Privacy Policy

1. Overview

Yallah AI ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data. By using the Service, you agree to the practices described here.

2. Information We Collect

Account information: When you register, we collect your name, email address, phone number, and country. This information is stored securely in our database.

App data: We store all data you create in the Service, including tasks, goals, budget entries, chat messages, time tracking logs (start/end times, durations per task), and AI memory notes. This data is used exclusively to provide the Service to you.

Calendar & reminder data: When you set due dates, deadlines, or reminder times for tasks and goals, these are stored and used to deliver push notifications.

Timezone and notification preferences: We detect and store your device timezone (as an IANA identifier, e.g. "America/New_York") automatically when you use the app. This is used solely to deliver task and goal reminder notifications at your local time. Premium subscribers may also store up to three custom reminder times (hours of the day you prefer to receive reminders). These preferences are visible in Settings and can be changed at any time.

Payment information: Payments are processed by Paddle. We do not store your full card number or payment credentials. We only receive confirmation of successful transactions and your subscription status.

Device and log data: We may collect your IP address, browser type, operating system, and pages visited for security, debugging, and analytics purposes. On mobile, we collect a push notification token to deliver reminders.

Geolocation (approximate): We use your IP address to determine your approximate country for tax display purposes only. This is cached in your browser's localStorage for 24 hours and is not stored on our servers.

3. How We Use Your Information

• To create and manage your account
• To provide and personalize the AI assistant experience
• To process payments and manage subscriptions
• To send transactional emails (account confirmation, password reset, support replies)
• To detect and prevent fraud or abuse
• To improve and develop new features

We do not sell your personal data to third parties. We do not use your data for advertising profiling.

4. AI Data Processing

Messages you send to the AI assistant are processed by Anthropic's Claude API to generate responses. Your messages are sent to Anthropic's servers for processing. We do not use your conversations to train AI models. Please review Anthropic's privacy policy for details on how they handle data.

5. Data Storage and Security

Your data is stored on Supabase-hosted infrastructure with encryption at rest and in transit. We implement industry-standard security measures including secure HTTPS connections, row-level security policies, and access controls. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

Administrative access: Yallah employs a small team of administrators and support staff who may access your account data to assist with support requests, investigate abuse, or maintain the integrity of the Service. Administrators with a "full admin" role can view your profile, subscription status, account activity, and support tickets. Support-role staff have more limited access. Administrators can disable accounts that violate our Terms of Service. We will not access your personal content (tasks, goals, budget entries, or chat messages) without a legitimate support or safety reason. All administrative access to account data is logged for accountability.

6. Third-Party Services

We use the following third-party services to operate the platform:

• Supabase — database, authentication, and file storage
• Anthropic (Claude) — AI chat and goal coaching processing
• Paddle — payment processing and subscription management
• Resend — transactional email delivery
• Firebase (Google) — push notifications on mobile
• Vercel — web hosting and deployment
• ipapi.co — approximate country detection for tax display (no account data sent)

Each of these services has its own privacy policy governing how they handle data.

7. Data Retention

We retain your account data for as long as your account is active. If you delete your account, all your personal data — including tasks, goals, budget entries, chat messages, time tracking logs, and AI memory — is deleted immediately and permanently. We do not retain backups of deleted accounts beyond standard database backup rotation (typically 7 days). Anonymized aggregate statistics may be retained indefinitely.

Archive retention: Archived tasks and goals are retained for different durations based on your plan: Free plan — 7 days; Pro plan — 4 months; Premium plan — 1 year. After this period they are permanently deleted. Items in the Recycle Bin (locked or soft-deleted) are retained for up to 30 days before permanent deletion.

8. Trial Period Data

New accounts receive a 7-day free trial with full Pro-tier access. During the trial we collect and store the same data as any paid subscriber. When a trial expires, your account automatically downgrades to the Free plan. If you created more data than the Free plan allows, excess items are moved to your Recycle Bin and marked as locked. Locked items are retained for 30 days and are fully restorable by upgrading at any time. Locked items are permanently deleted after 30 days if you do not upgrade.

9. Tax & Payment Processing

Payments are processed by Paddle, who acts as the Merchant of Record for all transactions. Paddle is responsible for calculating and collecting any applicable taxes (including VAT, GST, and sales tax) based on your billing country. We receive only a confirmation of payment and subscription status — we never see or store your card details. Tax amounts shown at checkout are calculated and applied by Paddle and may vary by location.

10. Data Export & Portability

You have the right to export your data:

• Goals export: Export your goals as an Excel spreadsheet (Pro & Premium) or PDF report (Premium only) from the Goals page.
• Account data request: Contact support@yallahai.app to request a full export of all your account data in a machine-readable format.

11. Cookies & Local Storage

We use:

• Session cookies — to keep you logged in. These are cleared when you sign out.
• localStorage (browser) — to cache your approximate country (for tax display, 24-hour TTL) and AI goal coaching responses (24-hour TTL). No personal data is stored in localStorage.
• WebView localStorage (mobile app) — the iOS and Android apps are WebView-based wrappers around the same web app. They use the same browser localStorage as the web version for session and caching purposes. This is cleared when you sign out or delete your account.

We do not use advertising, tracking, or analytics cookies.

12. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of your personal data
• Correction — request correction of inaccurate data
• Deletion — request deletion of your account and data
• Portability — request an export of your data
• Objection — object to certain processing of your data

To exercise any of these rights, contact us at support@yallahai.app.

13. Children's Privacy

The Service is not directed at children under 13 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

14. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via email or an in-app notice. The date at the top of this page reflects the most recent revision.

15. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us at support@yallahai.app.