Privacy Policy & Data Protection

Last updated: February 10, 2026

Version française

Yapademy is built with privacy at its core. The on-device AI runs entirely on your device, and we never see or store your chat conversations, quiz interactions, or anything processed locally. This policy explains what data we do collect and why.

Yapademy is operated by YapLabs (“we,” “us,” “our”), based in France. YapLabs is the data controller for the personal data described in this policy; the operator’s full identification and contact details are in the Legal Notice. We comply with the General Data Protection Regulation (GDPR) and applicable French data protection laws.

1. Data We Collect

1.1 Account Information

When you sign in through a supported provider (e.g., Google), we receive and store:

  • Email address (used as your account identifier)
  • Display name
  • Profile photo URL (if provided by the auth provider)

1.2 Subscription and Usage Data

We store data necessary to manage your account and enforce usage limits:

  • Subscription status and billing history
  • Number of tutorials generated (to track plan usage)
  • Tutorial metadata (title, topic, difficulty, creation date)

1.3 Learning Progress

To let you pick up where you left off across devices, we store:

  • Current step and completion status for each tutorial
  • Bookmark and progress indicators
  • Time spent on tutorials (aggregated)

This data syncs across your devices when you sign in. It does not include the content of your AI chats, quiz answers, or any locally generated data.

1.4 Tutorial Generation

When you request a new tutorial, we send your prompt to cloud-based AI models to generate the content. We store:

  • The generation prompt you submitted
  • The generated tutorial content (stored in Firebase Storage and cached on your device)

This is the only time user-provided content leaves your device for AI processing.

1.5 Analytics (Optional)

In the app, we may collect anonymized, aggregated usage statistics to improve the service:

  • Feature usage patterns (not individual content)
  • App performance metrics and crash reports

On our marketing website (yapademy.com), we use privacy-preserving, cookieless analytics to understand traffic and which content resonates:

  • Cloudflare Web Analytics and Google Analytics, both configured in cookieless mode (Consent Mode denied). No analytics or advertising cookies are set.
  • Aggregate interaction events (for example, which call-to-action was clicked, or scroll depth) and coarse device capability (for example, whether your browser can run on-device AI).
  • First-touch attribution (the referrer or campaign that brought you) is stored only in your browser’s sessionStorage and is cleared when you close the tab.

This data is aggregate and cannot be traced back to you. We do not use it for advertising.

2. Data We Do Not Collect

Thanks to on-device AI processing:

  • We do not see or store your AI chat conversations
  • We do not store quiz answers or quiz questions generated locally
  • We do not record any output from the local AI model
  • We do not use your data to train AI models

Note: We do store basic progress indicators (current step, completion status) to sync your learning across devices. This is limited to where you left off, not what you typed or how you answered.

3. How We Use Your Data

We use the data described in Section 1 to:

  • Provide and maintain the service (authentication, tutorial delivery, progress sync)
  • Process payments and manage subscriptions
  • Enforce usage limits per your plan
  • Sync your learning progress across devices
  • Improve the service based on aggregated, anonymous analytics
  • Communicate important service updates
  • Comply with legal obligations

We do not sell your personal data to third parties. We do not use your data for advertising.

4. Data Sharing

We share data only with the subprocessors necessary to operate the service. See our Subprocessors page for the full list. Data is shared solely for the purposes described (authentication, payments, hosting, tutorial generation).

If required by law or court order, we may disclose data to authorities.

5. Data Retention

  • Account data is retained as long as your account is active.
  • Tutorials are stored until you delete them or your account.
  • Upon account deletion, your personal data is removed within 30 days. Anonymized aggregate data may be retained.
  • Billing records may be retained longer as required by tax and accounting laws.

6. Your Rights (GDPR)

As a data subject under GDPR, you have the right to:

  • Access: Request a copy of the personal data we hold about you
  • Rectification: Correct any inaccurate data
  • Erasure: Request deletion of your personal data
  • Restriction: Request that we limit processing of your data
  • Portability: Receive your data in a structured, machine-readable format
  • Object: Object to processing of your data for specific purposes

To exercise any of these rights, contact us at privacy@yapademy.com. We will respond within 30 days.

7. Children’s Privacy

Yapademy is not intended for children under 15, the age of digital consent in France (art. 45 of the French Data Protection Act). We do not knowingly collect personal data from anyone under 15. If we learn that a child under 15 has created an account, we will delete it promptly. Parents or guardians can contact privacy@yapademy.com to request data deletion.

8. International Data Transfers

Your data may be processed in the EU and United States through our subprocessors (Firebase/Google Cloud, Cloudflare). Where data is transferred outside the EU, we rely on EU-approved safeguards such as Standard Contractual Clauses.

9. Security

We protect your data using:

  • TLS encryption for all data in transit
  • Encryption at rest for stored data
  • Access controls and authentication for all systems
  • Regular security reviews of our subprocessors

No system is 100% secure. If you discover a vulnerability, please report it to security@yapademy.com.

10. Cookies

The Yapademy web application uses only essential cookies required for authentication and session management. We do not use tracking or advertising cookies. Our marketing website (yapademy.com) sets no analytics or advertising cookies, website analytics run in a cookieless mode.

11. Changes to This Policy

We may update this policy. Material changes take effect 14 days after posting. We will notify you of significant changes through the service or by email.

12. Contact

For any privacy-related questions, contact us at privacy@yapademy.com.

Data Protection Officer: dpo@yapademy.com

You may also lodge a complaint with the French data protection authority (CNIL) at www.cnil.fr.