What Yui keeps, and how to delete it.

Last updated September 28, 2026.

Invites

Yui is in alpha, open to anyone on TestFlight. You can also ask us for an invite, or for a hand getting set up, with the form at the bottom of each page. When you do, or we invite you, we store your first and last name, the email you give us (the one on your Apple ID, because that is where TestFlight sends the invite), your phone number, which page and link brought you, your browser type, and where your invite stands: requested, approved, invited, claimed or declined. Nobody but Yui's server can read that table.

• We use it only to review your request and get you into Yui. Your phone number is for reaching you about your request, never for marketing.
• When we approve you, we send your name and email to Apple, which adds you to Yui's TestFlight beta and emails you the invite.
• Yui also emails you, from yuigui.com: a link to confirm your address, and word about your invite. See Email.
• Your invite also carries a one-time code for a link like yuigui.com/i/…. We keep only a scrambled (hashed) form of it. It works once.
• When you first sign in to the app, Yui matches your invite by that email, or by the code if you hid your email, and links it to your account.
• An invite we decline is deleted 30 days later. An invite you claimed stays with your account and is deleted with it. To remove a request or an invite you have not used, email us.

Email

Yui has her own mailbox at yuigui.com, and she runs it herself: she reads what comes in and answers on her own, by rules we write together. Chris, who builds Yui, can read the mailbox too. We send email through SendGrid.

• What we keep: every email you send us or we send you (who, when, the subject, the words and any attachments), whether it was delivered, and, for each address, whether you confirmed it, asked for news, or asked us to stop.
• What we send: a link to confirm your address when you ask for an invite, word about your invite or account, answers to what you write, and news about Yui only if you ticked the box and confirmed.
• Every news email has a link to stop it, and mail apps' own unsubscribe button works too. You can stop all email from Yui the same way. A bounce or a spam report stops mail to that address.
• We never sell or share your address. Links in our email are the real links; we don't track opens or clicks.
• Mail is deleted a year after the last message in its thread.

Chatting with Yui on this site

The chat bubble at the bottom right of yuigui.com is Yui, the same helper as in the app. You need no account to use it. We keep every chat, because reading them is how we learn what people want from Yui: we store what you and Yui say, the pages you were on, your browser type, which link brought you, and a scrambled (hashed) form of your IP address, never the address itself. Yui also writes short notes as you talk, like "wants an Android app" or "found a bug on the playground". Nobody but Yui's server can read these tables.

• Your messages go to OpenRouter, which passes them to the model that writes Yui's replies. We ask it not to keep or train on them.
• After a few messages, Cloudflare Turnstile checks that you are a person. Cloudflare sees that check, under its own privacy policy.
• If Yui asks and you choose to leave your name, email and phone, they are stored with the chat and as an invite request (above), and used only to reach you about Yui.
• This browser keeps a copy of the chat so it is still there on the next page. New chat clears it.
• To have your chats deleted, email us.

Signing in

You sign in to the Yui app with Apple. There is no password. Apple gives Yui a random ID that is unique to Yui and, if you allow it, an email address. If you choose "Hide My Email", Yui only ever sees an Apple relay address.

What the app stores on our servers

• Your account: Apple's ID for you, your email or relay address, and when you created the account and last signed in.
• Sign-in sessions, so you stay signed in. We store only a scrambled (hashed) form of each session key. A session ends after 60 days without use.
• A token from Apple that lets us remove Yui from your Apple ID when you delete your account.
• Your devices: a name and a push notification token, so your agents can reach you. While Yui is open, which agent's thread is on screen, so an answer you are already reading does not buzz too. It is cleared when you leave the app.
• Your agents: the name, color and look you gave each one, and whether its notifications are muted.
• The computers your agents run on: the name the computer reports (like "Sam's MacBook"), when it last checked in, and a scrambled form of its key. Pairing codes are single use, expire after 10 minutes and are deleted a day later.
• Agent access keys you create in Settings, so one of your agents can manage your other agents: the name you gave it, when it was last used, and a scrambled form of the key. They can never read your messages.
• Your messages with those agents, so a conversation shows up on your phone, with when each one was delivered to and handled by the agent. A reaction you leave on a message is stored on that message. Messages older than 90 days are deleted automatically, and so are photos and pictures no remaining message uses.
• Photos you send an agent (from the camera or your library) and pictures or videos your agents send you. They sit in private storage that only your account and the agent you sent them to can open, through links that expire. Yui only sees a photo when you pick or take one to send.

What stays on your phone

• Saved screens (the shelf above a thread) live only on your phone. The app rebuilds them from your messages, so they go when the messages do.
• A message you send while offline waits on your phone and goes out when you are back online.

Keeping Yui safe

• Usage counters per account (how many messages, agents or uploads in a short window) enforce Yui's limits. Idle counters are deleted after a day.
• A wrong pairing code records the network (IP) address it came from, for one day, so nobody can guess codes. It is used for nothing else.
• If an account or computer breaks the limits or is abused, we can pause it. We store when and why, and lift it when it is resolved.

Where it goes

That data lives in a Supabase database in the United States. Each account can read only its own rows. Push notifications travel through Apple's push service and carry the agent's name and a preview of its reply. Your agents run on their own computers, which you connect: messages you send an agent go to that agent. We do not sell your data, share it with advertisers, or use it to track you across other apps. The app has no ads, no third-party analytics and no crash reporting service. It does not use your location or contacts.

On the computers your agents run on

The Yui plugin keeps a small outbox there, so a reply is not lost when the network drops. Photos you send reach the agent as files in its cache. The plugin can also log which custom screen shapes an agent draws (field names and types, never the values) to learn what to build next. That log is off unless the computer's owner turns it on, stays on that computer, and is never uploaded.

Planned: the private ledger

Not recording yet. For use to earn, Yui plans a private ledger of facts: the day your account was made, the days you sent a message or answered a screen, and pull requests or feedback of yours that shipped. It never holds what you said: it reads when a message was sent and by whom, never the words. Only Yui's server can read it today, a view of your own rows comes later, and deleting your account deletes them. When it starts, it fills in back to your first day, and this page will say the date. Details in the ledger spec.

Deleting your account

In the app, open Settings, then Account, then Delete account, and confirm. Deletion happens right away: your account, sessions, devices, agents, computers, pairings, access keys, messages, photos and pictures, and your invite, are removed from our servers, and Yui is removed from your Apple ID. It cannot be undone. Signing in with Apple again later starts a new, empty account.

Your agents run on their own systems. Deleting your Yui account removes what Yui stores; it does not erase what an agent you talked to kept on its own side.

Every table, by name

Yui is open source, so here is the full list. It matches the database migrations in the app repo.

What we declare to Apple

On the App Store privacy label, Yui lists: contact info (email address), identifiers (your account ID and the device push token), user content (your messages, and the photos and videos in them) and usage data (which thread is open). All of it is linked to your account, used only to make the app work, and none of it is used to track you.

Help and contact

Questions, problems or a deletion you cannot finish in the app: yuigui.com/help, or email [email protected]. Yui is open source, so you can also read exactly what it does at github.com/postscarcityai/yui.

This website

The film behind "Watch the film" in the top bar and the videos on these pages are hosted here, and nothing loads until you press play. yuigui.com uses Google Analytics to count visits. It never sees an invite code: an invite link is counted as yuigui.com/i/ without it. The form at the bottom of each page writes to the yui_invites table, described under Invites above. The old waitlist (yui_waitlist) is closed, and its entries became invite requests. To be removed, email us.