Privacy Policy

This Privacy Policy explains how Yet Another AI HK Holdings Limited ("Yet Another AI", "we", "us", or "our") collects, holds, uses, discloses, and protects personal data in connection with Yet Another AI.

1. Scope ​

This Privacy Policy applies to the current yetanother.ai service, including:

• the website and documentation under yetanother.ai;
• the account and Desktop authorization portal under yetanother.ai;
• the Desktop application under yetanother.ai;
• Hosted backend and AI features under yetanother.ai; and
• download and update services under yetanother.ai.

It does not apply to a project, manuscript, game export, or other content after a user independently distributes it. The recipient or distributor of that material is responsible for their own handling of it. This Privacy Policy also does not apply to third-party websites or services that publish their own privacy policies.

2. Who we are ​

Yet Another AI HK Holdings Limited is the data user responsible for the personal data described in this Privacy Policy.

Registered address:
FLAT/RM B3, 19/F TUNG LEE COMM, BLDG 91-97, JERVOIS ST SHEUNG WAN HONG KONG 122001

Privacy contact: privacy@yetanother.ai

3. Personal data we collect ​

3.1 Account data ​

We collect the information needed to create and administer an account, including:

• email address;
• encrypted password credentials;
• internal account identifier;
• account creation and update times; and
• account status and settings.

We do not store a readable copy of your password.

3.2 Authentication and security data ​

When you sign in through the website or authorize the Desktop application, we process:

• access and refresh tokens;
• Desktop authorization and one-time exchange records;
• token issue, expiry, refresh, and revocation information;
• security and anti-abuse records; and
• related timestamps and technical identifiers.

Browser authentication tokens are stored in your browser's local storage. Desktop tokens are kept outside the renderer process and protected using operating-system secure storage where available. You can remove local browser data through your browser and revoke a session by signing out.

3.3 AI requests, responses, and submitted project content ​

When you use an AI feature, we collect and retain the complete request sent through the AI Gateway and the response returned for that request. Depending on how you use the product, this data may include:

• prompts, instructions, messages, and conversation history;
• story text, DSL source, project metadata, or other project excerpts included in the request;
• model selection and generation settings;
• tool calls and tool results;
• model responses, generated text, and usage information; and
• safety, quality, and operational metadata associated with the request.

We associate AI requests and responses with a pseudonymous account identifier rather than placing your email address in the training and evaluation record. We keep the account-to-identifier relationship separately so that we can locate and delete identifiable records when appropriate. Pseudonymised data remains personal data while we can reconnect it to an account.

3.4 Desktop product analytics ​

Desktop product analytics are off by default. We collect them only after you affirmatively enable analytics in the settings. The events may include:

• application version, operating system, and application language;
• a random installation identifier;
• feature activation counts;
• session duration; and
• operation success or failure counts.

Desktop analytics do not include prompts, model responses, story text, project names, file names, file paths, credentials, or other free-form user content. You can disable Desktop analytics at any time in settings. Disabling analytics stops future analytics collection but does not automatically remove events already sent; you may contact us to request deletion of identifiable analytics data.

3.5 Website analytics ​

On the website, the Google Analytics tag loads when you visit. Website analytics storage is enabled by default, so Google Analytics may read and write first-party analytics cookies and use persistent online identifiers for session and usage measurement. These measurements may process information such as:

• pages viewed and interactions with the website;
• referring page and approximate location derived from network information;
• browser, device, operating system, and language;
• IP address and short-lived technical identifiers; and
• date, time, and session information.

If you allow analytics storage, Google Analytics may also read and write first-party analytics cookies and use persistent online identifiers to produce more complete session and usage measurement. We keep advertising storage, advertising user data, and advertising personalisation denied in both modes. Google may process analytics data in accordance with the Google Privacy Policy.

3.6 Error and diagnostic data ​

Production and staging builds automatically send restricted error reports to Sentry so that we can diagnose crashes and software defects. These reports are limited to information needed to group and investigate an error, such as:

• exception type and redacted exception information;
• stack frames;
• request method and path, without query strings;
• application release, build environment, and runtime context; and
• native error classifications.

Before an event is sent, we remove user identity, request bodies, cookies, headers, query strings, arbitrary contexts, extras, tags, breadcrumbs, free-form exception messages, and similar content. We do not enable Sentry performance tracing, profiling, session replay, screenshots, local-variable capture, or Electron minidump attachments. Sentry processes diagnostic data under its Privacy Policy.

Error reporting is separate from Desktop product analytics and is not controlled by the Desktop analytics setting.

3.7 Service and network logs ​

Our infrastructure and service providers generate operational records when you use our products. These records may include IP address, request time, request path, response status, user-agent information, download requests, rate-limit events, and security signals. We minimise and redact logs where practicable. Data remains personal data where it can still reasonably be related to an individual, even after direct identifiers are removed.

3.8 Support and other communications ​

If you contact us, we collect your contact details and the content and attachments you choose to send. Please do not send a complete project, credentials, government identity document, or other sensitive material unless we specifically request it and it is necessary to resolve your issue.

3.9 Marketing preferences ​

You may separately choose at registration to receive our product news, feature announcements, events, and offers. The marketing option is not selected by default. We record your email address, choice, the notice shown when you made that choice, and the time of consent or withdrawal.

We do not use email-open pixels or click tracking in marketing email. You may opt out at any time through the unsubscribe control in a marketing email or by contacting privacy@yetanother.ai. Opting out of marketing does not stop transactional messages such as account security notices, service notices, or Privacy Policy change notices.

3.10 Information we do not currently collect ​

We do not automatically upload or collect the contents of a local project directory. Project content leaves your device only when you deliberately include it in an AI request, support request, export, or another action that clearly transmits it.

We do not currently collect payment card details. If paid features are introduced, a third-party payment processor will collect full card details directly. We may then receive limited billing records such as transaction identifier, amount, currency, payment status, billing country, and card brand or last four digits. We will update this Privacy Policy before introducing that processing.

4. How we obtain personal data ​

We obtain personal data:

• directly from you when you register, use AI, change a setting, subscribe to marketing, request support, or exercise a privacy right;
• automatically from the our website, Desktop application, and service infrastructure;
• from AI model and inference providers when they return a response or usage information; and
• from analytics, error-reporting, hosting, content-delivery, security, and communications service providers.

5. How we use personal data ​

We use personal data to:

• create, authenticate, maintain, secure, and delete accounts;
• authorize and revoke Desktop sessions;
• provide AI generation and related product functionality;
• operate, validate, troubleshoot, and improve our products;
• train and evaluate models and improve generation quality;
• investigate safety, fraud, abuse, and security incidents;
• provide customer support;
• measure website usage and, where enabled, Desktop usage;
• send marketing where you have chosen to receive it;
• send transactional, security, and policy notices;
• establish, exercise, or defend legal claims;
• comply with applicable law and enforceable legal process; and
• protect the rights, safety, and property of users, Yet Another AI, and others.

We do not use our AI to make decisions about you that produce legal or similarly significant effects.

6. Required and optional information ​

An email address and authentication credentials are required to hold and use an account. If you do not provide them, we cannot create or authenticate the account.

AI request data is required only when you choose to use an AI feature. The AI feature cannot work without sending the request to Yet Another AI and applicable AI providers. Use of AI request and response data for the AI purposes described in Section 7, including model training and quality evaluation, is part of the AI feature and cannot currently be disabled separately. If you do not want your content processed for those purposes, do not use our AI features. You may continue to use available local, non-AI features.

Website analytics run by default on the production website. Desktop product analytics and marketing email remain optional. Refusing or withdrawing those optional choices does not prevent you from using our core features.

7. AI processing, model training, and human review ​

7.1 AI Gateway ​

Our AI Gateway receives, validates, stores, and transmits AI requests and responses. It uses a self-hosted NewAPI deployment to route requests to available model and inference providers. NewAPI is part of our own hosted infrastructure; the downstream model providers are third parties.

Where an upstream interface supports it, the Gateway requests that the provider not store the response. A no-store instruction does not override a provider's independent legal obligations, security processing, or published data practices.

7.2 Our training and evaluation ​

We use stored AI requests and responses to train or fine-tune our models, create evaluation sets, assess output quality, test safety controls, and improve our products. Records used for these purposes remain associated with a pseudonymous account identifier during their retention period so that we can apply deletion requests where technically possible.

Human review conducted by Yet Another AI is limited to our own personnel who require access for model training, quality evaluation, safety investigation, or customer support. Those personnel are subject to confidentiality duties, role-based access restrictions, and access auditing. We do not authorise personnel to browse user content out of curiosity or for purposes unrelated to their work.

7.3 Third-party AI providers ​

Our available models and providers change frequently. We disclose them by category as AI model, inference, safety, and supporting infrastructure providers. They may be located globally and may receive prompts, submitted project excerpts, request settings, pseudonymous safety identifiers, and model outputs.

Some providers may retain request or response data, use it to improve or train their models, or act as an independent data user under their own terms and privacy policies. We cannot offer a provider-specific no-training route at this time. Provider data practices may vary by model and may change independently.

7.4 Deletion and trained models ​

Following a valid deletion request, we remove AI requests, responses, and training or evaluation samples that we can still locate through your pseudonymous account mapping, subject to the exceptions described in this Privacy Policy. We will also forward a deletion request to a provider for provider-held data where our contract and technical integration permit us to do so.

We do not perform model unlearning. Deletion of source records does not remove or reverse any influence those records may already have had on the parameters of a model trained by us or a third party. Deleted source records will not be selected for a later training run.

7.5 Personal data about other people ​

Do not submit personal data about another person unless you have a lawful right to do so and have given them any notice required by law. Personal data about another person that appears in an AI request is subject to the same storage, training, review, and third-party disclosure described in this Privacy Policy. A non-user who believes their personal data has been submitted to us may contact us at privacy@yetanother.ai.

8. When we disclose personal data ​

We may disclose personal data to the following categories of recipients for the purposes described in this Privacy Policy:

• AI model and inference providers, to produce responses and, depending on the provider, to support safety, quality improvement, or model training;
• analytics providers, including Google Analytics for production website analytics and enabled Desktop analytics;
• error-reporting providers, including Sentry, for restricted and sanitised diagnostic events;
• cloud hosting, database, storage, content-delivery, download, and security providers, to operate and protect our products;
• email and communications providers, to deliver transactional messages and marketing you requested;
• professional advisers, auditors, insurers, and legal service providers where reasonably necessary;
• law enforcement, regulators, courts, and other authorities where disclosure is required or permitted by applicable law or necessary to protect legal rights or safety; and
• a successor or transaction counterparty in connection with a proposed or completed merger, financing, acquisition, reorganisation, or sale of assets, subject to appropriate confidentiality and use restrictions.

We do not sell or rent personal data. We do not provide your personal data to another company for that company's direct marketing.

9. Data location and international processing ​

Our personnel access to that data is controlled from within our organisation.

Third-party AI, analytics, error-reporting, content-delivery, hosting, security, and communications providers may process data in other countries or regions. Website content and downloads may also be delivered through globally distributed infrastructure.

When we appoint a provider to process personal data on our behalf, we use contractual, technical, and organisational measures appropriate to the nature of the processing. A provider that uses data for its own purposes may have separate responsibilities under its own privacy policy.

10. Retention ​

We retain personal data only for as long as reasonably needed for the purposes described above, subject to legal, security, dispute-resolution, and backup requirements.

We may retain data longer where required by law, necessary to establish or defend a legal claim, or necessary to investigate a specific security or abuse incident. When a retention period ends, we delete the data or irreversibly aggregate or anonymise it. We may retain data that can no longer reasonably identify an individual.

Third-party providers apply their own retention periods. In particular, their retention or use of AI data may continue after our copy has been deleted, and a trained model may retain the influence described in Section 7.4.

11. Your choices ​

You may:

• decline or later disable Desktop product analytics;
• decline marketing email or unsubscribe at any time without charge;
• clear website local storage through your browser;
• sign out to revoke a browser or Desktop session; and
• avoid transmitting project content by not using an AI or support feature that sends it.

Withdrawing an optional choice stops future processing for that purpose. It does not make prior processing unlawful, erase data that must be retained for another permitted purpose, or cause model unlearning.

12. Access, correction, and deletion requests ​

You may contact privacy@yetanother.ai to:

• ask whether we hold personal data about you;
• request access to or a copy of that data;
• request correction of inaccurate data;
• request deletion of data that is no longer required;
• withdraw a Desktop analytics or marketing choice; or
• raise a privacy question or complaint.

We ordinarily verify an account holder by sending a one-time confirmation link to the verified registration email address. We ask for additional information only where reasonably necessary to confirm identity or authority. We do not require a government identity document as a standard condition of making a request.

Some requests may be limited or refused where permitted or required by law, including where we cannot verify the requester, cannot reasonably locate the requested data from the information provided, must protect another person's rights, or must retain data for legal, security, or claim purposes. We will explain an applicable refusal where required.

13. Security ​

We use technical and organisational safeguards designed for the nature and sensitivity of the data we process. These safeguards include:

• encryption in transit and server-side encryption at rest;
• separation of account information from pseudonymous training identifiers;
• role-based and least-privilege access controls;
• confidentiality obligations for personnel with content access;
• access logging and review;
• restricted, sanitised error reporting;
• credential isolation and secure local token storage; and
• retention limits and scheduled deletion.

No storage or transmission method is completely secure. We cannot guarantee absolute security. If we become aware of a personal-data incident, we will investigate, mitigate it, and notify affected individuals and relevant authorities where applicable law requires notification.

14. Changes to this Privacy Policy ​

We may update this Privacy Policy to reflect changes to us, our providers, or applicable law. For a material change that affects how we use personal data or the choices available to you, we will post notice on the our website and email registered users at least 30 days before the change takes effect.

We may make non-material corrections, formatting changes, contact-detail updates, or clarifications immediately. The version and effective date at the top of this page identify the current policy.

15. Contact us ​

Questions, requests, and complaints about this Privacy Policy or our handling of personal data may be sent to:

Yet Another AI HK Holdings Limited
FLAT/RM B3, 19/F TUNG LEE COMM, BLDG 91-97, JERVOIS ST SHEUNG WAN HONG KONG 122001
Email: privacy@yetanother.ai