yyours

PRIVACY AT YOURS

Your information should help you—not surprise you.

This policy explains what Yours accesses, why it is needed, where it is processed, and the controls available to you.

Effective September 12, 2026Google sign-in onlyNo advertising use
The short version

Your photos begin private. Google sign-in supplies only basic account identity. Yours does not request access to Gmail, Google Calendar, or Google Photos. Yours does not sell personal information or use private user data to train a general-purpose AI model.

1. Information Yours handles

Account information
When you use Google sign-in, Yours receives your basic profile, name, email address, and account identifier. Yours uses this information to create and authenticate your account.
Community contributions
Feature requests, reviews, star ratings, and comments you deliberately publish are public with your profile name. Your email address and private Yours content are not included.
Photos and metadata
Photos you select from your device, automatically sync from an authorized iPhone library, or receive through an authorized connection, plus available capture time, location, file, and camera metadata. The web and iPhone Shareable pilot can send two to five stripped 512-pixel previews and bounded capture metadata to AWS-hosted open-weight models. Automatic iPhone sync is off until you explicitly enable it.
Face matching
With explicit consent, camera captures are processed on your device into five 128-number face references. The captures are not uploaded. The numeric template is stored in your private account. It is available only to accepted friends while both people enable Face automatch. Their phone or browser processes it locally. A device may cache up to 10 authorized templates for speed.
Public context
Photo-derived dates, coarse coordinates, visible venue or activity clues, and public event terms may be sent to Yours to retrieve weather, holiday, place, or public-event information. Yours does not send Google account content because it does not request access to that content.

2. How Google sign-in data is used

Google sign-in is used only to establish and authenticate your Yours account. Yours requests basic identity information only. It does not request or use Gmail messages, Google Calendar events, Google Photos media, Google Drive files, or contacts.

Authentication is managed through Supabase Auth. Yours does not use the Google sign-in token to call Google content APIs.

3. Google API data

Yours’ use and transfer of information received from Google follows the Google API Services User Data Policy, including its Limited Use requirements.

  • Google account identity is used only for sign-in and account management.
  • It is not sold or used for advertising, credit decisions, or surveillance.
  • It is not used to create, train, or improve a generalized AI or machine-learning model.

4. Models and automated drafts

Yours first runs local quality and duplicate checks. The bounded web and iPhone pilot then sends only two to five stripped 512-pixel previews, bounded same-photo metadata, and cited public facts to open-weight models hosted by Amazon Bedrock in one AWS Region. It does not send readable biometric templates, face embeddings, face identity state, contacts, private messages, or Google account content. Yours configures the AWS model account for zero inference-data retention. AWS may retain and review content flagged as apparent child sexual abuse material to determine whether it is CSAM and report it to the relevant authorities. This narrow safety exception also applies under zero-retention settings. Model invocation logging is disabled. Yours logs only aggregate token, latency, route, and cost counters. The model providers cannot access customer prompts or completions through Amazon Bedrock. Yours does not use private photos or drafts to train these models.

Every result is a private suggestion. It may be incomplete or incorrect. You can replace every selected photo and edit every word before saving. Saving and creating a sharing link are separate actions.

5. Storage, retention, and deletion

Account records, uploaded photos, owner-only photo capture metadata, access grants, numeric face templates, and public community contributions are retained while your account is active or as needed to provide the service. Authorized device caches keep no more than 10 face templates. The iPhone app may upload a photo asset's own GPS metadata, but it does not upload current-device location or build a location history.

You can pause automatic iPhone photo sync at any time without deleting photos already copied. You can delete Shareable drafts, individual photos and their capture metadata, your face template, and your own community posts and comments. Deleting a face template removes its cloud copy, revokes face-match access, and clears the current device cache. Relationship revocation removes that person from future authorized template reads. Use Settings → Delete account to permanently delete account data and uploaded media. You can also revoke Google sign-in access in your Google Account. Private sharing links expire after 30 days.

6. Sharing and service providers

Photos are visible only through permissions you authorize, such as an active mutual face match, a group grant, or a private link you create. Community posts, reviews, ratings, comments, and their profile names are intentionally public once you publish them. Yours uses Cloudflare for private photo storage and delivery, Supabase for account and authorization records, and Amazon Bedrock for the bounded open-weight Shareable pilot. Those providers process data to provide their contracted services and meet applicable safety and legal obligations. Yours does not sell personal information to advertisers or data brokers.

7. Security

Yours uses HTTPS, access controls, private object storage, short-lived media links, and permission checks designed to protect data. No service can guarantee absolute security. Please contact us promptly if you believe your account or data has been compromised.

8. Children, changes, and contact

Yours is not directed to children under 13. We may update this policy as the service changes. Material changes will be reflected by the effective date and, when appropriate, an in-product notice.

For privacy questions, access requests, deletion help, or Google sign-in concerns, email mmbarakat16@gmail.com.