private by design, not by promise.
no ad ids, no behavioral trackers, no third party sdks. what we do not collect cannot be leaked, sold or subpoenaed.
encrypted · wipeable · never sold
your device
keys live here
readable only here
still on for saturday?
hotel option still open
save the alfama pin
••••••••••••••••
yankee servers
ciphertext only
waiting for sync
— — — —
a8f3 · 9c21 · e4b0 · …
7d12 · b90e · 44af · …
c1e9 · 02dd · 88f1 · …
the stance
how yankee stays private
yours alone
never sold, never used to train ai. your writing will stay your writing.
private + encrypted
feed, memory and dms will live encrypted. plaintext will stay on your devices.
your keys, not ours
decryption keys will live with you. even we will only hold ciphertext blobs.
gone when you say so
you'll be able to delete your account any time. memory, messages and history will be wiped.
what it means
privacy in plain words
end to end
scrambled on your phone. readable only there.
messages and calls will be encrypted on your device and only decrypted on the recipient's. yankee will not be able to read them, even if asked.
zero trackers
no ad sdks. no session replay.
if we do not ship a tracker, we cannot leak it. yankee is funded by people, not by selling attention.
local first
your device holds the primary copy.
the cloud is an encrypted backup you can pause or turn off. nothing trains a model on your posts.
glossary
the privacy words we use
plain english definitions of how yankee is built. what they mean, and why they matter.
concepts
end to end encryption
messages and calls are scrambled on your device and only unscrambled on the recipient's. yankee cannot read them.
zero trackers
no third party analytics, ad sdks or session replay tools ship inside the app.
data minimization
yankee asks for the smallest amount of information needed. extra data is never collected just in case.
local first sync
your device holds the primary copy. the cloud is an encrypted backup you can pause or turn off.
controls
right to deletion
export everything in one tap and delete your account. servers will wipe within 30 days.
region pinning
pick where your encrypted backup lives, eu or us. change it once a year if you need to.
quiet permissions
location, contacts, camera and microphone are off by default until a feature needs them.
transparency report
we publish what we receive, what we can hand over, and what we cannot. usually almost nothing.
how it works
three layers. no loopholes.
encrypt on device
drafts, dms and memory will be locked before they leave your phone.
store only ciphertext
if you enable backup, yankee servers will hold blobs we cannot read.
delete for real
when you wipe an account, plaintext and backups will expire. no hidden copies.
the things we do not collect cannot be leaked.
region pinning, quiet permissions, a public transparency report. privacy is architecture, not a marketing page.
frequently asked
short answers about encryption, deletion and what yankee can never see.
No. Direct messages and calls will be end-to-end encrypted. Keys will live on your devices. Even under a subpoena, we would only be able to hand over ciphertext blobs.
yankee
your data stays yours.
encrypted where it matters, wipeable whenever you want, never sold and never trained on.
