Privacy Policy

Last updated: June 2026

This Privacy Policy explains what personal data Yoota ("we", "us") collects when you use yoota.io, why we collect it, who we share it with, and the rights you have over it.

1. Data we collect

Information you give us

Account data — email address, or phone number if you register with a phone, and a hashed password. We never store your password in readable form.
Profile data — display name and any optional details you add.
Uploads — the product images and reference material you submit for generation.
Prompts — the descriptions and settings you enter to direct a generation.
Support messages — anything you send us by email.

Information collected automatically

Usage data — generations performed, credits consumed, features used, timestamps.
Technical data — IP address, browser type, device type, and approximate region, used for security, abuse prevention and rate limiting.

Payment data

We do not collect or store your card details. Payments are processed by Lemon Squeezy, our Merchant of Record. We receive only a confirmation of purchase, the pack purchased, and an order reference.

2. Why we use your data

To create and operate your account (contractual necessity).
To generate the imagery you request (contractual necessity).
To apply credits, process purchases and keep billing records (contractual and legal necessity).
To prevent abuse, fraud and misuse, and to enforce our Terms (legitimate interest).
To provide customer support (contractual necessity).
To improve the service and diagnose faults (legitimate interest).
To send service and transactional emails, such as password resets and purchase confirmations (contractual necessity).

We do not sell your personal data, and we do not use your uploaded images to train our own AI models.

3. Who we share data with

We share the minimum necessary with the following processors:

Google Firebase (Google LLC) — authentication, database and file storage hosting.
Google Gemini API (Google LLC) — image and video generation. Your prompt and uploaded image are transmitted to this API to produce your result.
Anthropic — used in certain studio tools to construct and refine generation prompts.
Lemon Squeezy — payment processing and Merchant of Record. They receive the billing information you enter at checkout.

We may also disclose data where required by law, to enforce our Terms, or to protect the rights and safety of users.

4. International transfers

Our providers operate globally, so your data may be processed in the United States and other countries. Where data is transferred out of the EEA or UK, our providers rely on Standard Contractual Clauses or an equivalent approved safeguard.

5. How long we keep data

Account data — for as long as your account is active.
Generated images and uploads — until you delete them or delete your account.
Purchase records — retained as required for tax and accounting purposes, typically seven years.
Security and abuse logs — up to 12 months.

When you delete your account, we delete or irreversibly anonymise your personal data, except records we are legally required to retain.

6. Your rights

Depending on where you live, you may have the right to:

Access the personal data we hold about you.
Correct data that is inaccurate or incomplete.
Delete your data ("right to be forgotten").
Export your data in a portable format.
Object to or restrict certain processing.
Withdraw consent where processing is based on consent.

You can delete your account directly in the app. For any other request, email support@yoota.io and we will respond within 30 days.

If you are in California, you have the right to know what personal information is collected and to request its deletion, and the right not to be discriminated against for exercising those rights. We do not sell personal information as defined by the CCPA.

7. Cookies and local storage

Yoota uses only what is necessary to run the service: a session token to keep you signed in, and browser local storage to remember your interface preferences such as your selected theme. We do not use advertising or cross-site tracking cookies.

8. Security

Data is transmitted over HTTPS and stored on Google Firebase infrastructure with access controls and security rules restricting access to your own records. Generated images are stored behind unguessable tokenised URLs and are not publicly listed unless you choose to publish them. No system is perfectly secure, but we take reasonable measures appropriate to the risk.

9. Children

Yoota is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

10. Changes

We may update this policy. Material changes will be marked by a new "Last updated" date, and where appropriate we will notify you by email or in-app.

11. Contact

Privacy questions or requests: support@yoota.io · Contact page