Privacy Policy

Introduction

We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information when you use Yoloo AI, a hosted platform that runs frontier AI image and video generation models on your behalf. This policy covers the website and the service, including sign-in with Google or email.

What you may and may not create with Yoloo AI is covered by our Acceptable Use Policy, not by this policy.

Information We Collect

We collect the following types of information to provide and improve Yoloo AI:

1. Account Information — Your name, email address, and profile details you provide when creating an account. If you sign up with email, your password is stored only in hashed form. When you sign in with Google, we receive the information described under Google User Data below. If GitHub sign-in is offered and you use it, we receive your GitHub name, email address, profile image, and account identifier. We do not receive or store your Google or GitHub password.
2. Usage Data — Information about how you interact with the service, including features used, generation history, frequency of use, and interaction patterns.
3. Device Information — Device type, operating system, browser type, IP address, and locale, used to optimize compatibility, performance, and security.
4. Cookies and Local Storage — Small data files stored on your device to keep you signed in, remember preferences, and measure site usage. See our Cookie Policy for details.
5. Payment Information — Billing information processed by the payment provider you select, such as Creem or Stripe. We receive transaction details needed to confirm payment, activate your plan, and maintain billing records; full payment credentials are handled by the provider.
6. Generations and Inputs — The text, reference media, settings, and other inputs you submit when creating content. Generation records are stored in your account, and completed media is stored in Cloudflare R2 so you can view and download it.
7. Support Messages — The emails you send us, including any attachments.

Summary of Data Use

Here is a short overview of the data we handle and why. The sections below give the details.

• Account data (name, email address, profile picture, Google account identifier) — to create and secure your account, sign you in, and contact you about your account.
• Content you submit (text prompts, reference images, videos, and audio, and generation settings) — to generate your results, show your history, and screen content for safety.
• Generated media (images and videos created for you) — to let you view, download, and reuse results.
• Billing data (order IDs, plan, credit balance, payment status) — to process payments, grant and track credits, and keep billing records.
• Usage and device data (pages visited, features used, IP address, browser, device type) — to operate, secure, and improve the service.
• Support messages (emails you send us) — to answer your request and resolve problems.

Google User Data

Yoloo AI offers "Sign in with Google" through Google OAuth. This section describes exactly what Google user data Yoloo AI accesses and how it is handled.

What we access

We request only the basic sign-in scopes openid, email, and profile. Through them Google provides:

• your name,
• your email address and whether Google has verified it,
• your profile picture, and
• your Google account identifier.

During the OAuth sign-in exchange, Google also returns authentication tokens and their scope and expiry information. Our authentication system may store the access token, ID token, and, if Google issues one, refresh token in the linked-account record. These credentials support the sign-in flow; we do not use them to read unrelated Google services. Google One Tap, when available, uses an ID token to verify your identity.

We do not request or access your Gmail, Google Drive, Calendar, Contacts, Photos, or any other Google service, and we do not request any sensitive or restricted scope. We never receive or store your Google password.

Why we need it

• Email address and account identifier — to create your Yoloo AI account, recognize you when you return, and send account, receipt, and security messages.
• Name and profile picture — to show who is signed in on the interface.

How we use it

Google user data is used only to provide and improve the user-facing features of Yoloo AI described above: creating your account, authenticating you, personalizing the interface, communicating about your account, and preventing fraud and abuse. We do not use it for advertising (including retargeting or interest-based ads), we do not sell it, and we do not use it to develop, improve, or train generalized AI or machine-learning models.

How we share it

We do not transfer Google user data to third parties except: (a) to the infrastructure providers listed under Data Sharing that host and process it on our behalf, (b) when necessary to comply with applicable law or a valid legal request, (c) to protect the security of the service or investigate abuse, or (d) as part of a merger, acquisition, or sale of assets of Yoloo AI, and only after obtaining your explicit prior consent.

We do not send Google profile information, account identifiers, or OAuth tokens to AI model providers or content moderation providers for generation or model training. Those providers receive the generation inputs you submit, which are separate from the information obtained through Google sign-in. Transactional email providers receive your email address and the message needed to deliver account communications; payment providers may receive your account email to associate a checkout with your account. We do not send Google sign-in profile data or OAuth tokens to analytics services.

Our staff do not read your Google user data unless you give us permission (for example, by asking for help in a support request), it is needed for security purposes such as investigating abuse, it is required to comply with applicable law, or it is aggregated for internal operations.

How we store and protect it

Your name, email address, email verification status, and profile picture URL are stored in the Yoloo AI user record. Your Google account identifier and any stored OAuth tokens, scopes, and expiry timestamps are stored in the linked authentication account record. Sessions are stored separately with an expiry, session identifier, and security metadata such as IP address and browser information. We use HTTPS for data in transit, session-based authentication, and authorization checks for private account operations. Access to account records is limited to personnel and infrastructure providers that need it to operate, secure, or support the service. We do not claim that OAuth tokens are separately encrypted at rest by the application.

Retention and deletion

We keep Google user data for as long as your account is active. To delete your account and the Google user data linked to it, email support@yoloo.ai from your account address; we process requests within 30 days, subject to records we must keep by law. Please state whether you want your entire Yoloo AI account deleted or only the Google connection and associated Google data removed. We may verify your identity before acting. Removal includes the linked Google account record and stored OAuth tokens; account deletion also removes associated profile data and sessions, except information necessary for legal obligations, payment records, or security and dispute handling. Any retained information is restricted to those purposes.

You can also revoke Yoloo AI's Google access through Google Account third-party connections. Revoking access prevents further authorized access to Google; it does not automatically delete data already stored by Yoloo AI or close your Yoloo AI account. Contact us separately to request that deletion. Signing out ends your current Yoloo AI session but does not delete your account.

Limited Use

Yoloo AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How We Use Your Information

We use the data we collect to:

• Provide, maintain, and improve Yoloo AI.
• Authenticate you and keep your session secure.
• Process transactions, provision credits and subscriptions, and send related confirmations.
• Route generation inputs to Replicate and other model providers needed to fulfill your request.
• Screen text prompts and supported reference images and videos through the configured content moderation providers when their channels are enabled.
• Send technical notices, security alerts, and support messages.
• Respond to your questions, feedback, and support requests.
• Detect, prevent, and address fraud and abuse.

Data Sharing

We do not sell your personal information. We share data only with the processors that help us run Yoloo AI, and only the information needed for each purpose:

• AI and model providers, including Replicate — Receive the inputs and generation settings required to process your request and return the resulting media.
• Payment providers, including Creem and Stripe — Process subscription billing, credit purchases, invoices, and payment security. The provider involved depends on the payment method you select.
• Content moderation providers — The configured providers receive text prompts and supported reference images or videos for safety screening when the corresponding moderation channel is enabled.
• Authentication and database services — Help us securely manage your account and store your information.
• Cloudflare R2 — Stores uploaded reference images, videos, and audio, as well as completed generated media, so the service can process requests and make results available from your account.
• Analytics services — We may use Google Analytics to measure visits, sessions, approximate location, device information, traffic sources, and on-site activity; a Plausible-based analytics script that counts page views and records referrers, browser and device type, and country; and Microsoft Clarity, which provides heatmaps and session replays based on interactions such as mouse movements, clicks, scrolling, navigation, and page rendering. We use this information to understand and improve Yoloo AI, and we do not use these tools for advertising.
• Email delivery providers — Deliver account, receipt, and security emails and receive your email address and the message content.

We may also disclose information if required by law, to protect the rights and safety of our users or partners, or in the context of a corporate transaction. Google user data is transferred in a corporate transaction only as described under Google User Data above.

Data Retention

• Account and billing records are retained for as long as your account is active and for the period required by tax and accounting law after closure.
• Text inputs, generation settings, and task records are retained as needed to provide generation history, operate the service, address abuse, and meet legal obligations. Contact us if you want to request deletion of account-linked generation data.
• Support correspondence is retained for the period needed to resolve your request and meet our legal obligations.
• Moderation records (the checked prompt text or a reference to the checked media, the provider, its verdict, reason, and response, and a timestamp) are retained to operate the safety system and respond to abuse reports.

Generated media stored in our Cloudflare R2 storage share the same retention period as generation history: 7 days. After this period, generated media is automatically deleted. Copies processed or retained by model providers are subject to their own retention practices.

Your Rights

You can change your display name in your account settings. To request access to, export of, or deletion of other personal information, contact us at the email address below. Depending on where you live, you may also have the right to restrict or object to certain processing, withdraw consent, or lodge a complaint with your local data protection authority.

Legal Bases for Processing

Where data protection law such as the GDPR applies, we process personal data to perform our contract with you (providing the service and your account), for our legitimate interests (security, fraud prevention, measuring site usage, and improving the service), and to comply with legal obligations.

Privacy Rights by Region

• European Economic Area, United Kingdom, and similar regions — You may request access, correction, deletion, portability, restriction, or objection to processing, and may withdraw consent at any time.
• California and other US states — You may request to know what personal information we hold, to have it deleted or corrected, and to opt out of any sale or sharing of personal information. We do not sell personal information or share it for cross-context behavioral advertising, and we do not discriminate against you for exercising these rights.

To exercise any right, email support@yoloo.ai from your account address. We may need to verify your identity and will respond within the period required by law.

Children's Privacy

Yoloo AI is not directed to children under 13, or under the higher minimum age set by the law of your country, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact support@yoloo.ai and we will delete it.

International Transfers

We and our service providers may process your information in countries other than your own.

Data Security

We use HTTPS for data in transit, authorization checks on private account operations, and limited access to account records. No method of transmission or storage is completely secure.

Changes to This Policy

We may update this Privacy Policy from time to time. We update the date at the top of this page when the policy changes. If we want to use Google user data for a new purpose, or to access a type of Google user data not described in this policy, we will first update this policy, notify affected users by email, and ask for their consent before any such processing begins. Any new Google permission will be requested through the Google consent flow before access.

Contact Us

If you have questions about this Privacy Policy, contact us at support@yoloo.ai.