Privacy Policy

Last Updated: January 29, 2026

Introduction

Yaru (hereinafter referred to as "the Software", "we", or "us") is developed and operated by the Yaru Development Team. We respect and protect the privacy of all users who use Yaru services (including the application, website, and related services).

This Privacy Policy explains in detail how we collect, use, disclose, transfer, and store your information when you use Yaru. Please read this policy carefully before using the Software. By using Yaru, you agree to the data processing practices described in this policy.

1. Information We Collect

To provide you with core learning management and synchronization services, we need to collect specific categories of information.

1.1 Information You Actively Provide

  • Account Registration Information:
    • Mandatory: When you register an account, we collect your username and an encrypted password.
    • Optional: If you choose to register via email, we will collect your email address. You may also choose to provide a bio, upload an avatar, or modify your nickname.
  • Authentication Data: If you log in using third-party services (Google, GitHub), we will collect the unique user identifier (OpenID), avatar, and nickname authorized by that service. We do not collect or store passwords associated with your third-party accounts.
  • User Content: Data you create, upload, or sync within Yaru, including but not limited to: notes and documents; Spaced Repetition System (SRS) cards and review history; GTD task lists and completion status; Custom tags and knowledge graph structures.
  • Payment Information: When you purchase a subscription or make a donation, the transaction is processed through third-party payment gateways (e.g., Aifadian, Stripe). We do not collect or store your credit card numbers or complete payment account information; we only retain transaction status and order IDs to activate your service.

1.2 Automatically Collected Technical Information

Even if you use the Software in "Guest Mode," to ensure service stability and security, we or our service providers may collect:

  • Device and Network Information: When connecting via the Cloudflare edge network, server logs may automatically record your IP address, browser/client type, approximate geographic location (country/city level, non-precise coordinates), and access timestamps.
  • Usage Data: We use Google Analytics to collect anonymous statistical data, such as feature usage frequency, session duration, and application crash logs. This data is not directly linked to your personal identity.

2. Data Storage Architecture & Ownership

Yaru adopts a "Local-First" architecture to maximize your data sovereignty.

2.1 Storage Mode Options

  • Local Mode (Default): Data is stored solely in the local database on your device. We have no access to this data.
  • Yaru Cloud Sync (Official): If you enable this service, data is encrypted during transmission and stored in our databases via Cloudflare D1/KV.
  • BYOS (Bring Your Own Storage): If you configure an S3-compatible storage bucket (e.g., AWS S3, MinIO) or WebDAV, Yaru acts solely as a client communicating directly with your storage endpoint. We cannot access, decrypt, or control any data stored in your private cloud.

2.2 Data Retention

We retain your personal information as long as your account remains active.

If you request account deletion, we will permanently delete your data from production servers via an automated process within 30 days, and it will be completely cleared after subsequent backup cycles are overwritten.

3. Data Processing & Use

We process your data based on the following legal grounds:

  • Performance of Contract: To provide synchronization services, cross-device restoration, and customer support.
  • Legitimate Interests: To analyze crash logs for bug fixing and to optimize product features using anonymous data.
  • User Consent: For interactions involving AI-assisted features.

Special Note on AI Features

Yaru integrates Generative AI capabilities (e.g., OpenAI, Gemini, DeepSeek).

  • On-Demand Transmission: Only when you actively trigger an AI feature (e.g., "Summarize this note," "Generate quiz"), is the context of the currently selected text sent to the AI service provider.
  • No Training Usage: We access these services via API. According to current API policies, third-party providers generally do not use data submitted via API to train their foundation models, though this is subject to the specific privacy policies of each provider.
  • Data Isolation: We do not package or send your entire knowledge base to AI service providers.

4. Information Sharing & Disclosure

We promise not to sell your personal information to any third parties. We share information only in the following circumstances:

  • Service Providers: Third parties we must partner with to provide services, including:
    • Infrastructure: Cloudflare (CDN, Edge Computing, Database).
    • AI Models: OpenAI, Google, DeepSeek (Inference requests only).
    • Analytics: Google Analytics (Anonymous data only).
    • Payment Gateways: Aifadian, Stripe, etc.
  • Legal Compliance: Where required by law, subpoena, or other legal processes, or to protect the rights, property, or safety of Yaru, its users, or the public.

5. Your Rights (Global Compliance)

Regardless of your location, Yaru grants you the following rights:

5.1 General Rights

  • Right to Access: You may view your profile and cloud data at any time.
  • Right to Export (Data Portability): You may export your notes and learning data in universal formats (e.g., Markdown, JSON).
  • Right to Correction & Deletion: You may correct inaccurate information or request account cancellation and deletion of all cloud data via settings.

5.2 For Users in the European Economic Area (EEA) - GDPR

If you are located in the EEA, you have the right to lodge a complaint with a local data protection authority. Our data processing is primarily based on "Performance of Contract" and "User Consent."

5.3 For California Residents - CCPA/CPRA

Yaru does not "sell" your personal information. You have the right to request that we disclose the categories of personal information collected in the past 12 months.

5.4 For Users in Mainland China - PIPL

In accordance with the Personal Information Protection Law (PIPL), your data may be transferred cross-border to our servers located outside of Mainland China (based on the Cloudflare global network). Use of this service constitutes your consent to such cross-border transfer to facilitate synchronization features.

6. Data Security

We implement industry-standard security measures to prevent unauthorized access, disclosure, or modification:

  • Transmission Encryption: All data transmission is encrypted via TLS/SSL protocols.
  • Access Control: Only authorized personnel can access server backends, and they are subject to strict confidentiality obligations.
  • Hashing: User passwords are stored using salted hash algorithms; even we cannot revert them to your original password.

Despite these measures, please note that no method of transmission over the Internet is 100% secure.

7. Protection of Minors

Yaru's services are primarily intended for high school/university students and lifelong learners.

We do not knowingly provide services to children under the age of 13 (or the equivalent minimum age in your jurisdiction). If we discover that we have inadvertently collected personal information from a minor, we will take steps to delete such information as soon as possible.

8. Changes to This Policy

  • Material Changes: If there are significant changes to how we process data, we will notify you in advance via in-app notifications or email (if provided).
  • Continued Use: Continued use of Yaru after the update becomes effective constitutes your acceptance of the revised policy.

9. Contact Us

If you have any questions or suggestions regarding this Privacy Policy, please contact the developer via: