Privacy Policy — YvorAIO

1. Data We Collect

Data	Why	Stored
Email address	Account creation, login, transactional emails	Our database
Password (hashed)	Authentication	Our database (PBKDF2, never plain text)
Discord ID & username	Discord integration (optional)	Our database
Stripe customer ID	Subscription management	Our database + Stripe
IP address	Rate limiting, security	Temporarily (login attempts only)
Device ID	Session management (single-device enforcement)	Our database
App version	Update notifications	Not stored

2. How We Use Your Data

To provide and maintain your account and subscription.
To send transactional emails (verification, password reset, billing notices).
To manage access to the desktop application and Discord community.
To detect and prevent fraud or abuse.

We do not use your data for advertising. We do not sell your data to third parties.

3. Third-Party Services

We use the following third-party processors who may handle your data:

Stripe — Payment processing. Your card details are handled exclusively by Stripe. See Stripe Privacy Policy.
Cloudflare — Hosting, CDN, and DDoS protection. See Cloudflare Privacy Policy.
Discord — Optional account linking and community access. See Discord Privacy Policy.
Resend — Transactional email delivery. See Resend Privacy Policy.

4. Data Retention

We retain your account data for as long as your account exists. If you delete your account, your personal data will be removed within 30 days, except where retention is required by law (e.g., billing records).

Login attempt logs are kept for a maximum of 7 days for security purposes.

5. Security

Your password is stored using PBKDF2 with SHA-256 (100,000 iterations). We use HTTPS for all communications. Access to production data is strictly limited.

While we take reasonable measures to protect your data, no system is completely secure. We encourage you to use a strong, unique password and enable 2FA on your account.

6. Your Rights

Depending on your location, you may have the right to:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your account and associated data.
Object to or restrict certain processing.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

7. Cookies

We use a single session cookie (yvor_token) to keep you logged in. This cookie is HTTP-only and Secure. We do not use tracking or advertising cookies.

8. Children

YvorAIO is not directed at persons under 18. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy. We will notify you of material changes via email. Continued use of the service after changes are effective constitutes acceptance.

10. Contact

For any privacy-related questions or requests: [email protected]