Privacy Policy

Last updated: August 23, 2026

Overview

HelloYaYa ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our neurodivergent-friendly task management application.

Our core principle: We collect only what's necessary to provide a great experience, and we're transparent about what stays on your device vs. what's stored in our systems.

Information We Collect

Account Information

  • Sign in with Google: Email address, name, and profile photo
  • Sign in with Apple: Email address (may be a private relay address), name

Planning Data

  • Tasks: Titles, descriptions, due dates, contexts, difficulty, and completion status
  • Plans and capacity: The plan you approve, capacity check-ins, scheduling decisions, and completion history
  • Rescue and Reset: Friction categories, the intervention you choose, and content-free outcome records
  • Capture: Only tasks you approve and content-free session metadata are stored; raw Capture text is not stored in Firestore
  • Continuity: Only items you explicitly confirm are stored, and their content remains end-to-end encrypted

Preferences and Device Data

  • Preferences: Theme, notification settings, accessibility options, and other choices you save
  • Energy and capacity: Check-ins you save are synced to your account so plans and Patterns can use them
  • Device snapshots: A bounded current-plan snapshot may be cached for widgets, watches, and offline use

Calendar Integrations (Optional)

Connecting a calendar lets HelloYaYa display your events alongside your tasks and create, update, or delete events from inside HelloYaYa (for example, when you turn a task into a calendar event). Calendar integrations are optional and can be disconnected at any time from Settings.

Google Calendar

  • Scopes requested: calendar.events (read & write events on selected calendars), calendar.calendarlist.readonly (list your calendars to populate the picker), and userinfo.email + userinfo.profile (record which Google account is connected).
  • What we do: read your calendar list, read events in the visible date range, and — only on your explicit action — create, update, or delete events.
  • What we store on our servers: the connected account's email and display name, the list of calendars you have access to (calendar IDs, display names, colors, and your enabled-for-display selection), and your OAuth access + refresh tokens (encrypted with AES-256-GCM and decrypted only inside server-side proxy code that you cannot read directly).
  • What we DON'T store: calendar event content. Events are fetched in real time when you view them and are never persisted to our database.

Microsoft Outlook

  • Scopes requested: Calendars.ReadWrite, User.Read, offline_access.
  • Behavior is the same as Google Calendar above: read calendar list and events; create, update, or delete events only on your explicit action.
  • Your calendar list is stored on our servers; event content is not. OAuth tokens are encrypted server-side.

Apple Calendar (iCloud)

  • Connects via CalDAV using an app-specific password you generate at appleid.apple.com. We never see your iCloud account password.
  • Same read & write behavior as Google and Microsoft above.
  • Your app-specific password is encrypted server-side; calendar list metadata is stored; events are fetched live and never persisted.

Information We Do Not Collect

Your privacy matters. These boundaries apply to the focused planning loop:

  • Keystrokes: We do not record typing behavior or key-by-key Capture input
  • Raw demo text: Public-demo text is processed for one result and is not written to your profile or Firestore
  • Task or memory content in analytics: Operational telemetry excludes task titles, Capture text, prompts, outputs, names, and Continuity content
  • Session recordings: We do not use session replay or screen-recording analytics

How We Use Your Information

  • Provide, maintain, and improve HelloYaYa
  • Sync your tasks across devices
  • Adapt a plan to the preferences and capacity you choose to share
  • Send notifications and reminders you've opted into
  • Generate content-free reliability and outcome Patterns
  • Interpret Capture text and optionally tailor bounded assistance

AI and Deterministic Assistance

HelloYaYa uses deterministic planning and safety rules first. When an assisted feature is enabled, bounded text may be processed by Google Vertex AI to interpret Capture text or tailor a suggestion.

  • Raw Capture text is processed for the request and is not written to Firestore, analytics, logs, or error reports
  • We do not use your data to train models and use provider no-training protections
  • A deterministic fallback remains available when model assistance is unavailable or invalid
  • A model cannot decide crisis response, billing, permissions, deletion, or a Continuity write
  • Persistent embedding memory remains disabled until its encryption, deletion, and compatibility gates pass

Data Storage & Security

Your data is stored securely using Google Firebase infrastructure with:

  • Encryption in transit (TLS 1.3)
  • Encryption at rest (AES-256)
  • Firebase Security Rules limiting access to your own data
  • Regular security audits and monitoring

Third-Party Services

HelloYaYa uses the following third-party services:

  • Google Firebase: Authentication, database, and hosting
  • Google Vertex AI: Bounded Capture interpretation and optional assistance
  • Resend: Email notifications (welcome emails, reminders)
  • Stripe: Payment processing and subscription management
  • Sentry: Error and performance monitoring with scrubbed stack traces and an internal account identifier; no session replay
  • Google/Microsoft OAuth: Calendar integrations

Each service operates under their own privacy policy. We've selected partners with strong privacy practices.

Google API Services User Data Policy

HelloYaYa's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

  • We use information from Google APIs only to provide the user-facing calendar features described above (display events alongside tasks; create / update / delete events on your explicit action).
  • We do not transfer this information to third parties except as needed to provide or improve those user-facing features, comply with applicable law, or as part of a merger or acquisition with notice to you.
  • We do not use this information for advertising and we do not allow it to be used for advertising by third parties.
  • We do not allow humans to read this information unless we have your affirmative consent for specific items, do so for security purposes (such as investigating abuse), to comply with applicable law, or for internal operations where the information has been aggregated and anonymized.

Data Sharing

We do not sell your data. Ever.

We may share your information only in these circumstances:

  • With your explicit consent
  • To comply with legal obligations
  • To protect our rights and prevent fraud
  • With service providers under strict confidentiality agreements

Your Rights

You have the right to:

  • Access: View all data we have about you
  • Export: Download a portable JSON copy of your account data, or export your tasks as CSV
  • Correct: Update inaccurate information
  • Delete: Remove your account and all associated data
  • Disconnect: Revoke calendar or account connections anytime
  • Opt out: Disable optional notifications and disconnect optional integrations

You can exercise most of these rights directly in Settings. For additional requests, contact us at privacy@helloyaya.app.

Data Retention

  • Active accounts: Data retained while your account is active
  • Deleted accounts: Account data deleted within 24 hours; a content-free compliance receipt is retained for 90 days
  • Raw Capture text: Not retained by our server after request processing; local drafts remain under your device's control until you clear or commit them

Children's Privacy

HelloYaYa is designed for users 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us immediately at privacy@helloyaya.app.

International Users

HelloYaYa is operated from the United States. If you're accessing the app from the European Union, UK, or other regions with data protection laws, please note that your information will be transferred to and processed in the United States.

We comply with applicable data protection laws including GDPR for EU users.

Changes to This Policy

We may update this Privacy Policy as we add features or as laws change. We'll notify you of significant changes through the app or via email. The "Last updated" date at the top shows when this policy was last revised.

Contact Us

Questions about this Privacy Policy or your data? Reach out:

privacy@helloyaya.app

Mabry Ventures LLC
Nolensville, TN 37135
United States