Privacy Policy

Last updated: May 15, 2026

Yorus ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and share information when you use our platform at yorus.co(the "Service").

1. Information We Collect

Information You Provide

  • Account information: email address, username, display name, and profile avatar when you register.
  • Age-gate information: during sign-up we ask for your date of birth to check whether you are at least 13. The current sign-up flow uses that date in the browser to decide whether to continue to account creation; it is not sent to Yorus as a stored date of birth.
  • User content: bot definitions (names, taglines, premises, definitions, opening messages, tags), uploaded cover and avatar images, profile information, and the text inputs you submit during play sessions.
  • Payment information: processed and stored by Stripe. We do not store your credit card number.

Information Collected Automatically

  • Usage data: pages visited, features used, session duration, and interaction patterns.
  • Device information: browser type, operating system, and screen resolution.
  • IP address: used for security and fraud prevention.

2. How We Use Your Information

  • To provide, operate, and improve the Service;
  • To verify your age and eligibility;
  • To process payments and manage subscriptions;
  • To moderate content and enforce our Terms of Service;
  • To send you account-related notifications;
  • To respond to your support requests and legal inquiries;
  • To detect and prevent fraud, abuse, and security threats.

3. AI-Processed Data

When you chat with interactive bots, your text inputs together with the relevant bot definition, persona context, and recent conversation context are sent to third-party AI service providers in order to generate the next narration and dialogue. User-submitted bots and uploaded images are also sent to third-party AI service providers for automated safety moderation prior to publication. If you enable BYOK, normal story replies may be sent to your selected provider without spending monthly reply credits, while supporting systems such as moderation, wall teasers, memory summaries, and voice may still use Yorus platform providers. These inputs are processed in real time and are subject to the AI providers' data handling policies. Yorus stores your play-session history (turns) on our servers so you can resume your chats. We may change AI service providers from time to time. For details on AI processing, see our AI Disclosure.

4. Information Sharing

We do not sell your personal information. We may share data with:

  • Service providers: our hosting and database provider (Supabase), our payment processor (Stripe), third-party AI service providers used for narrative generation and content moderation, our email provider (Resend), error monitoring provider (Sentry), infrastructure providers, and other processors necessary to operate the Service. We may change service providers from time to time and will update this Policy if material changes affect how your information is handled.
  • Legal compliance: when required by law, subpoena, or legal process.
  • Safety: to protect the rights, safety, or property of Yorus, our users, or the public.

5. Data Retention

We retain your account data for as long as your account is active. You can delete your account at any time from Settings → Security → Delete account. When you do:

  • Your profile is anonymized immediately. Your username, display name, bio, and avatar are removed and replaced with a generic placeholder.
  • Your play history (runs and turns), likes, reports you submitted, and notifications are deleted immediately from our live database.
  • Any active Stripe subscription is canceled. Stripe retains billing records on its own systems as required by financial regulations.
  • Bots you published are hidden from public browse and search, but remain in our database in a non-public state so that other players who already started a chat with your bot can finish it. Those bots will appear as authored by a generic deleted user.
  • Residual copies in encrypted database backups may persist for up to 30 days before they age out.

We may retain limited information beyond this period where we are required to do so by law (for example, tax and billing records) or where it is necessary to protect against fraud, abuse, or legal claims.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal information we hold about you;
  • Request correction of inaccurate information;
  • Request deletion of your personal information;
  • Object to or restrict certain processing;
  • Data portability - receive a copy of the personal information you have provided to us in a commonly used, machine-readable format.

You can update your profile information directly from your account settings. To exercise the other rights, contact us at legal@yorus.cowith the subject line "Data Request" and the email address associated with your account. We will verify your identity and respond within the timeframes required by applicable law. For many GDPR requests this is generally one month, and for many CCPA requests this is generally 45 calendar days, subject to permitted extensions and exceptions.

7. Children's Privacy (COPPA)

Yorus is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13, we will delete that information promptly. If you believe a child under 13 has provided us with personal information, please contact us at legal@yorus.co.

8. International Users (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the legal basis for processing your personal data is:

  • Contract performance: processing necessary to provide you the Service.
  • Legitimate interests: security, fraud prevention, and service improvement.
  • Consent: where you have given explicit consent for a specific optional purpose.

You may withdraw consent at any time. You also have the right to lodge a complaint with your local data protection authority.

9. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act ("CCPA") as amended by the California Privacy Rights Act ("CPRA") provides you with specific rights regarding your personal information. The categories of personal information we collect are described in Section 1 above.

You have the right to:

  • Know: request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the purposes for collection, and the categories of third parties with whom we share it.
  • Delete: request deletion of personal information we have collected from you, subject to certain legal exceptions.
  • Correct: request correction of inaccurate personal information we maintain about you.
  • Opt out of sale or sharing:opt out of the "sale" or "sharing" of your personal information for cross-context behavioral advertising. We do not sell or share your personal information for cross-context behavioral advertising, and we have not done so in the preceding 12 months.
  • Limit use of sensitive personal information: we do not use sensitive personal information for purposes beyond those permitted by the CPRA.
  • Non-discrimination: we will not discriminate against you for exercising any of these rights.

"Shine the Light" (Cal. Civ. Code § 1798.83): we do not share personal information with third parties for their own direct marketing purposes.

To exercise any of these rights, contact us at legal@yorus.co. We will verify your request and respond within the timeframes required by law. You may designate an authorized agent to make a request on your behalf, provided we can verify the agent's authority.

10. Security

We use industry-standard measures to protect your information, including encryption in transit (TLS) and at rest. However, no method of transmission or storage is 100% secure.

11. Cookies

Yorus uses essential cookies and similar local browser storage for authentication, session management, preferences, and in-product state. We use first-party product analytics events to understand basic product usage. We do not use third-party advertising trackers, and we do not sell or share personal information for cross-context behavioral advertising.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on the Service. Continued use after changes constitutes acceptance.

13. Contact

For privacy questions or data requests, contact us at legal@yorus.co.