Privacy Policy

1Introduction

Neeko Codes LLC, an Oregon limited liability company ("we", "our", or "us"), makes the Yapp Studio app and operates the website at https://yapp.studio. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use our app and website. Yapp Studio is a desktop app for editing talking-head videos on your own computer, with help from your own AI agent, such as Claude or Codex. It is available for Mac now, with Windows planned; if anything works differently on Windows, we will update this policy.

2Scope of This Policy

This Privacy Policy applies to all personal information collected through the Yapp Studio app, https://yapp.studio, and any related applications, services, forms, payments, or communications provided by Neeko Codes LLC. It does not apply to third-party websites, products, or services even if they are linked from our app or website, including the AI agent you connect to Yapp Studio. By using our services you acknowledge that you have read and understood this policy. Our Terms of Service also apply.

3Information We Collect

We may collect the following categories of information: full name, email address, IP address, device information (only your macOS version, in bug reports and ideas you choose to send), and payment details (only if you choose to support Yapp, and never your full card number). This section explains where each comes from. Yapp Studio has no accounts, and no analytics, usage tracking, advertising, or crash reporting.

3.1 Information that stays on your computer

Yapp Studio works on your computer, and what you make stays there. We do not receive it and have no copy of it:

• your projects, as folders on your computer (new ones go in Yapp Studio, in your Movies folder);
• the recordings, pictures, sounds and fonts you add, your transcripts and captions, and your brand kits and editing skills;
• Yapp's settings and working files, and the email address you last used for a bug report, in Yapp's folder in your Library (Library, Application Support, Yapp Studio);
• which version of our Terms of Service and this Privacy Policy you agreed to in Yapp, and when.

Yapp's own processing also runs on your computer, without sending your content anywhere: transcription, with a speech recognition model that runs on your computer; cutouts, with the image tools built into macOS; face finding, which finds where faces are in the frame so that zooms can aim at them and does not recognize who anyone is; Clean voice, with a model that comes inside the app; and studying and exporting your videos.

3.2 Your AI agent

Yapp connects to the agent app you set up, such as Claude or Codex, through a connection that stays on your computer. When your agent works on a video, Yapp gives it what it asks for, which can include your transcript and caption words; your project's details, brand kits and editing skills; the names and folder locations of your projects and files, which can include your computer's user name; pictures of frames from your video, or from a video you ask it to study; and the results of the edits it makes, and any errors.

Your agent app may send this to the company that makes the agent, such as Anthropic for Claude or OpenAI for Codex, so that the agent can do its work. That company's privacy policy and terms apply to it, and your settings with that company (for example, whether it may use your chats to train its models) are between you and it. Yapp's editor can also open in your agent app's browser pane; it is served from your own computer, at an address only your computer can reach, and your agent app may see what it shows. Yapp itself has no AI chat and sends none of your content to any AI company.

3.3 Bug reports and ideas you send us

You can send us a bug report or an idea from Yapp's Report button, or ask your agent to send one. From the Report button, nothing is sent until you press Send. Your agent is told to ask you first, and Yapp makes it come back with a one-time code before it can send anything. Yapp cannot check that your agent really asked you, so connect only agents you trust.

A report contains only:

• the words you write (when you open the form from an error message, the message's words are put in for you to keep, change or delete);
• your email address, so we can reply (when your agent sends a report and you do not want a reply, it goes without one);
• the screenshots and pictures you attach, up to 4. A screenshot of the Yapp window shows whatever was on screen, which can include a frame of your video, your transcript and caption words, and your project's name. Reports your agent sends have none;
• the versions of Yapp and macOS, which the Report form shows you before you send.

Earlier beta copies of Yapp also sent details about your computer, the app and the open project with a bug report. Our report service throws those away without passing them on or keeping them.

The report goes over an encrypted connection to our report service at report.yapp.studio, which runs on Cloudflare. The service checks the report and emails it to our mailbox, [email protected], which Google hosts for us. The report service does not store reports. It uses your IP address briefly to limit how many reports one computer can send each minute. Cloudflare's email service may keep short delivery logs, which can include the email's subject: the start of your description.

3.4 When the app connects to the internet

Each of these is an ordinary internet request. The service that answers it sees your IP address and basic technical details, as any website does, and handles them under its own privacy policy.

• Updates. About 30 seconds after Yapp starts (the first time, once you agree to our Terms), and then every 4 hours, Yapp asks our update service at yapp.studio whether there is a new version, and downloads it if there is. The request carries a key that is the same in every copy of Yapp, and a random install number that the open-source update tool Yapp uses (electron-updater) creates and keeps on your computer. Besides what any internet request carries, it contains nothing about you or your projects. Our update service does not read or keep the install number.
• Speech model. When you first open Yapp (once you agree to our Terms), and again later only if the model is missing, Yapp downloads its speech recognition model (about 460 MB) from Hugging Face. After that, transcription works without the internet.
• Fonts. When you browse Yapp's list of Google Fonts, when you or your agent choose one, and whenever a project or brand kit you open or change uses a Google Font this computer does not have yet, Yapp downloads the font files from Google Fonts, so Google learns which fonts were asked for.
• Links. When you or your agent import a picture or clip from a link, Yapp downloads it straight from that website.

3.5 Our website, forms and emails

• Hosting. Our website, beta pages, update service and report service run on Cloudflare, which processes visitors' IP addresses and request details to deliver the site and protect it from attacks.
• Download count. When someone downloads the Yapp Studio installer from our site, the site adds one to a count for that day and that version of the app. The count holds nothing about who downloaded it.
• Waitlist. When you enter your email address in the box on our site, Eden collects it for us.
• Beta application. If you apply to test Yapp, you fill in a form that Eden runs for us. It asks for your name and email address, what you make, a link to your videos (if you want to give one), how often you post, which computer you use, which AI agent you use, what you hope Yapp will do for you, and whether you will send feedback. It also records whether you agreed to our Terms and this policy, and when. We read each application ourselves to choose testers; no automated system decides.
• Emails. Eden only collects our forms. We send news and product updates, only to people who asked for them, from [email protected] through Kit, an email service; the launch email to the waitlist, which asks whether you want them, goes the same way. Every one of these emails has an unsubscribe link. We send access, beta updates and requests for feedback to testers, and replies to bug reports and messages, from [email protected] through Google's email service.

3.6 Supporting Yapp

If you choose to support Yapp with a payment, you pay on a checkout page that Stripe runs for us. Stripe collects your card details and handles the payment under its own privacy policy; we never see your full card number. Stripe gives us your name, email address, country, the amount, and your card's brand and last four digits. Stripe may email you a receipt.

4How We Use Information

We use personal information to:

• provide, maintain, and improve our services;
• respond to support requests, bug reports and ideas, and communicate about the service;
• choose beta testers and give them access;
• process payments you choose to make to support Yapp;
• secure the platform and detect fraud or abuse;
• comply with legal obligations;
• send news and product update emails to people who asked for them.

To help us understand and fix a problem, we may paste a bug report into an AI tool, such as Claude; where the tool lets us, we turn off its use of our chats for training. We do not sell or share personal information, we do not use it for targeted advertising, we do not make decisions about you by automated means or build profiles of you, and we do not use your content or the bug reports you send to train AI models.

5Cookies and Tracking

Our website does not set cookies and does not use analytics (apart from the download count in Section 3.5), advertising, or tracking technologies. Its fonts come from our own site. The beta download page asks for its password and does not remember it: you sign in again on each visit. The Yapp Studio app does not track you.

Our news and product update emails, sent through Kit, record whether you open them and which links in them you click, so we can see what is useful. This is linked to your email address and stays in Kit; we do not use it for advertising or share it with anyone else.

6Third-Party Service Providers

We work with trusted service providers to operate the platform. Current providers include:

• Cloudflare: hosting our website, beta downloads and updates, running the report service, and sending report emails;
• Google: our email (Google Workspace);
• Kit: sending our news and product update emails;
• Eden: collecting our waitlist and beta application forms;
• Stripe: processing payments to support Yapp;
• AI tools we use to read bug reports, such as Claude (made by Anthropic).

These providers may process personal information on our behalf subject to contractual and legal safeguards. The app also downloads files from Google Fonts, Hugging Face, and websites you import links from, which receive the request under their own privacy policies (Section 3.4). Whatever your AI agent app sends to the company that makes it is between you and that company (Section 3.2).

We may also disclose information if the law requires it, to protect our rights or someone's safety, or to a buyer if our company or Yapp Studio is sold or merged, who must protect it as this policy does.

7Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy; it is then securely deleted or anonymized. In particular:

• Waitlist, and news and product updates: until you unsubscribe or ask us to delete your email address.
• Beta applications: while the beta runs, and only as long as we need them for it after that, or until you ask us to delete yours.
• Bug reports and emails: as long as we need them to fix the problem and reply to you, and we delete a report sooner if you ask.
• Payment records: as long as tax and accounting law requires, generally seven years.
• Our providers' logs: Cloudflare, Google, Kit, Eden, Stripe and Hugging Face keep their own records for the times their policies set.
• On your computer: until you delete it. Deleting the app does not delete your projects, Yapp's folder in your Library, the update files in your Library's Caches folder, or the connection and skills Yapp added to Claude or Codex. Remove those from Yapp's agent list before you delete the app, or delete them yourself.

8Children's Privacy

Our service is not directed to children under 13, and Yapp Studio is for people aged 18 and over (see our Terms of Service). We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, contact us so that we can review and delete the information.

9Your Privacy Rights

Depending on where you are located and the laws that apply, you may have the right to:

• Right of Access: request a copy of the personal information we hold about you;
• Right to Rectification: request correction of inaccurate or incomplete information;
• Right to Erasure: request deletion of personal information, subject to legal exceptions;
• Right to Data Portability: receive a machine-readable copy of your data where applicable;
• Right to Object: object to processing based on legitimate interests or direct marketing;
• Right to Restriction: request that we limit how we process your information in certain circumstances;
• Right to Withdraw Consent: withdraw consent at any time where we rely on consent as our legal basis.

We offer these rights to everyone, whether or not a law requires it, and we will not treat you differently for using them. Most of your information is on your own computer, under your control, and we have no copy of it.

How to exercise your rights: You may submit a Data Subject Access Request (DSAR) or any other privacy request by emailing us at [email protected]. We may ask you to confirm that the email address the request is about is yours. We will provide a substantive response within 30 days of receipt (or such shorter period as required by applicable law). In complex cases we may extend this by a further 60 days and will notify you accordingly. Someone else can make a request for you if you give them written permission. If you are in the European Economic Area, the UK or Switzerland, you can also complain to your local data protection authority.

10Legal Basis and Jurisdiction

We are based in the United States and process personal information in accordance with applicable privacy laws. Where the law requires a legal basis, such as in the European Economic Area, the UK and Switzerland, the table below sets out the legal basis we rely on for each category of processing activity:

11Security

We implement reasonable technical and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, or destruction. Yapp's editor page and its connection to your agent can be reached only from your own computer, and updates, bug reports and payments travel over encrypted connections. Your projects are protected by your computer's own security, so keep it up to date and locked. No way of sending or storing information is perfectly secure, so we keep what we receive to a minimum.

12International Transfers

We are based in the United States, and the services we use may process information in the United States and other countries. If personal information is transferred across borders, we take steps to ensure the information receives an adequate level of protection under applicable law, such as relying on the EU Standard Contractual Clauses our providers offer.

13Contact Us

If you have questions about this Privacy Policy or want to exercise a privacy right, contact us:

Email: [email protected]

Postal address:

14Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date above and say so on our website before the change takes effect.

AJurisdiction-Specific Privacy Disclosures

The following provisions supplement this Privacy Policy and apply where the relevant law governs your relationship with us.

California (CCPA / CPRA)

California residents have the following rights under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (Cal. Civ. Code §§ 1798.100 to 1798.199):

• Right to Know what personal information we collect, the sources, the purposes, and the categories of third parties to whom it is disclosed.
• Right to Delete personal information we have collected, subject to enumerated exceptions in § 1798.105(d).
• Right to Correct inaccurate personal information.
• Right to Opt Out of Sale or Sharing of personal information for cross-context behavioral advertising. We do not sell or share personal information, so there is nothing to opt out of.
• Right to Limit Use of Sensitive Personal Information (§ 1798.121). We do not collect sensitive personal information.
• Right to Non-Discrimination for exercising privacy rights (§ 1798.125).

You may submit a verifiable consumer request via [email protected]. We respond within 30 days, as Section 9 says. Authorized agents may act on your behalf with written authorization. Categories of personal information collected and disclosed are described in Sections 3 and 6 above.

Other U.S. State Privacy Laws

Residents of states with comprehensive privacy laws, including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Iowa, Tennessee, Indiana, Florida (FDBR), Delaware, New Jersey, New Hampshire, Minnesota, and Maryland, have the right to access, correct, delete, port, and opt out of targeted advertising, sale, and certain profiling. We do none of the last three. To exercise these rights, contact [email protected]. We respond within 30 days and honor authorized agent requests.

CalOPPA (California Online Privacy Protection Act)

Pursuant to Cal. Bus. & Prof. Code §§ 22575 to 22579, this Privacy Policy is conspicuously posted on our website. We notify users of material changes by updating the effective date. Do Not Track ("DNT") and Global Privacy Control (GPC): we do not track you across websites, so these browser signals have nothing to turn off.

COPPA (Children Under 13, United States)

Our service is not directed to children under 13, and we do not knowingly collect personal information from them (Section 8).

Data Breach Notification

If a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and notify affected individuals without undue delay where required by applicable breach-notification law (including U.S. state breach laws, Australia's NDB scheme, PIPEDA breach reporting, and LGPD Article 48).

Sub-Processors

We engage the following sub-processors to provide the service: cloud hosting and report emails (Cloudflare), email (Google Workspace), email newsletters (Kit), form collection (Eden), and payment processing (Stripe). Where the law requires it, we rely on each provider's data processing terms, which require confidentiality, security, and processing only on our documented instructions.