Privacy Policy

This Privacy Policy explains how Yazora ("Yazora", "we", "us", or "our") handles personal data when you use our website, web, desktop, or mobile applications, workspaces, and related services (together, the "Service").

If you use Yazora through an organization or a team workspace, that organization may control the workspace content and account settings it manages. Its own privacy notices may also apply.

This policy provides information about data processing; it does not itself obtain your consent. Where applicable law requires consent, accepting the Terms or continuing to use Yazora does not replace that consent.

We collect information you provide, information created while you use the Service, and limited technical information needed to operate and secure Yazora.

Sources include forms and content you submit, your browser or app requests, your chosen sign-in provider, app stores, and workspace members who invite you or share content with you. Required account and technical information is needed to provide the associated features; optional profile information and AI actions are your choice.

• Account and profile data, such as your name, email address, authentication identifier, profile image, chosen sign-in method, language, and settings.
• Workspace content, including documents, tables, drawings, files, comments, links, publications, membership details, roles, permissions, and related metadata.
• Technical and security data, such as IP address, browser, device and operating-system details, app version, request times, sync state, diagnostics, and security or audit events.
• Messages and support information you choose to send to us.
• Subscription and purchase data received from app stores, such as the store, product and transaction identifiers, purchase verification records, subscription status, renewal or expiry dates, and the account or workspace receiving paid access.

Where a legal basis is required, we process account, workspace, support, and purchase-verification data to enter into or perform our agreement with you and provide the features you request, including optional AI actions. We process necessary technical and security records for our legitimate interests in preventing abuse and maintaining a reliable Service, with regard to your rights and freedoms.

We process records required for legal, accounting, or regulatory duties to comply with those obligations, and information needed to establish, exercise, or defend legal claims where the law permits. Processing that requires consent relies on that consent; choosing an optional feature does not waive any separate legal consent requirement.

• Create and manage accounts, authenticate users, and remember essential preferences.
• Save, synchronize, organize, search, share, publish, export, and restore workspace content.
• Enable collaboration, permissions, workspace administration, and security auditing.
• Provide support, maintain reliability, prevent abuse, and comply with legal obligations.
• Improve the Service using aggregated feedback and operational information.

The Service stores working copies, caches, and preferences on your device so you can continue working with limited or no connectivity. When you are signed in and a connection is available, eligible workspace data is synchronized with our cloud services.

• Clearing browser or app storage can remove local copies and preferences, but it does not automatically delete content already synchronized to the cloud.
• Local work that has not synchronized may be lost if the app, browser data, or device storage is removed.
• When you deliberately publish a document, the published snapshot and required assets can be accessed through its public link until you withdraw it. Later private edits are not added to that publication until you choose to update it.

AI features are optional. When you request an AI action, the content sent depends on the scope you choose: selected text and relevant context, or the document's text when you choose a whole-document action. The request can include document structure, your instructions, action settings, and information needed to authorize the request. A Yazora service sends the relevant input to Cloudflare Workers AI. Merely having AI features available does not send your entire workspace.

Content submitted for AI is processed in readable form by the services handling the request, including when it comes from an encrypted workspace. Yazora also keeps request-status and usage records, such as model, token counts, and quota consumption, to operate and account for AI features. Results you apply become part of your document and follow its storage and sharing settings.

• Only use AI actions when you are comfortable sending the relevant text for external processing.
• Avoid including secrets, highly sensitive personal data, or information you are not authorized to share.
• Cloudflare states that Workers AI customer content is not used to train AI models or improve Cloudflare or third-party services without explicit consent.

We do not sell personal data or use workspace content for third-party behavioral advertising.

• Workspace owners, administrators, and members according to the roles and permissions applied to that workspace or item.
• Anyone with access to a public link when you choose to publish content.
• Google Firebase for functions such as sign-in, cloud storage, and backend processing, and Cloudflare for relevant security, synchronization, publishing, and AI services. In the web app, Cloudflare Turnstile processes browser and technical signals to help prevent automated abuse.
• Apple App Store and Google Play for purchase processing, subscription verification, and paid-access management. The stores also process purchase and payment information independently under their own privacy notices.
• Authorities or other parties when required by law, needed to protect rights and safety, or connected with a merger, financing, acquisition, or transfer of the Service.

The Yazora landing site stores your language and theme preferences in browser storage and does not currently use third-party advertising cookies. The applications additionally use device storage for sign-in persistence, offline content, caches, and synchronization queues. Security services may process technical signals to validate requests and prevent abuse.

Your browser, operating system, or device settings may let you clear this data. Doing so can sign you out, reset preferences, or remove unsynchronized local content.

If you enable reminders, Yazora uses your browser or device's notification service. Reminder titles and content may appear on the lock screen depending on your device settings. You can manage notification permission in your browser or device settings.

Deleting a workspace is different from deleting your Yazora account. Only the workspace owner can initiate deletion. Deletion permanently removes the workspace for every member, while the owner's account and other workspaces remain available.

Access is closed as soon as a valid deletion request is accepted. Cloud cleanup then removes the workspace's documents, files, versions, publications, memberships, invitations, and encryption data in the background.

We retain a minimal deletion receipt containing the workspace identifier and type, request and completion times, requesting account identifier, and completion status. It does not contain the workspace name, content, or member list. The receipt is retained for at least three years. App Store and Google Play transaction records remain under the stores' independent control.

To request deletion of your Yazora account, use the account-deletion page or email info@yazora.app, preferably from your registered account address. We verify account ownership and authority over affected workspaces before acting. Export content you want to keep and cancel store subscription renewal separately.

Account deletion and workspace deletion have different effects. Shared records controlled by another workspace may remain available to its authorized members. Contact us before requesting deletion if a team depends on your ownership or administration. Copies exported by others and records independently controlled by app stores are outside a Yazora account-deletion request.

We keep account and synchronized workspace data while your account or workspace is active and for as long as needed to provide the Service. Deleted items and encrypted recovery copies may remain for a limited period. Separate security, fraud-prevention, billing, tax, accounting, dispute, legal, and deletion-evidence records may be retained for the period required by their purpose or applicable law.

When information is no longer needed, we delete it, anonymize it, or isolate it until deletion is possible. Public content can remain available until its publication is withdrawn.

We use access controls, encryption in transit, provider security features, and operational safeguards designed to protect personal data. No service can guarantee absolute security, so please use a strong password, protect your devices, and report suspected account misuse.

Our providers may process information in countries other than where you live, including the United States. Where required, we rely on appropriate contractual or legal safeguards for international transfers.

You can contact info@yazora.app for information about the providers, processing locations, and transfer safeguards relevant to your data, including how to obtain a copy of applicable safeguards where the law provides this right.

Privacy rights vary by location. We may need to verify your identity and authority before completing a request. Some data may be retained where the law permits or requires it, including for security, legal claims, or the rights of other people.

Where the EU/EEA or UK GDPR applies, we generally respond within one month of receipt; legally permitted extensions and their reasons are notified within that period. Requests under Türkiye's KVKK are resolved as soon as possible and within 30 days. Elsewhere, we follow the deadlines and any permitted extensions under the law that applies to your request. Contacting us does not prevent you from using other legally available request or complaint channels.

If applicable US state privacy laws, including California's CCPA, cover your data and our processing, you may also have rights to know, access, correct, delete, and obtain a copy of your information; opt out of sale, sharing for cross-context behavioral advertising, targeted advertising, or certain profiling; and limit certain uses of sensitive information. The rights and exceptions depend on the applicable law and processing. We will not unlawfully discriminate against you for exercising them. Where the CCPA applies, requests to know, access, correct, or delete are generally answered within 45 days; a permitted extension is explained within that period.

You or an authorized representative may contact info@yazora.app to exercise applicable rights; we may request proof of authority and identity as appropriate to the request. If we decline a request, you can ask for a review by replying to our response. Where applicable law provides an appeal, we explain the reasons and how to appeal. You may also complain to the relevant regulator. Users elsewhere, including Canada and Australia, can use the same contact address for access, correction, or privacy complaints under the laws that apply to them.

• Ask whether we process your personal data and request access to it.
• Correct incomplete or inaccurate data.
• Request deletion, restriction, or objection where the law provides.
• Request a portable copy of eligible data.
• Withdraw consent for future processing where consent is the legal basis, without affecting the lawfulness of processing before withdrawal.
• Learn the purposes of processing, whether data is used consistently with those purposes, and the recipients of domestic or international disclosures; request that corrections or deletions be communicated to recipients where required.
• Object to an adverse result based solely on automated analysis and seek compensation for unlawful processing where applicable law provides these rights.
• Complain to your local data-protection authority.

Yazora is not directed to children under 13, and they are not eligible to use the Service. Older minors must meet any higher age or parental or guardian authorization requirements that apply where they live. Where processing relies on consent, local rules may require a parent or guardian's consent even for a user aged 13 or older. If you believe a child has provided personal data contrary to these rules, contact us so we can review and take appropriate action.

We may update this policy as Yazora, our providers, or applicable laws change. We will post the revised policy here and update the date above. If a change materially affects your rights, we will provide additional notice where required.

For privacy questions or requests to access, correct, export, or delete personal data, email info@yazora.app. Please describe your request and the account or workspace it concerns. Do not send passwords or confidential document content by email.

With your consent, we use Google Analytics 4 to measure landing-page visits, campaign sources, and clicks on web app, store, and desktop download links. Google processes usage data through analytics cookies and technical connection information. The analytics tag does not load before you accept; ad personalization and Google Signals are off. We do not add email addresses or document content to analytics events. A store-link click does not establish an installation. Your consent choice is saved in this browser for 180 days; analytics cookies expire after 180 days and may be renewed on subsequent visits. You can withdraw consent through Analytics preferences in the footer; this stops future measurement and removes this site’s analytics cookies, but does not automatically delete previously sent data. Learn about Google’s data processing at policies.google.com/privacy.