Privacy Policy
Last updated: September 6, 2026
1. Introduction
This draft describes the data flows implemented in Yapwise for Mac and on https://yapwise.xyz. Yapwise turns spoken thoughts into editable mind maps using a native Mac app and cloud services. The legal identity and address of the operator responsible for your information must be confirmed before publication.
2. Account information
Google Sign-In requests openid, email, and profile permissions. The backend receives a Google account identifier, email address, display name, and profile image information. It creates an app account, authentication sessions, and subscription records. The Mac app stores its session credential in macOS Keychain. Google account passwords are not submitted to Yapwise.
3. Voice and audio
With your permission, the Mac app captures microphone audio and streams it to Apple’s Speech framework for transcription. The current app does not force on-device speech recognition; audio may be processed by Apple’s servers. The inspected implementation does not upload audio recordings to the Yapwise backend or OpenAI and does not implement a persistent recording library. Microphone and Speech Recognition permissions can be revoked in macOS System Settings.
4. Transcripts and AI processing
After capture finishes, the app sends the final transcript, timezone, and date context to the Yapwise backend. The backend passes the transcript and relevant context to OpenAI to identify topics, relationships, and actions and generate structured mind-map content. This is cloud processing. A local unfinished transcript draft may be kept for recovery; the capture interface includes a Discard action. Provider retention and data-use settings require confirmation; this draft makes no zero-retention or no-training guarantee.
5. Mind maps and saved content
Maps, original and cleaned transcripts, nested nodes, action items, edits, and library metadata are saved in a local cache and synchronized through authenticated backend endpoints. Production storage is implemented using MongoDB Atlas. The app can retain local content even when synchronization fails. Removing the app or signing out should not be assumed to delete backend records.
6. Device and technical information
The app and backend use diagnostic events such as request identifiers, error types, timing, and node counts for operation and troubleshooting. The website includes Vercel Web Analytics and Speed Insights for page visits, performance, and conversion interactions. Hosting services receive technical request information to deliver the website and API. The final hosting regions, log retention, and analytics account settings have not been confirmed. No additional crash-reporting vendor was identified in the inspected code.
7. Optional Google Calendar connection
Calendar connection is separate from basic sign-in. It requests openid, email, and the calendar.events scope, which permits viewing and editing events on your calendars. The implementation stores the connected email, access token, refresh token when supplied, expiry, and connection metadata. It creates requested events in your primary calendar, using event details such as title, description, and start/end times; optional Meet links may be requested. These permissions are broader than creation alone. Access can be revoked through your Google Account. Calendar availability depends on the deployed integration configuration.
8. Payment and billing data
The app’s billing integration uses Dodo Payments. The backend sends your account email, name, selected product, and account reference to create checkout. Dodo handles payment details in its checkout. Yapwise stores subscription and customer references, status, billing dates, and cancellation state; the inspected code does not collect full payment-card numbers. Payment providers may retain transaction records under their own policies and legal obligations.
9. How information is used
Information is processed to authenticate you, transcribe speech, generate and save maps, synchronize content, provide requested integrations, manage billing, diagnose failures, and measure website performance and conversion. The website’s conversion events contain the interaction name and, for an expanded FAQ, its question; they do not send your map content or transcripts. No advertising-data sale integration was identified, but a binding no-sale commitment requires operator review.
10. Service providers
The implemented integrations include Apple Speech (audio transcription), Google (identity and optional Calendar), OpenAI (transcript structuring), MongoDB Atlas (production database), Dodo Payments (billing), Vercel Web Analytics and Speed Insights (website measurement), and a YouTube-hosted iOS app demonstration. The YouTube player is loaded only when a visitor chooses to play it; YouTube may then process information under its own policies. Vercel deployment configuration exists for the website; the actual API host and infrastructure arrangements must be confirmed. The website waitlist stores email address, signup source, and creation time in MongoDB so the operator can manage priority rollout. No email-delivery provider was verified.
11. Storage and retention
The implementation has local app storage and account-scoped cloud storage. Exact retention periods for content, local drafts, accounts, logs, backups, provider requests, and billing records have not been established in the supplied implementation. A production retention schedule must be supplied; this draft does not promise deletion within a fixed number of days.
12. Account deletion and choices
A complete self-service account/data deletion endpoint was not found in the inspected Mac backend. Discarding an unfinished local transcript is distinct from deleting cloud content or an account. The operator must establish a verified privacy contact and a process covering account records, saved maps, transcripts, local copies, backups, and processor requests. Revoking Google permissions does not itself delete Yapwise records.
13. Security
The production app is configured to communicate with an HTTPS API. The implementation uses account-scoped access, OAuth state and PKCE protections, Keychain-backed app sessions, and signed billing webhooks. These mechanisms do not establish a blanket guarantee of security. Database encryption settings, connector-token protections, access management, and backup controls require an operational review. No encryption-at-rest or security-certification claim is made here.
14. Rights and lawful processing
Depending on applicable law, you may have rights to request access, correction, deletion, portability, restriction, or objection, withdraw consent, or complain to a supervisory authority. Permissions can be changed in macOS and Google settings. The operator must determine applicable legal bases and publish a working rights-request contact and verification process before this policy is finalized.
15. International processing
The listed providers may process information outside your country. Specific storage regions, transfer mechanisms, and contractual safeguards must be confirmed against the production accounts and provider agreements. This draft does not claim that a particular transfer safeguard is already in place.
16. Children’s privacy
No child-directed experience or age-verification implementation was identified. The operator must establish an eligibility age and a process for handling children’s data consistent with applicable law before public adoption of this policy.
17. Changes to this policy
The policy should be updated when data flows, providers, retention, or user choices change. The date at the top records this draft’s revision. Material changes should be communicated as required by applicable law.
18. Provider information
See Apple’s speech-recognition privacy information and Dodo Payments’ Privacy Policy for their respective processing practices.
19. Contact
Website: yapwise.xyz. A current official privacy contact has not yet been confirmed. This must be supplied before the policy is adopted.