Privacy policy
Account holders
When you create an account we store your email address, your name if you give one, a hash of your password, the times you sign in, the IP address and browser of each signed-in device (so you can see and revoke them), and everything you build. We use this to run the service, to email you about your account (confirmation, password reset, and the digests and alerts you switch on), and to keep the service safe. We do not sell it. Every email we send carries an unsubscribe link and the standard one-click unsubscribe header; using either stops all optional email to that address at once. Confirmation and password-reset messages are the only ones that cannot be switched off, because they are how your account is kept safe.
AI processing
When you use an AI feature, the text you type, the site you are editing and, for style copying, screenshots of the pages involved are sent to Anthropic's API to generate the result. Anthropic's terms for API data apply. Analytics insights send an aggregated summary of your site's statistics, never individual visitors.
Visitors to sites built here
Sites published with this studio include a small script that counts visits. In plain terms:
- No cookies. Nothing is written to your browser to recognise you. A short random id in the browser's session storage groups the pages of one visit and is gone when the tab closes.
- No session replay, no recording. The script does not record your screen, your mouse movements, what you type or the page itself. It never will.
- No personal data stored. Per page load it records: the page, the referring site, campaign tags in the link, your country, browser, operating system, device type, screen size and language, time on page, how far the page was scrolled, which sections were on screen, clicks on links and buttons, repeated clicks, that a form was sent (not what it said) and page load timings.
- Your IP address is never stored. A visitor identifier is computed as a hash of the address and browser signature with a salt that changes every day, so you cannot be recognised across days and the address itself is not kept.
- Country from a local database. The country is looked up in a database on our own server; your address is not sent to anyone to find it.
- No third parties. The script talks only to the server that serves the site. Fonts are served by the same server; a YouTube or Vimeo video is loaded only when you press play, and the page says so on the button.
- Kept for thirteen months, then deleted. Site owners see aggregates only.
- Your signals are honoured. With Global Privacy Control or Do Not Track switched on in your browser, nothing is sent at all. In the EU/EEA, the UK, Switzerland and California the page asks first with a small bar; "No thanks" is remembered in your browser and the site stops counting you.
Each site's own summary of this is at /a/<site id>/privacy on this studio.
Your rights (EU/UK and California)
If you are in the EU, the EEA, the UK or Switzerland you may ask what we hold about you, have it corrected or deleted, and object to its use; if you are in California you have the equivalent rights under the CCPA/CPRA. Email hello@yawrn.ai and we will answer within a month. Because visitor records are not linked to a person, a request about a visit usually means confirming that nothing identifying is held; account holders can see and delete their own data on the account page.
We do not sell or share personal information, and we do not use it for targeted advertising. The Global Privacy Control signal is treated as a valid opt-out. For visitors to a site built here, the site's owner is the controller of that data and this studio is the processor acting on their instructions; a request about a particular site may be passed to its owner. You can also complain to your data protection authority or, in California, to the Privacy Protection Agency.
Form submissions
What a visitor types into a form on a published site is stored for the site's owner, who is responsible for it. We hold it on their behalf.
Hosting and retention
Data is stored on servers in [location]. Backups are kept for seven days. When you delete a site or your account, its data is removed with it; backups age out within a week.
Your rights
You can see and change your account details on the account page, export any site as HTML, and delete sites or your account. For anything else — access, correction, deletion, a complaint — email [contact email]. If you are in the EU/UK you can also complain to your data protection authority.
Cookies we use
The studio itself uses one session cookie to keep you signed in, and a password-protected site sets one cookie to remember that the password was entered. Nothing for advertising.