CLI from OpenAI). Those providers' terms and privacy policies govern the model calls your agent makes. We never receive your model credentials, and the agent turns that do your work never run on a model of ours.

Hosted voice is the exception, and it is worth being exact about. Voice does not run on your machine. When you connect, your browser joins a media room and a voice worker of ours (running on our own infrastructure, not yours) joins the same room, receives your audio, and runs the conversation on Google Gemini under our API key. The assistant can read your inbox back to you, answer a blocked thread, and search your finished threads, so that content (thread titles, questions, drafts, results) is sent to Gemini along with what you say. While the call is live, its rolling transcript is sent to our control plane so the cockpit can render it; the moment the call ends, the transcript is deleted. Call content does not persist on our servers after the call. Voice is the one place your audio and your task content reach infrastructure and a model we operate, for the duration of the call. If you do not want that, do not use voice: everything else works without it.

3. Data we process on the marketing site

• Waitlist / access requests. If you submit the waitlist form, we store the email address you provide, your optional note, your coarse country (derived by Cloudflare from the request, never your IP address), and, where present, session attribution (campaign/UTM parameters and the referring page) in Cloudflare Workers KV, solely to contact you about beta access and to understand how people find yothere. We do not store your user agent or IP address with the entry. Entries expire automatically after 12 months. We do not use them for unrelated marketing.
• Server logs. Our host (Cloudflare Pages) processes standard request metadata (IP address, user agent, timestamp) transiently to serve the site and prevent abuse.
• Privacy-preserving analytics. We measure page views (including when you leave a page), anonymous page-performance metrics (Core Web Vitals), and a small set of explicit interactions (for example, submitting the waitlist form) with PostHog, hosted in the EU (Frankfurt) and configured cookieless: no cookies, no persistent identifiers, no session recording, and the client IP address is discarded. Analytics requests are sent to our own domain and forwarded to PostHog's EU servers. To understand where visitors come from, we keep campaign (UTM) parameters and the referring page in your browser's sessionStorage for the current session only; it is deleted when you close the tab.
• Reddit advertising measurement. When we run ads on Reddit, the Reddit pixel tells us which of them actually work. We run it in its cookieless mode: it storesnothing on your device, no cookies and no identifiers, which is why this site still has no cookie banner. What Reddit receives is the page you are on and standard request metadata such as your IP address and user agent, at two moments: opening a page, and reaching our pricing page. We never send Reddit your email address or anything you type. Our legal basis is our legitimate interest in knowing which campaigns are worth paying for (Art. 6(1)(f) GDPR). You can object at any time via the address in section 9, and you can object without asking us: if your browser sends Global Privacy Control or Do Not Track, we do not load the pixel at all. We check those signals ourselves because Reddit's own code ignores them. Reddit also uses this data for its own purposes underits privacy policy.
• Reddit signup reporting (from our server, not your browser). If you arrive by clicking one of our Reddit ads, Reddit adds a click identifier to the link (rdt_cid). We keep it for your session in the same way as the campaign parameters above, and if you go on to create an account, our server tells Reddit thatthat click converted. This is how we learn which ads are worth their cost when your browser blocks the pixel. We send Reddit only that click identifier, the time, and the signup page address: no email address (not even a hashed one), no name, no IP address, and nothing you typed. If you did not arrive from a Reddit ad there is no click identifier, and we send Reddit nothing at all about your signup. Same legal basis and same right to object as above.
• Demo video (YouTube). The demo video on the homepage loads nothing from Google until you press play. Starting it embeds the video from YouTube's privacy-enhanced domain (youtube-nocookie.com); from that point YouTube (Google) receives standard request metadata such as your IP address to stream it.

4. Data we process in the app

• Account. Your email and a password stored only as a cryptographic hash (never in plaintext). Sessions and login attempts are recorded so we can keep the account secure. If you arrive from our website, the campaign parameters, referring page, landing page, and any Reddit ad click identifier from that visit (see section 3) are stored on the account so we know which channels work; this acquisition record is deleted with the account.
• Subscription. Your card details are handled entirely by Stripe (for Creala LLC, the company that operates our billing) and never reach us. We store only your Stripe customer and subscription identifiers and your plan status, so we know your account is active. The legal basis is performance of our contract with you (Art. 6(1)(b) GDPR).
• Task data. The instructions you dispatch, the state of each thread, and the results your agents return. The AI compute runs on your own machine, with your own model credentials. Our control plane stores the thread and result data so you can see your fleet from any device. If your machine is asleep, dispatched tasks simply sit in our database until it reconnects.
• Cost ledger. Per-thread and per-day cost records, so the caps can be enforced and you can see what a thread spent.
• Device pairing. Tokens that link your machine to your account. Only a sha256 hash is stored server-side, never the token itself.
• Voice. Voice is hosted, and the media does not stay on your machine. When you click Connect, your browser joins a media room run by Daily (our SFU). A voice worker of ours, running on our own Fly.io infrastructure, joins that room, receives your audio, and runs the conversation through Google Gemini on our API key. To answer "what's waiting on me?" that worker fetches your open inbox, and to pick a thread back up it searches your finished ones, soyour thread content is sent to Gemini along with your speech. Audio is processed in real time: we do not enable call recording and we do not store the audio. While the call is live, the worker pushes a rolling transcript to our control plane so the cockpit can render it; when the call ends, the transcript, the session snapshot, and the call's network-signaling data are all deleted in the same database write that closes the call. What remains is content-free call metadata (when the call started and ended, and whether it closed cleanly), which we keep briefly for support and billing. The voice worker's own disk is configured to never write call content at all. We use Gemini through the paid Gemini API on our own key, under which Google's terms state that Google does not use the prompts or responses to improve its products, and logs them only for a limited period to detect abuse; Google does not train on your call content. Work the assistant dispatches during a call becomes a thread, and threads persist like any other thread until you archive or delete them. Anything you say in a call is content: treat it as you would treat typing it into the cockpit.
• Product telemetry (server-side, keyed to your tenant). The app writes event rows we use to run and improve the beta: activation milestones (for example, your first dispatched thread), usage events (when you steer a thread), error events (an exception, its type, the HTTP status, and a detail string), feedback events (what you submit through the feedback form), and email events (delivery and engagement signals from our email provider, with recipient and purpose, never message content). These rows carry your tenant identifier, so they are personal data, and we disclose them rather than call them "anonymous". They are not sold, not shared with advertisers, and not fed to any third-party product analytics tool.
• Web-push subscriptions. If you turn on push notifications, we store the push subscription your browser hands us: the endpoint URL plus the p256dh and auth keys. To deliver a notification, we send it to that endpoint, which belongs to your browser vendor's push service (Google for Chrome, Apple for Safari, Mozilla for Firefox). Those services are therefore recipients of the notification payload and its metadata. Turning notifications off in the cockpit removes the subscription.
• Data on your own machine. yothere runs your agent on your own computer, so some records live there, on your disk, not ours: a copy of each call's transcript, logs of any failed turn, short call debriefs, and the session history your coding agent (Claude Code or Codex) keeps under its own directory. yothere ages these out automatically, and yothere local wipe erases them on demand (add --harness to include your coding agent's own session files). This is your data on your device; we never receive it.

5. Legal bases (Art. 6 GDPR)

• Performance of a contract (Art. 6(1)(b)): to provide the app and its features to you.
• Consent (Art. 6(1)(a)): for the waitlist and for push notifications; you can withdraw it at any time.
• Legitimate interests (Art. 6(1)(f)): security, abuse prevention, keeping the service running, and understanding aggregate product and site usage (sections 3 and 4) so we can fix what is broken.

6. Processors and sub-processors

We share data only with the providers needed to run the service:

• Fly.io. Hosting for the app control plane, the hosted voice worker, and the Postgres database (EU region, Amsterdam).
• Daily. The media room (SFU) that carries voice audio between your browser and our voice worker.
• Google (Gemini). The model that powers voice conversations. It processes call audio and text in real time.
• Stripe. Payment processing for the Founding plan, on behalf of Creala LLC. Stripe handles your card details directly; we receive only your customer and subscription identifiers and plan status.
• Resend. Transactional email (sign-up confirmation, password reset, invites) and the delivery events in section 4.
• Cloudflare. Website hosting and CDN, the waitlist store (Workers KV), and the TURN relay that carries voice audio when a direct network path is not available.
• PostHog (EU). Cookieless website analytics, hosted in Frankfurt. It receives marketing-site events only, not your task data.
• Reddit. Advertising measurement on the marketing site only, in cookieless mode, as described in section 3. Reddit is an independent controller for its own use of that data, not our processor.

Push services (Google, Apple, Mozilla) receive push notifications addressed to your browser, as described in section 4. They are recipients, not processors we contract with.

We do not use a third-party backup provider. App data lives on our Fly.io infrastructure and is not copied to a separate backup vendor. An earlier version of this page named one; that was wrong, and it is gone.

Your task compute runs on your own machine via your own coding agent, Claude Code (Anthropic) or the Codex CLI (OpenAI), so the work itself never runs on a model of ours. Hosted voice is the exception: your audio reaches our voice worker on Fly.io, the conversation runs on Google Gemini under our API key, and the thread content the assistant reads to you goes with it, for the duration of the call; the transcript is deleted when the call ends (sections 2 and 4).

7. International transfers

Your account data and threads are stored in the EU (Fly.io, Amsterdam). Some processors are US companies and may process data outside the EU/EEA: Google (Gemini, for hosted voice), Cloudflare (site hosting, TURN relay), Resend (email), Stripe (payments, collected for Creala LLC), and PostHog's operator. Reddit (advertising measurement, section 3) also receives marketing-site request data in the US, but as an independent controller rather than a processor. Where a processor is involved, the transfer relies on that processor's Standard Contractual Clauses under its data processing terms. For hosted voice specifically, we use the paid Gemini API, under which Google's published terms state it does not use the content to train its products and logs it only briefly for abuse detection. We verify each processor's current transfer terms before relying on them; if you need the specific mechanism for a given processor, email us.

8. Retention and deletion (what actually happens)

Even without deleting your account, we do not keep everything forever. A background job runs regularly and enforces these limits: voice-call metadata is kept 30 days after the call (the call content itself is already gone at hang-up, section 4); finished background-task records roll off after 7 days; login and sign-up throttle history (which holds emails and IP addresses) is dropped within a day or a week; server error logs are kept 90 days; product-usage counts are kept up to 13 months for year-over-year comparison; email delivery records are kept 180 days. Threads you archive are removed after 30 days, and a thread you delete outright is erased after a short recovery window.

You can also delete your whole account yourself, from /settings in the cockpit. Here is exactly what that does.

Erased in the delete. Your user row and every authentication row keyed to it, in one transaction: sessions, device tokens, login-attempt history, invites bound to your email, and pairing tokens. Your voice rows and queue rows are purged. Your telemetry rows are handled too: feedback text, error rows, and email-delivery rows are deleted; the aggregate rows (activation milestones and usage counts) are stripped of your tenant identifier and re-keyed to a random token that is generated once and never stored anywhere else, so the aggregate numbers we steer the product by survive without a way back to you.

Held briefly after the delete, then erased. Two things, and we would rather you hear it here than find out later:

• Your tenant home is renamed first, then erased on a delay. The directory holding your threads, their results, and your cost ledger is renamed to .deleted-<tenant>-<timestamp> the instant you delete, so it leaves every live view at once. A background job then erases it for good after a 7-day grace window (deletion is staged rather than instant on purpose, because an accidental recursive erase is unrecoverable). If you want it gone immediately, email us and we will erase it by hand and confirm.
• Backups linger for up to a few more days. We take automatic encrypted volume snapshots of our database and file storage, retained for 5 days. So for a short period after erasure a copy can still exist in a backup, which then rolls off automatically. Within roughly a week of a full erasure, no copy remains anywhere, backups included.

If you want full erasure now rather than on the schedule above, email [email protected] and we will do it and confirm when it is done. That is your right under Art. 17 GDPR and we will honour it.

Waitlist emails are kept in Cloudflare Workers KV until the beta ends or you ask us to remove them.

9. Your rights

You have the right to access, rectify, erase, restrict, and port your data, to object to processing, and to withdraw consent at any time. You may also lodge a complaint with a data protection supervisory authority. To exercise any right, email [email protected].