Privacy Policy

Summary

Yap turns a question and a spoken answer into a page. Here’s a brief summary of how we treat what you give us:

• What we collect: Your account details (email address, handle, and how you sign in), what you record, type, or import into a yap, and basic device and usage data (cookies, IP address, browser). You don’t need an account to answer a yap; a cookie in your browser remembers that you’re the one answering.
• How we handle recordings: Your recordings are transcribed, and the transcript is written up into a page by AI services from Google (Gemini) and Anthropic (Claude). Neither we nor they train AI models on your recordings, transcripts, or pages. We never use your voice to identify you.
• Who sees a yap: A yap is visible only to the asker and the answerer until the answerer marks it shareable. The answerer can also set it to expire, which ends everyone else’s access.
• Who we share with: The service providers that run Yap (named below), and authorities when the law requires it. We have no advertising trackers, and we don’t sell your personal information or share it for advertising.
• Deleting your data: Email legal@yap.so from your account’s email address and we’ll delete your account and your content within 30 days.
• Contact us: Questions? Email legal@yap.so

We have presented these terms in a short, non-binding summary, and what follows is the full legal document.

---

Privacy Policy

Effective Date: September 27, 2026

Welcome to the Yap Privacy Policy. Please read this Privacy Policy to learn how we treat your Personal Data, which is information that is directly linked or can be linked to you. It applies to the Personal Data that 10Real, Inc. (10RI) processes when you interact with yap.so, its subdomains, and our online services that display this Policy (collectively, “Services”). It applies whether you ask, answer, or read a yap, and whether or not you have an Account. By using or accessing our Services in any manner, you acknowledge that you accept the practices and policies outlined below, and you hereby consent that we will collect, use and disclose your information as described in this Privacy Policy.

Remember that your use of Yap’s Services is at all times subject to our Terms of Service, which incorporates this Privacy Policy. Any terms we use in this Policy without defining them have the definitions given to them in the Terms of Service.

As we continually work to improve our Services, we may need to change this Privacy Policy from time to time. We will alert you of material changes by placing a notice on the Yap website, by sending you an email and/or by some other means. Please note that if you’ve opted not to receive legal notice emails from us (or you haven’t provided us with your email address), those legal notices will still govern your use of the Services, and you are still responsible for reading and understanding them. If you use the Services after any changes to the Privacy Policy have been posted, that means you agree to all of the changes.

Third Party Access and Data Protection

When you use third-party extensions, integrations, or follow references and links within our Services, the privacy policies of these third parties apply to any Personal Data you provide or consent to share with them. Their privacy statements will govern how this data is processed.

Imported media

You can bring audio or video from another site into a yap. When you do, our servers fetch it using the open source tool yt-dlp, either directly or through a residential proxy provider (currently Decodo). We store the media in the yap along with the public metadata the source site publishes about it: its title, its uploader, and its thumbnail. The source site’s own terms and privacy policy govern the original, and you must have the right to import it (see the Terms of Service).

Wikipedia and Wikidata links

Pages link the people, places, and things they name. To find those links, our servers look up the names on Wikidata and Wikipedia; these lookups contain the names from the page, not your account details. When you open a link in the reading drawer, your browser fetches the article’s mobile-html directly from Wikipedia, so the Wikimedia Foundation receives your IP address and browser details for that request, and the Wikimedia Foundation Privacy Policy applies to it.

Personal Data We Collect

Personal Data is collected from you directly, automatically from your device, and also from third parties. The Personal Data 10RI processes when you use the Services depends on variables like how you interact with our Services, the features you use and your method of accessing the Services (your preferred browser). Below, we detail the information we collect through each of these channels:

From You

• Account Data: When you open an Account, we collect your email address and assign you a handle, which starts out as a pseudonym. You may add a display name and an avatar image link. If someone invited you, we record the referral code you arrived with and who invited you. We don’t use passwords. You sign in with a one-time email link (we store only a hash of its token, and the link works for about six hours), or with Google or Apple, in which case we store the provider’s name, its identifier for you, and the email address it gives us.
• Your Content: When you use our Services, we collect what you put into a yap: voice recordings, their transcripts, text you type, the question, the page Yap writes and each version of it, your edits to the page, forks (copies of a yap), and audio or video you import along with its public metadata (title, uploader, and thumbnail). Voice recordings are stored as audio files (ogg or webm) in Cloudflare R2, in a private bucket; they play back through links that expire shortly after they’re issued.
• Other people’s details: When you ask someone, you give us the recipient’s name and your reason for asking them. If you ask through someone’s profile without signing in, you may give us your email address, which we use only to send you the link to the answer. Your recordings and text may also mention other people; please only share what you have the right to share.
• Support Data: When you ask us for help (for example at hi@yap.so), we collect what you send us, such as text, links, screenshots, or other files.

Automatically

• Essential cookies and similar technologies: We use cookies to keep you signed in, remember that you’re the answerer of a yap, and credit invitations. They are yapinfo (session details the page can read) and yapsecure (the protected session cookie, httpOnly), both lasting 7 days; yapoauth, which exists only while you sign in with Google or Apple; yap_resp_<yap_id>, which marks you as the answerer of that yap in that browser for up to 365 days; and yapref, which remembers an invitation link for up to 180 days. Your browser’s local storage also holds an invitation token, your playback speed, and recordings in progress until they finish uploading. See this section for details.
• Analytics: We use PostHog to understand how people use Yap: which pages load, which buttons are pressed, and which features get used. Analytics events are relayed to PostHog through our own domain. If you’re signed in, the events carry your account ID and handle. Session recording is turned off, and the text of your yaps, recordings, and pages is never sent to PostHog.
• Error reports: When something breaks, Sentry receives an error report with browser and device details and the stack trace. If an error happens in your browser, the report may include a replay of the page’s layout in which all text and inputs are masked and all media is blocked, so your recordings, transcripts, and pages never enter an error report.
• Service Usage Information: We log the requests your browser makes to our Services, including IP address, user agent (browser and device type), and the date and time of each request. When you first open an invitation link, we record the IP address it was opened from (referral_ip), which we use only to detect referral abuse.

From Third Parties

• Sign-in providers: When you sign in with Google or Apple, we receive your email address and that provider’s identifier for you. The information we receive depends on your settings with those services and their privacy policies.
• Other users: Other people may give us information about you. Someone can ask you a question by name, which records your name and the reason they’re asking, and someone asking through a profile may enter their own email address. An answer may mention you by name.

Processing Purposes: How We Use Your Personal Data

The Personal Data we process depends on your interaction and access methods with our Services, including the features you use and your preferred access tools (like your browser). This section details all the potential ways 10RI may process your Personal Data:

• Business Operations: We use Personal Data for activities like accounting. This includes creating aggregated statistical data for internal reporting, financial reporting, capacity planning, and forecast modeling (including product strategy).
• Communication: We use Personal Data to send you sign-in links, links to answers you asked for, confirmations, technical notices, updates, security alerts, and administrative messages, and to tell you about new Services and features.
• Inference: We generate new information from other data we collect to derive likely preferences or other characteristics. For instance, we infer your general geographic location based on your IP address.
• Safety and Security: To promote safety, integrity, and security across our Services, we process Personal Data, using both automated and, at times, manual techniques for abuse detection, prevention, and violations of terms of service.
• Service Provision: We use Personal Data to deliver and update our Services as configured and used by You.
• AI-Powered Features: We use third-party artificial intelligence services to turn what you say into a page. Google LLC (Gemini) transcribes your recordings and runs quick steps such as pulling the question out of a recording and picking which names on the page to link. Anthropic PBC (Claude) writes the page, suggests follow-up questions, and writes fact-check notes; to fact-check, claims from the page are sent to Anthropic’s web search. The Personal Data sent to these providers is what you record, type, or import into a yap, the question, and the page itself, and it is sent only when you record, type, or import. Neither we nor these providers train AI models on it (see “AI Service Providers” under Sharing of Personal Data below). Your recordings are only transcribed; we don’t create voiceprints, and we never use your voice to identify you or anyone else.
• Public pages: We process Personal Data to show pages to the people allowed to see them. A yap is visible only to its asker and its answerer until the answerer marks it shareable. The answerer can set a shareable yap to expire, which removes everyone else’s access. A fork of a yap inherits the privacy of the yap it was copied from. A shareable page shows the asker’s and the answerer’s handles and the question. Questions asked through your profile are visible to you as the profile’s owner.
• Troubleshooting: We use Personal Data to identify and resolve technical issues.
• Ongoing Service Performance: Personal Data helps us keep the Services up to date and performant, and meet user productivity, reliability, efficacy, quality, privacy, accessibility and security needs.
• Complying with and resolving legal obligations: including responding to Data Subject Requests for Personal Data processed by 10RI as Controller (for example website data), tax requirements, agreements and disputes.

When carrying out these activities, 10RI practices data minimization and uses the minimum amount of Personal Information required.

Sharing of Personal Data

We may share Personal Data with the following recipients:

• Abuse and Fraud Prevention Entities: We may disclose Personal Data based on a good faith belief it is needed to prevent fraud, abuse, or attacks on our Services, or to protect the safety of Yap and our users.
• Affiliates: Personal Data may be shared with 10RI affiliates to facilitate customer service, technical support, and legal and compliance obligations. Our affiliates may only use the Personal Data in a manner consistent with this Privacy Policy.
• Competent Authorities: We may disclose Personal Data to authorized law enforcement, regulators, courts, or other public authorities in response to lawful requests or to protect our rights and safety.
• Corporate Transaction Entities: we might disclose Personal Data within the limits of the law and in accordance with this Privacy Policy for strategic business transactions such as sales or a merger.
• Subprocessors and Service Providers: We use vendors to provide services on our behalf. They are bound by contractual obligations to ensure the security, privacy, and confidentiality of your information. They are:
  • Render: hosting for our servers and database, in the United States.
  • Cloudflare: DNS, and storage of recordings and imported media in Cloudflare R2.
  • Postmark: sending email, such as sign-in links and answer links.
  • PostHog: product analytics, relayed through our own domain, with no session recording.
  • Sentry: error reports, with browser and device details and stack traces, never the content of recordings or pages.
  • Google: sign-in with Google, and AI processing with Gemini (see below).
  • Apple: sign-in with Apple.
  • Anthropic: AI processing with Claude, including web search for fact-checks (see below).
  • Decodo: residential proxy used to fetch media you import.
• AI Service Providers: When you record, type, or import into a yap, your inputs are sent to third-party AI service providers for processing. These currently are Google LLC (Gemini, for transcription and quick steps such as extracting the question and picking which names to link) and Anthropic PBC (Claude, for writing the page, follow-up questions, and fact-check notes, including web search on claims from the page). Both process your data under their commercial API terms, which prohibit training their models on customer data. We don’t train AI models on your data either. Your inputs are retained by these providers only as their API terms allow, to process your request and meet their legal obligations, and are retained by us under the Security and Retention terms below. We may update the list of AI providers as the Service evolves; material changes will be communicated per our change notification policy.
• Other Users and the Public: A yap is visible only to its asker and its answerer until the answerer marks it shareable. Once it is shareable, anyone with the link can see the page, which shows the asker’s and the answerer’s handles and the question. The answerer can set it to expire, which ends everyone else’s access. A fork inherits the privacy of the yap it was copied from. Questions asked through your profile are visible to you as the profile’s owner. Please be aware that anything in a shareable page may be copied or passed on by the people who can see it.

Private yaps: Yap access

If you are the asker or the answerer of a private yap, you control the access to that information. Yap personnel do not access private yaps without your consent except as provided in this Privacy Policy and for:

• security purposes
• automated scanning or manual review for known vulnerabilities, active malware, or other content known to violate our Terms of Service
• to assist the asker or answerer with a support matter
• to maintain the integrity of the Services, or
• to comply with our legal obligations if we have reason to believe the contents are in violation of the law.

Yap will provide you with notice regarding private yap access unless doing so is prohibited by law or if Yap acted in response to a security threat or other risk to security.

Lawful Bases for Processing Personal Data (Applicable to EEA and UK End Users)

10RI processes Personal Data in compliance with the GDPR, ensuring a lawful basis for each processing activity. The basis varies depending on the data type and the context, including how you access the services. Our processing activities typically fall under these lawful bases:

• Contractual Necessity: Processing is required to fulfill our contractual duties to you, in accordance with the Yap Terms of Service.
• Legal Obligation: We process data when it’s necessary to comply with applicable laws or to protect the rights, safety, and property of 10RI, our affiliates, users, or third parties.
• Legitimate Interests: We process data for purposes that are in our legitimate interests, such as securing our Services, communicating with you, and improving our Services. This is done only when these interests are not overridden by your data protection rights or your fundamental rights and freedoms.
• Consent: We process data when you have explicitly consented to such processing. When we rely on consent as the legal basis, you have the right to withdraw your consent for data processing at any time. The procedures for withdrawal are detailed in this Policy and available on our website.

Your Privacy Rights

Depending on your residence location, you may have specific legal rights regarding your Personal Data:

• The right to access the data collected about you
• The right to request detailed information about the specific types of Personal Data we’ve collected over the past 12 months, including data disclosed for business purposes
• The right to rectify or update inaccurate or incomplete Personal Data under certain circumstances
• The right to erase or limit the processing of your Personal Data under specific conditions
• The right to object to the processing of your Personal Data, as allowed by applicable law
• The right to withdraw consent, where processing is based on your consent
• The right to receive your collected Personal Data in a structured, commonly used, and machine-readable format to facilitate its transfer to another company, where technically feasible

To exercise these rights, please send an email to legal@yap.so and follow the instructions provided. To verify your identity for security, we may request extra information before addressing your data-related request. Please contact our Data Protection Officer at legal@yap.so for any feedback or concerns. Depending on your region, you have the right to complain to your local Data Protection Authority. European users can find authority contacts on the European Data Protection Board website, and UK users on the Information Commissioner’s Office website.

We aim to promptly respond to requests in compliance with legal requirements. Please note that we may retain certain data as necessary for legal obligations or for establishing, exercising, or defending legal claims.

International data transfers

10RI stores and processes Personal Data in a variety of locations, including your local region, the United States, and other countries where 10RI, its affiliates, subsidiaries, or subprocessors have operations. We transfer Personal Data from the European Union, the United Kingdom, and Switzerland to countries that the European Commission has not recognized as having an adequate level of data protection. When we engage in such transfers, we generally rely on the standard contractual clauses published by the European Commission under Commission Implementing Decision 2021/914, to help protect your rights and enable these protections to travel with your data. To learn more about the European Commission’s decisions on the adequacy of the protection of personal data in the countries where 10RI processes personal data, see this article on the European Commission website.

Security and Retention

10RI uses appropriate administrative, technical, and physical security controls to protect your Personal Data. Recordings are stored in a private bucket and play back only through links that expire shortly after they’re issued.

We keep your Account Data while your Account exists, and we keep a yap (its recordings, transcripts, and page) while the yap exists. Expiry ends other people’s access to a yap; it does not delete the yap. We may also retain data as needed to comply with legal requirements, resolve disputes, and enforce agreements.

To delete your Account, email legal@yap.so from the email address on your Account. We will delete your Account, and the recordings, transcripts, and pages of the yaps you answered. For yaps you asked that someone else answered, we remove your handle and email address; the answerer’s page stays theirs. We complete deletion within 30 days of your request.

If you answered without an Account, your browser’s yap_resp_<yap_id> cookie is what identifies you as the answerer. To have a yap you answered deleted, email legal@yap.so with its link and enough detail for us to confirm that you answered it.

To report a suspected security issue, contact security@yap.so.

Information for Minors

Our Services are not intended for individuals under the age of 13. We do not intentionally gather Personal Data from such individuals. If you become aware that a minor has provided us with Personal Data, please notify us at report@yap.so. See details here.

Changes to Our Privacy Policy

10RI may periodically revise this Privacy Policy. If there are material changes to the policy, we will provide at least 30 days prior notice by updating our website or sending an email to the email address associated with your Yap Account.

Our use of cookies and tracking technologies

Cookies and tracking technologies

Yap uses cookies to provide, secure and improve our Service or to develop new features and functionality of our Service. For example, we use them to (i) keep you logged in, (ii) remember your preferences, (iii) identify your device for security and fraud purposes, including as needed to maintain the integrity of our Service, (iv) compile statistical reports, and (v) provide information and insight for future development of Yap. The cookies we set, what they’re for, and how long they last are listed under “Essential cookies” in Personal Data We Collect.

The length of time a cookie will stay on your browser or device depends on whether it is a “persistent” or “session” cookie. Session cookies will only stay on your device until you stop browsing. Persistent cookies stay until they expire or are deleted. The expiration time or retention period applicable to persistent cookies depends on the purpose of the cookie collection and tool used. You may be able to delete cookie data. If you clear the yap_resp_<yap_id> cookie for a yap you answered without an Account, we cannot restore your access to that yap from another browser or device.

What are cookies and similar technologies?

We use cookies and similar technologies, such as local storage, to operate and provide our Services.

Cookies are small text files stored by your browser on your device. A cookie can later be read when your browser connects to a web server in the same domain that placed the cookie. The text in a cookie contains a string of numbers and letters that may uniquely identify your device and can contain other information as well. This allows the web server to recognize your browser over time, each time it connects to that web server.

How do we and our partners use cookies and similar technologies?

The Yap Services use cookies and similar technologies for a variety of purposes, including to store your preferences and settings, enable you to sign in, remember that you’re the answerer of a yap, analyze how our Services perform, track your interaction with the Services, develop inferences, combat fraud, and fulfill other legitimate purposes. Some of these technologies are provided by our service providers, such as PostHog for analytics.

The table below provides additional information about how we use different types of cookies:

Purpose	Description
Required Cookies	Yap uses required cookies to perform essential website functions and to provide the services: yapinfo and yapsecure keep you signed in (7 days), yapoauth protects sign-in with Google or Apple (only while you sign in), yap_resp_<yap_id> marks you as the answerer of a yap in that browser (up to 365 days), and yapref remembers an invitation link (up to 180 days). These cookies are necessary for our websites to work.
Analytics	We use PostHog analytics cookies and local storage to understand how you use our websites so we can make them better. For example, they are used to gather information about the pages you visit and how many clicks you need to accomplish a task. We don’t use analytics for advertising.

What are your cookie choices and controls?

You have several options to disable non-essential cookies generally for all websites, including Yap:

• Many browsers provide cookie controls which may limit the types of cookies you encounter online. Check out the documentation for your browser to learn more.
• If you enable a browser extension designed to block tracking, such as Privacy Badger, non-essential cookies set by a website or third parties may be disabled.
• If you enable a browser extension designed to block unwanted content, such as uBlock Origin, non-essential cookies will be disabled to the extent that content that sets non-essential cookies will be blocked.

These choices are specific to the browser you are using. If you access our Services from other devices or browsers, take these actions from those systems to ensure your choices apply to the data collected when you use those systems.

Yap has no advertising trackers. We don’t sell your personal information, and we don’t “share” it for cross-context behavioral advertising, so the Global Privacy Control (“GPC”) signal has nothing to switch off here. We don’t respond to the “Do Not Track” (DNT) browser signal.

US State Specific Information

This section provides extra information specifically for residents of certain US states that have distinct data privacy laws and regulations. These laws may grant specific rights to residents of these states when the laws come into effect. This section uses the term “personal information” as an equivalent to the term “Personal Data.”

Privacy Rights

These rights are common to the US State privacy laws:

• Right to Knowledge and Correction: You have the right to request details on the specific personal information we’ve collected about you and the right to correct inaccurate information. You can exercise this right by contacting us.
• Right to Know Data Recipients: We share your information with service providers for legitimate business operations, such as data storage and hosting. For more details, please see “Sharing of Personal Data” above.
• Right to request Deletion: You reserve the right to request the deletion of your data, barring a few exceptions. Such exceptions include circumstances where we are required to retain data to comply with legal obligations, detect fraudulent activity, investigate reports of abuse or other violations of our Terms of Service, or rectify security issues. Upon receiving your verified request, we will promptly delete your personal information (unless an exception applies), and instruct our service providers to do the same.
• Right to a Timely Response: You are allowed to make two free requests in any 12-month period. We commit to responding to your request within 45 days. In complex cases, we may extend our response time by an additional 45 days.
• Non-Discrimination: We will not hold it against you when you exercise any of your rights. On the contrary, we encourage you to contact us with any questions.

Notice of Collection of Personal Information

We may collect various categories of personal information about our website visitors and users of “Services” which includes Yap websites, software, products, or services. That information includes identifiers/contact information, internet or electronic network activity information, coarse geolocation data (inferred from your IP address), audio information (voice recordings), and inferences drawn from such information.

We collect this information for various purposes. This includes providing services, troubleshooting, conducting business operations such as security, improving products and supporting research, communicating important information, and promoting safety and security.

Exercising your Privacy Rights

To make an access, deletion, correction, or opt-out request, please send an email to legal@yap.so and follow the instructions provided. We may need to verify your identity before processing your request. If you choose to use an authorized agent to submit a request on your behalf, please ensure they have your signed permission or power of attorney as required.

California

Mandatory Disclosures

We also make the following disclosures for purposes of compliance with California privacy law:

• We collected the following categories of personal information in the last 12 months: identifiers/contact information, Internet or other electronic network activity information, coarse geolocation data, audio information (voice recordings), and inferences drawn from the above.
• The sources of personal information from whom we collected are: directly from you, automatically or from third parties.
• The business or commercial purposes of collecting personal information are as summarized above and in our Privacy Policy under Processing Purposes.
• We disclosed the following categories of personal information for a business purpose in the last 12 months: identifiers/contact information, Internet or other electronic network activity information, coarse geolocation data, audio information (voice recordings), and inferences drawn from the above. We disclosed each category only to service providers, as described in the Sharing of Personal Data section of our Privacy Policy.
• We did not sell or share personal information in the last 12 months.
• We do not “sell” or “share” the personal information of known minors under 16 years of age.

Shine the Light Act

Under California Civil Code section 1798.83, also known as the “Shine the Light” law, California residents who have provided personal information to a business with which the individual has established a business relationship for personal, family, or household purposes (“California Customers”) may request information about whether the business has disclosed personal information to any third parties for the third parties’ direct marketing purposes. Please be aware that we do not disclose personal information to any third parties for their direct marketing purposes as defined by this law. California Customers may request further information about our compliance with this law by emailing legal@yap.so. Please note that businesses are required to respond to one request per California Customer each year and may not be required to respond to requests made by means other than through the designated email address.

Removal of Content

California residents under the age of 18 who are registered users of online sites, services, or applications have a right under California Business and Professions Code Section 22581 to remove, or request and obtain removal of, content or information they have publicly posted. To remove content or information you have publicly posted, or to request that we remove it, please send a detailed description of the specific content or information you wish to have removed, with its link, to report@yap.so. Please be aware that your request does not guarantee complete or comprehensive removal of content or information posted online and that the law may not permit or require removal in certain circumstances. If you have any questions about our privacy practices with respect to California residents, please send an email to legal@yap.so.

We value the trust you place in us and are committed to handling your personal information with care and respect. If you have any questions or concerns about our privacy practices, please email our Data Protection Officer at legal@yap.so.

Colorado/Connecticut/Virginia

If you live in Colorado, Connecticut, or Virginia you have some additional rights:

• If we deny your rights request, you have the right to appeal that decision. We will provide you with the necessary information to submit an appeal at that time.
• You have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. 10RI does not engage in such profiling as defined by Colorado law, so there’s no need to opt out.

Nevada

We do not sell your covered information, as defined under Chapter 603A of the Nevada Revised Statutes. If you still have questions about your covered information or anything else in our Privacy Policy, please send an email to legal@yap.so.

Contact Us

If you would like to contact us about our privacy practices, related matters referenced in this document, please email us at legal@yap.so.