Privacy Policy

Effective date: 2026-02-18

YuvFlow ("we", "us", "our") operates the YuvFlow web application. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights regarding that data. We are committed to being transparent and honest about our data practices.

1. Data We Collect

1.1 Account Information

When you create an account, we collect:

• Email address — required for account identification and communication.
• Name — optional, used for display within the application.
• Password — if you register with email. Stored securely using bcrypt hashing with a salt factor of 12. We never store or have access to your plain-text password.
• Profile picture URL — if you sign in with Google, we receive your Google profile image URL.

1.2 Authentication via Google OAuth

If you choose to sign in with Google, we receive the following from Google:

• Your Google account ID
• Your name and email address
• Your profile picture URL
• OAuth tokens (access token, refresh token, ID token)

We store these tokens solely to maintain your authenticated session. We do not access your Google Drive, contacts, Gmail content, or any other Google services beyond basic profile information.

1.3 Automatically Collected Data

When you use YuvFlow, we automatically collect certain technical information:

• IP address — used for rate limiting and recorded in administrative audit logs.
• User agent (browser/device info) — stored with push notification subscriptions for device identification and in audit logs.
• Timezone — automatically detected from your browser (via the Intl API) and saved to display dates and times in your local timezone.

1.4 Content You Create

We store all content you create within YuvFlow, including:

• Processes (titles, descriptions, statuses, dates)
• Actions and tasks
• Notes and timeline events
• File attachments (stored in S3-compatible object storage)
• Workspace names and settings

This data is stored in our PostgreSQL database and is necessary for the application to function.

1.5 Notification Data

• Push notification subscriptions — if you enable push notifications, we store your device's push endpoint URL and encryption keys (p256dh and auth) required by the Web Push protocol.
• Notification preferences — your choices about email digest frequency (off, daily, or weekly) and push notification settings.

2. How We Use Your Data

We use your personal data for the following purposes:

• Provide the service — manage your account, display your content, and enable collaboration within workspaces.
• Authentication — verify your identity and maintain your session.
• Notifications — send email reminders, push notifications, and in-app alerts based on your preferences and the processes you are involved in.
• Security — rate limiting, abuse prevention, and audit logging of administrative actions.
• Timezone display — show dates and times in your local timezone.

We do not use your data for advertising, profiling, or selling to third parties. We do not use any third-party analytics or tracking services (no Google Analytics, no Mixpanel, no Facebook Pixel, or similar).

3. Data Sharing

3.1 Within Your Workspace

YuvFlow is a collaboration tool. When you are a member of a workspace, other members of that workspace can see:

• Your name and email address
• Processes, tasks, notes, and attachments within that workspace
• Your profile picture

Workspace visibility is determined by your role (Owner, Admin, Member, or Viewer).

3.2 Third-Party Services

We share limited data with the following third-party services, solely to operate YuvFlow:

We do not sell, rent, or trade your personal data to any third party.

4. Cookies and Local Storage

4.1 Cookies

We use a single essential cookie:

• Session cookie (authjs.session-token or __Secure-authjs.session-token) — a cryptographically signed JWT token that maintains your login session. This cookie is httpOnly in production and is essential for the application to function. We do not use any advertising, analytics, or tracking cookies.

4.2 Local Storage

We store small amounts of non-personal data in your browser's localStorage for a better experience:

• Calendar view preference (month/week/agenda)
• Push notification registration status
• PWA install prompt dismissal status
• Temporary notification dismissal timestamps (expire after 30 minutes)

4.3 Service Worker Cache

If you use YuvFlow as a Progressive Web App (PWA), a service worker caches certain pages and static assets for offline access and faster loading. This cache is stored locally on your device and does not transmit data to us.

5. Data Storage and Security

• All application data is stored in a PostgreSQL database.
• File attachments are stored in S3-compatible object storage.
• Passwords are hashed using bcrypt (salt factor 12) and never stored in plain text.
• Sessions use JWT tokens signed with a secret key.
• Push notification payloads are encrypted using the Web Push protocol (ECDH key exchange).
• Invitation tokens are hashed with SHA-256 before storage.
• We implement rate limiting on sensitive endpoints (registration, login, API actions) to prevent abuse.

6. Data Retention

• Account data — retained for as long as your account is active. Deleted when you delete your account.
• Email verification tokens — expire and are deleted after 24 hours.
• Workspace invitations — expire after 7 days.
• Content (processes, notes, attachments) — retained until you or a workspace administrator deletes them, or until your account is deleted.
• Audit logs — retained for administrative and security purposes.

7. Your Rights

You have the following rights regarding your data:

• Access and export — you can export all your workspace data at any time from within the application (JSON format).
• Correction — you can update your name and profile information at any time.
• Deletion — you can request account deletion. When your account is deleted, we remove your profile, credentials, sessions, push subscriptions, notifications, and all content you created in workspaces where you are the sole member. In shared workspaces, processes you created are transferred to an administrator, and your file attachments are queued for deletion.
• Notification control — you can disable email digests and unsubscribe from push notifications at any time in your notification settings.
• Revoke Google access — you can disconnect your Google account through your Google account settings at any time.

8. Administrative Access

YuvFlow administrators (staff and super-admin roles) have access to limited user information for support and moderation purposes:

• Email address, name, and profile picture
• Account status (active, suspended, verified)
• System role and account creation date
• Aggregate counts (number of workspaces, processes)

Administrators cannot see your passwords, workspace content (process titles, descriptions, notes), or file attachments. All administrative actions (suspension, deletion, role changes) are logged in an audit trail.

9. Children's Privacy

YuvFlow is not intended for use by children under the age of 16. We do not knowingly collect personal data from children. If we learn that we have collected data from a child under 16, we will delete that data promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Effective date" at the top of this page. We encourage you to review this page periodically. Your continued use of YuvFlow after changes are posted constitutes your acceptance of the updated policy.

11. Contact

If you have questions about this Privacy Policy or want to exercise your data rights, please contact us at: privacy@yuvflow.app