Privacy Policy (English)

Last updated: 2026-02-19

This is the canonical Privacy Policy for Yous (MVP). It explains what personal data we collect, why, and how you can exercise your rights.

What we collect

• Account email and password (hashed)
• Display name and profile information (optional)
• IP address and device metadata for security
• Files you upload (stored as FileBlob)
• Analytics event data (pages visited, feature interactions, language, device/browser metadata)

Why we process your data

• To provide core account features and security
• To deliver and moderate community content
• To improve product quality and user experience using aggregate analytics

Analytics and cookies

• Analytics provider: Google Analytics 4 (Google LLC)
• Legal basis (EEA/UK): consent (analytics is off until you accept)
• We use the analytics_consent cookie to store your choice (granted or denied) for up to 12 months.
• We do not intentionally send direct identifiers such as plain email in analytics events.
• You can withdraw consent at any time from app settings; this disables future analytics tracking for your browser session.

Retention

• Account and content data are retained while your account is active.
• Analytics reporting data retention in GA4 is configured by the project owner (recommended: 14 months or less).
• Data may be retained longer when required for legal, security, or fraud-prevention obligations.

Your rights

• Data export: you can request a copy of your personal data (profile, stories, uploaded files metadata).
• Erasure: you can request that we erase or anonymize your personal data. Some system records may be retained in anonymized or aggregated form for legal or auditing requirements.

Contact

For privacy requests, use the account settings or the API endpoints:

• GET /api/privacy/export — Request an export of your data (authenticated).
• POST /api/privacy/erasure — Request deletion/anonymization of your account (authenticated).