Privacy Policy

YAGNI, Inc. (“Company”, “we”, “us”, or “our”) respects your privacy and is committed to protecting it through our compliance with this policy. This Privacy Policy describes the types of information we may collect from you or that you may provide when you use the YAGNI web application at https://yagni.app (our “Site” or “Service”), and our practices for collecting, using, maintaining, protecting, and disclosing that information.

I. Information We Collect

A. Account and Profile Information

When you create an account or subscribe to YAGNI, we collect:

• Name and email address, to identify your account and communicate with you.
• Payment information, collected and processed by Stripe, our payment processor. We do not store full payment card details on our systems.
• Phone number (optional), if you choose to enable SMS notifications. We store the number and the fact that it was verified; verification codes themselves are generated and checked by Twilio and are never stored by us.

B. Usage Data

We collect information about how you interact with our Service, including:

• Pages viewed, features used, and session duration.
• Browser type, operating system, and IP address.

C. User Content

We collect messages, goals, tasks, meeting notes, and other content you create within your YAGNI workspace.

D. Google Workspace Data

YAGNI integrates with Google Workspace to deliver its core functionality: providing you with full context across your productivity tools so your agent coworkers can act on your behalf. When you connect your Google account, we access the following data via Google OAuth:

We access only the data necessary to deliver YAGNI’s features. Broad scopes like drive.readonly are essential to YAGNI’s core value proposition: the whole point of the product is having all the context.

E. AI Processing of Your Data

YAGNI’s agent features (including email triage, meeting preparation, document drafting, and conversational assistance) are powered by third-party AI language models. When you interact with @yagni or when the Service processes your data to provide its features, your User Content (including data from connected Google Workspace services) may be sent to the following AI providers for processing:

• Baseten: our primary provider. Provides the US-hosted language models used for reasoning, drafting, and agent tasks. Automatic routing prefers Baseten ahead of our other inference providers.
• Fireworks AI: our secondary provider. Provides hosted language models used when Baseten is unavailable for a given request or tier, and during a Baseten outage. We use Fireworks’ United States pinned serverless models, so this processing is United States hosted on the normal path.
• Google (Gemini API): provides embedding models used to index your content for semantic search within your workspace.

Data sent to these providers is used solely to generate responses and embeddings for the Service. We use provider API or business services, not consumer chat products. Providers receive User Content only when needed for the requested processing, subject to the applicable service terms and data processing terms.

Our language model routing prefers United States hosted capacity, so on the normal path your User Content is processed by these providers in the United States. If those United States lanes are unavailable for a given request, it may fall back to Fireworks’ global fleet, which processes outside the United States. Where your workspace is configured for United States data residency, no such fallback applies: YAGNI routes every language model call for that workspace to a United States hosted provider and will fail the request rather than serve it from outside that region.

F. Web Search

When @yagni needs current information from the public web, it runs a search. On models that do not provide their own search capability, that search is executed through Tavily, a third-party search provider, which receives the search query and returns ranked public results. We also run one Tavily lookup against your company’s public website and public web results during onboarding, so your workspace starts with accurate context about your business.

Search queries are generated by the agent from the task at hand and may therefore contain terms drawn from your User Content. Tavily receives only the query text and returns public web results; we do not send your Google Workspace data, message content, or files to Tavily.

G. Error Monitoring and Product Analytics

To operate and improve the Service, we share limited technical and usage data with the following providers:

• Datadog: application performance monitoring, log management, runtime metrics, and browser monitoring for YAGNI’s own services. Datadog receives request traces with query strings obfuscated, parameterised database queries with no bound values, the same privacy-scrubbed application logs that Sentry receives, and workspace and user identifiers. For AI observability we send the shape of each model call (message roles, character and token counts, model, and cost) with the prompt and response text redacted before it leaves our systems. Prompt and response text is exported only for a small allow list of YAGNI’s own internal workspaces, never for customer workspaces.
• Sentry: error and performance monitoring. When the Service encounters an error, we send diagnostic data to Sentry including stack traces, error messages, runtime environment (browser, operating system, application version), and pseudonymous identifiers (user, workspace, and customer IDs, which are opaque UUIDs). We explicitly disable Sentry’s default PII collection, scrub sensitive fields (authorization headers, cookies, tokens, API keys, database URLs) from all events before transmission, and mask all text and form inputs in any session recordings. We do not send email addresses, names, message content, file content, or any Google Workspace data to Sentry.
• Mixpanel: product analytics. We send event data about how you use YAGNI (features accessed, actions taken, anonymized page paths, workspace metadata) to Mixpanel so we can understand aggregate usage patterns and improve the product. Some of these events are sent from our servers and some directly from your browser; browser-sent events reach Mixpanel with your IP address, while we suppress IP collection on server-sent events. Mixpanel also receives your email address and display name as user profile properties, solely to identify your account for cohort and retention analysis. We do not send message content, file content, or any Google Workspace data (Gmail, Drive, Docs, Sheets, Slides, Calendar, or Contacts content) to Mixpanel, and all event properties are scrubbed of sensitive fields before transmission.
• Google Analytics (GA4): web analytics on our marketing site and within the signed-in application. Google Analytics receives page views, referring pages, device and browser information, approximate location, and your IP address, and sets cookies in your browser to distinguish repeat visits. We serve the Google Analytics script from our own domain, but measurement data is sent from your browser to Google. We do not send message content, file content, or any Google Workspace data to Google Analytics, and we do not use it for advertising or remarketing.
• Temporal Cloud: durable workflow orchestration. We send operational workflow metadata to Temporal Cloud, such as workflow IDs, task queue names, execution status, retry history, timestamps, and limited workflow/activity inputs needed to coordinate background jobs. We do not intentionally send message content, file content, payment card details, OAuth tokens, API keys, or raw Google Workspace content to Temporal Cloud.

H. Infrastructure, Business Systems, and Delivery Providers

The following providers host the Service, run the business systems behind it, or deliver parts of it on our behalf. They process data under our instructions and are bound by their applicable data processing terms:

• Fly.io: application hosting and our primary database, including encrypted storage and encrypted backup snapshots. Your workspace data lives here.
• Tigris: object storage for files you upload as attachments and for artifacts your agents produce. Stored encrypted at rest.
• E2B: ephemeral, sandboxed code execution. When you ask @yagni to run an analysis or review code, the relevant workspace data or repository contents are loaded into a short-lived sandbox that is destroyed when the task ends. Where the task you asked for concerns Google Workspace content, such as analyzing a spreadsheet from your Drive, that content may be placed into the sandbox for the duration of the task.
• Attio: our customer relationship management system, which holds the account and contact records behind your relationship with us. Workspace records that YAGNI is directed to sync, such as contacts, companies, and activity associated with your account, may be shared with Attio. We do not send message content, file content, or Google Workspace content to Attio.
• Resend: transactional email delivery. Receives recipient email addresses and the contents of the notification being sent.
• Twilio: SMS delivery and phone verification, used only if you provide a phone number. Receives your phone number and the text of the messages we send you. You can stop these messages at any time by replying STOP to any text, or by turning off SMS notifications in your YAGNI settings; reply START to resume. Message frequency varies with your notification settings, and standard message and data rates from your carrier may apply.

A current list of our sub-processors is available on request atsupport@yagni.app. We will give notice of material changes to this list as described in Section IX.

I. Cookies and Similar Technologies

We use cookies and browser storage for the following purposes:

• Strictly necessary: to keep you signed in, maintain your session, and protect against cross-site request forgery. The Service does not work without these.
• Preferences: to remember interface state, such as the last surface you were viewing.
• Analytics: Google Analytics sets cookies to distinguish visitors and sessions, and Mixpanel stores an identifier in your browser’s local storage for the same purpose.

We do not use advertising or cross-site tracking cookies. You can block or delete cookies through your browser settings, and you can opt out of Google Analytics using Google’sbrowser opt-out add-on; blocking strictly necessary cookies will prevent you from signing in.

II. How We Use Your Information

A. General Use

• To present our Service and its contents to you.
• To provide the services you request, including AI-powered product features.
• To process your transactions and send related information.
• To send you technical notices, updates, and support messages.
• To respond to your comments, questions, and requests.
• To improve our Site, products, and services.

B. Purposes Specific to Each Google Integration

We use data from your connected Google account exclusively to provide and improve YAGNI’s user-facing features. Specific purposes include:

• Gmail: We read your email threads and metadata to give @yagni context about ongoing conversations, pending decisions, and communication history. We compose and send emails only at your explicit direction within YAGNI workflows.
• Google Drive (drive.readonly): We access all your Drive files to build comprehensive context for @yagni, enabling it to surface relevant documents, summarize files, and answer questions about your content without you having to manually locate and attach files.
• Google Drive (drive.file): We create, read, and edit specific Drive files when you initiate those actions through YAGNI, such as saving outputs or linking work items to documents.
• Google Docs: We read Docs content to provide document-aware context and draft or update documents on your behalf when you direct @yagni to do so.
• Google Sheets: We read spreadsheet data for data-aware context and update or create Sheets when you direct @yagni to perform those actions.
• Google Slides: We read presentation content to provide context for meeting prep, summaries, and briefings, and create or edit Slides on your behalf when directed.
• Google Calendar: We read your calendar data to power YAGNI’s scheduling context, meeting briefs, and time-aware recommendations. We create or edit events only when you direct @yagni to do so.
• Google Contacts: We read your contacts to identify people across your workflows, enrich communication context, and help @yagni understand the relationships and stakeholders relevant to your goals.

III. Google API Services: Limited Use Disclosure

YAGNI’s use and transfer to any other app of information received from Google APIs will adhere to theGoogle API Services User Data Policy, including the Limited Use requirements.

In accordance with Google’s Limited Use requirements, we commit to the following restrictions on all data obtained via Google APIs:

A. Data Use is Limited to YAGNI Features

We use Google user data only to provide or improve the user-facing features that are prominent within YAGNI. We do not use Google data for purposes unrelated to the core YAGNI product experience you have authorized.

B. No Transfer to Third Parties Except as Permitted

We do not transfer Google user data to third parties except:

• To provide or improve YAGNI features visible and prominent in the application, and only with your consent.
• For security purposes, such as investigating abuse or unauthorized access.
• To comply with applicable law or a valid legal process.
• In connection with a merger, acquisition, or sale of substantially all of our assets, after obtaining your explicit prior consent.

C. Humans Do Not Read Your Google Data

YAGNI personnel do not read your Google user data (emails, documents, calendar events, etc.) unless:

• You have given your affirmative agreement to allow access to specific messages, files, or other data.
• It is necessary for security purposes, such as investigating a bug, abuse, or a security incident.
• It is required to comply with applicable law.
• The data is aggregated and anonymized for internal operational analysis in accordance with applicable privacy law.

D. No Advertising, No Data Sales

We do not use Google user data:

• For advertising, retargeting, or personalized or interest-based advertising.
• To determine your credit-worthiness or for lending purposes.

We do not sell Google user data to data brokers, advertising platforms, or any information resellers. Your Google data is never sold.

IV. Data Sharing and Third-Party Services

We share data only as described below. We do not sell any personal information, including Google user data.

The above excludes text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Google Workspace data may be shared with Baseten, Fireworks AI, and Google (Gemini API) solely to power the AI features described in Section I(E) of this policy, and is stored as encrypted data on the infrastructure described in Section I(H) (Fly.io and Tigris) for the purpose of operating the Service. It may also pass through an ephemeral E2B sandbox where a task you have asked for requires it, for example when you ask @yagni to analyze a spreadsheet from your Drive; those sandboxes are destroyed when the task ends. It is not shared with Stripe, Datadog, Sentry, Mixpanel, Google Analytics, Tavily, Attio, Resend, Twilio, Temporal Cloud, or any other third party except as described in this policy. No Google Workspace data (Gmail, Drive, Docs, Sheets, Slides, Calendar, or Contacts content) is passed to advertising platforms, data brokers, or analytics providers.

We may also disclose your information:

• To comply with a court order, law, or legal process.
• To protect the rights, property, or safety of YAGNI, our users, or others.
• In connection with a merger, acquisition, or transfer of assets (with notice to you and, where required, your consent).

V. Data Security

We have implemented measures designed to secure your personal information, including data accessed via Google APIs, from accidental loss and from unauthorized access, use, alteration, and disclosure.

Specific security practices include:

• Encryption in transit: All data transferred between your browser, YAGNI’s servers, and Google’s APIs is encrypted using TLS (Transport Layer Security).
• Encryption at rest: User data, including cached Google Workspace data stored to power YAGNI’s context engine, is encrypted at rest in our Fly.io database and in Tigris object storage. Credentials for connected services, including OAuth tokens, receive an additional layer of application-level encryption.
• Access controls: Access to user data within our systems is restricted to authorized personnel on a need-to-know basis. Production data access is logged and reviewed.
• Per-workspace data isolation: Customer data is isolated per workspace using application-level access controls. Every database query that touches customer-scoped data is filtered by workspace, preventing cross-account data access.
• Google secure data handling: We handle Google user data in accordance with Google’s secure data handling requirements as specified in the Google API Services User Data Policy.

The safety and security of your information also depends on you. Please keep your account credentials confidential and contact us immediately if you suspect unauthorized access to your account.

VI. Data Retention

A. General Retention

We retain your personal information for as long as your account is active or as needed to provide you with our services. We retain and use your information as necessary to comply with legal obligations, resolve disputes, and enforce our agreements.

B. Google Workspace Data Retention

YAGNI stores Google Workspace data (such as indexed content, cached context, and synced records) only as long as is necessary to deliver the Service and for a limited period thereafter. Specifically:

• While your account is active: Google data is retained and refreshed to keep your YAGNI context current.
• Upon account deletion: All Google user data stored by YAGNI (including indexed Drive files, email data, calendar data, contact data, and document content) is permanently deleted from our systems within 30 days of account termination.
• Upon revoking Google access: If you disconnect your Google account from YAGNI without deleting your account, we will cease accessing new Google data immediately and will delete previously synced Google data within 30 days.

VII. Your Rights and Data Deletion

You have the following rights with respect to your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate personal information.
• Deletion: Request deletion of your personal information, including all Google user data we have stored.
• Objection: Object to our processing of your personal information.
• Portability: Request a machine-readable export of your personal information.
• Withdraw Consent: Withdraw consent for Google Workspace access at any time by disconnecting your Google account via your YAGNI account settings or by revoking YAGNI’s permissions directly in your Google Account security settings.
• Opt Out of SMS: Stop text messages at any time by replying STOP to any message from us, or by turning off SMS notifications in your YAGNI settings. We record the opt-out against your number and every SMS path checks it before sending.

How to Delete Your Google Data

You may delete your Google user data from YAGNI in any of the following ways:

• Account Settings: Navigate to Settings → Data & Privacy within YAGNI and choose Request Account Deletion. This submits a deletion request covering your account and all associated data, including Google Workspace data and connected-service tokens. Deletion from our systems will be completed within 30 days of the request.
• Email Support: Send a deletion request to support@yagni.app with the subject line “Data Deletion Request.” We will confirm receipt and complete the deletion within 30 days.
• Revoke Google Access Only: To disconnect Google Workspace without deleting your account, open the account menu in the top-right, choose Connections, open Google Workspace, then choose Disconnect. All previously synced Google data will be deleted within 30 days.

We will not discriminate against you for exercising any of these rights.

VIII. Children’s Privacy

YAGNI is not directed to children under the age of 13 and does not knowingly collect personal information from children under 13. If we learn we have collected personal information from a child under 13 without parental consent, we will delete that information promptly. If you believe we may have collected information from a child under 13, please contact us atsupport@yagni.app.

IX. Changes to This Policy

We may update our Privacy Policy from time to time. If we make material changes (including any changes to how we access, use, or share Google user data) we will notify you by email and by posting a notice on the Site before the changes take effect, and we will update the “Last revised” date at the top of this policy. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the revised policy.

X. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your data, please contact us:

YAGNI, Inc.
Email: support@yagni.app
Website: https://yagni.app

For data deletion requests, please emailsupport@yagni.appwith the subject line “Data Deletion Request.”

See also our Terms of Service.