Privacy Policy

Last updated: 19 October 2026

Yahee is built so that we know as little about you as possible. This page explains what we do store.

What we store

• Account: your username, a salted hash of a value derived from your password (we never receive the password), and your encrypted master key. Your display name and avatar are stored encrypted.
• Your content: files, notes, journal entries, calendar events, messages and similar data are encrypted in your browser before upload. We store the ciphertext and technical metadata such as size, timestamps and the structure needed to sync (for example which conversation a message belongs to). Mail sent from or to outside Yahee is handled as ordinary email and can be read by the mail systems involved.
• Links: for Private Drop and share links we store the encrypted file and its expiry and download limits. The decryption key is in the part of the link after #, which browsers never send to us.
• Reports: when you report something we store your report, the public part of the link or username you point to, and the email you give (optional).
• Technical data: your IP address is used for rate limiting and abuse prevention and for the security logs of our hosting provider. Sessions use a cookie that is needed to keep you signed in.

What we do not do

• We do not sell your data, show ads or build advertising profiles.
• We cannot read end-to-end encrypted content, so we cannot hand it over in readable form.

Providers

Yahee runs on Cloudflare (hosting, database, object storage and email routing). Data is processed in the regions Cloudflare uses to serve the Service.

Retention and deletion

You can delete your files, messages and other content in the app. Deleted items are removed from storage (files can stay in Trash until you empty it or it expires). Private Drops are deleted after they expire. Reports may be kept as long as needed to handle abuse and legal obligations.

Legal requests

We may disclose data we hold where the law requires it. Because most content is encrypted with keys we do not have, what we can provide is limited to account and metadata information.

Your rights

Depending on where you live you may have rights to access, correct, export or delete your personal data, and to object to processing. Contact abuse@yahee.xyz and we will respond within a reasonable time.

Children

The Service is not intended for children under 13 and we do not knowingly collect their data. Tell us if you believe a child has created an account.

Changes

We will post updates to this policy here with a new date.