Privacy policy

Your words.
Your information.

Effective 8 September 2026

This notice explains information used by the Yapp website, contact service and development versions of the app.

Who is responsible

Super Creative Incorporated, a US-based corporation, is responsible for Yapp and the personal information described in this notice.

For privacy questions or requests, use our secure contact form and start your message with “Privacy request”.

When you visit this website or contact us

• Website delivery and security. Our hosting service, OpenAI Sites, and its Cloudflare infrastructure process technical request information such as your IP address, browser information and request time to deliver and protect the site. The hosting service may use security cookies.
• Contact messages. The Google Forms contact form collects the reply email address and message you enter. We use them to read, investigate and respond to your enquiry, support request or privacy request. The form does not ask for files or payment information. You do not need a Google account to send a message.
• Private responses. Contact responses are stored in our Google Workspace account and are not published as a response summary. Google processes the form submission and may process technical information to operate and protect its service. See Google’s privacy policy.

We have not added advertising pixels or a marketing analytics service to this website. A contact message is not a newsletter subscription. Please do not include passwords, financial information or sensitive personal details in a message.

Information in development versions of the app

• Your learning content. Phrases, optional context, selected languages, categories, generated translations, review decisions and approved audio are processed to build and play your phrase library.
• Account information. Guest identifiers or a signed-in account identifier associate work and library records with you. Where Apple or Google sign-in is enabled, Amazon Cognito handles authentication and receives identity information supplied by that provider, including an email address where supplied. Apple may supply a private-relay address. Authentication tokens are stored in the device Keychain.
• Security and reliability. The app uses Apple App Attest and DeviceCheck signals to limit abuse. Restricted product-interaction and diagnostic events help diagnose failures and improve reliability. They can include activity checkpoints, bounded counts and an account-pseudonymous identifier. Phrase text, email addresses, raw provider responses and free-form error messages are excluded from this telemetry.
• Test purchases. Test versions can process Apple sandbox transaction identifiers and product information to test generation-unit balances. Public production purchases are not currently offered. Payment and purchase disclosures will be updated before paid availability.

AI, speech and infrastructure providers

Phrase text and the context needed for translation are sent through Amazon Bedrock to the configured language model. Development routing includes GLM and a Nemotron fallback. Approved text is sent to Amazon Polly for speech; some configured test locales can use Google Cloud Text-to-Speech instead. Only use content you are comfortable submitting for this processing. Generated output can be wrong, so review it before use.

Amazon Web Services provides app processing, account infrastructure, database storage, private audio storage and operational diagnostics. Apple and Google process information when you use their enabled sign-in or platform features. Google Workspace provides our contact intake. These services may process information outside your country under their applicable service and data-protection arrangements.

Storage and retention

The app stores account and learning records in its backend database and generated audio in private cloud storage. Downloaded audio is also kept on your device. Accepted raw app telemetry has a 14-day expiry. Operational logs, security records and recovery backups have separate lifecycles; a telemetry expiry does not mean all account data is deleted after 14 days.

We retain contact information while it is needed to handle the request and related follow-up, and to meet applicable legal or security needs. You can ask us to delete your contact submission. App content is retained to provide the library and related account functions until removed through the available app controls or an applicable deletion process. Recovery copies and records needed for legal or security reasons may have a separate retention period.

Your choices and requests

You can choose what phrases and context to provide and whether to contact us. Development builds include an account-deletion workflow to stop new account work and remove account-owned content, audio and linked identity records. If you cannot access it, or want help with access, correction or deletion, use the contact form. Do not send an identity document unless we specifically request an appropriate verification step.

Depending on applicable law, you may have rights to access, correct, erase or obtain a copy of personal information, restrict or object to certain processing, withdraw consent where processing relies on consent, or complain to a data-protection authority. We may need to verify that a request relates to your information. We will explain any legal limits or information we must retain when responding.

Security

The website and contact form use HTTPS. Contact responses are restricted to the authorized Workspace account, and app audio storage is private. No service can guarantee absolute security. Use the contact form to report a concern without including passwords or other secrets.

Updates

We will revise this notice when data handling changes and show the effective date here. A public app release, new provider or new collection purpose may require additional disclosures or choices in the app.