Privacy Policy

• No ads. No tracking. No selling your data. No AI training on your content.
• We collect what we need to run the services and bill you, nothing else.
• You can export your account data and delete your account at any time from account settings.

Account information. Your yeil address, your display name, your public identity keys, and the encrypted key blobs that only your recovery phrase can open. yeil accounts are passwordless: we do not store a password, and your recovery phrase is the only credential. We also store passkey credentials you register, a TOTP secret if you set one up, and a recovery email address if you have given us one. Active sessions are tracked by an opaque token; you can see and revoke them from your account's Security page.

Your content. The actual stuff you put into yeil:

• mail. Messages you send, receive, draft, and store, plus attachments, filters, signatures, and vacation responder text.
• dns. Zones you own and the records on them.
• pass. Your vault items, sealed on your devices. We hold the ciphertext and cannot read any of it.
• analytics.The sites you register, and the traffic they report. Event contents are sealed in your visitor's browser and decrypted in yours; we hold sealed blobs and opaque counters. If you run analytics on a site, you are the one deciding what your visitors' data is used for, and the terms for that are in the Data Processing Addendum, section 9.
• team. team name, domain ownership, member list, group/role assignments, billing arrangement.

Billing information. For paid plans we store a Stripe customer ID and subscription metadata (plan, status, period end). We don't see or store your card details; Stripe does.

Operational logs. We run standard service logs for the apps and infrastructure that help us operate yeil, debug issues, and investigate abuse. We avoid retaining anything we don't need.

We use what we collect to:

• deliver the services to you (the obvious one)
• authenticate you and protect your account
• charge you for paid plans
• investigate abuse and respond to security issues
• communicate with you about the services (transactional email)
• comply with the law

We do not use your content for advertising, sell it, share it with data brokers, or use it to train AI models, ours or anyone else's.

yeil's applications, its databases and its object storage run on hardware we own in our own datacenter. The public-facing edges do not: those are virtual machines we operate on rented infrastructure, which means the host provider has infrastructure-level access to what runs on them. We would rather state that plainly than imply it away.

• Stripe for payments. Stores your card and billing address; we never receive those.
• Linode hosts the web edge, which terminates TLS for every yeil app before passing the request on, and the public SMTP edge, which holds inbound and outbound mail in plaintext long enough to filter, sign and relay it. One of our two authoritative nameservers also runs there.
• AWS hosts the second authoritative nameserver. Each nameserver keeps a local replica of every dns zone we serve and the key used to sign its answers.
• Apple (APNs) delivers notifications to the yeil iOS app. A notification carries an opaque device token, your unread count, and the sender and subject of the message it is about. The preview text is encrypted and Apple cannot read it.
• Vultr hosts the public status page, which holds no personal data.

The full list with details is on our subprocessors page. When we add or change one we update that page; for material changes we'll also surface a notice next time you sign in.

We retain different categories of data for different lengths of time:

• Account data (your address, profile, security settings, recovery info): while your account is active. On account deletion, removed within 30 days, with backups aging out within an additional 60 days. One exception survives that: our audit log keeps a record of the deletion itself, and of administrative actions taken on the account before it, including the address that was deleted and the address the request came from. We keep those to be able to answer what happened to an account.
• mail content: while your account is active. Messages you move to Trash are automatically purged after 30 days. On account deletion, removed within 30 days, with backups aging out within an additional 60 days.
• DNS records: while you own the zone. Deleted zones are removed immediately; the dns-server cache may serve the old records for up to the configured TTL.
• Billing records (invoices, payment history): retained for the period applicable US tax law requires (currently 7 years).
• Operational logs (delivery, request, authentication): around 30 days, except where a specific investigation requires holding them longer.
• Abuse signals (records associated with TOS or AUP violations): retained as long as needed to enforce against repeat offenders or comply with the law.

Some of this you can do yourself; some needs us:

• View and edit profile, recovery email, passkeys, and two-factor settings from your account settings at account.yeil.app. mail filters, signature, and vacation reply live in mail settings.
• Export your account data (addresses, profile, org memberships, security settings, sessions, account activity) as JSON from account.yeil.app/security/data. Message bodies are encrypted and decrypted only on your devices; a self-serve mail export is something we're building.
• See your account data under account.yeil.app/security/data, with a JSON download for portability. It carries your account details, addresses, team memberships, passkeys, billing records, signed-in sessions and a log of actions taken from your account. It does not carry your mail, dns zones, pass vaults or analytics sites: those live in their own apps, mostly as ciphertext only your devices can open, and each app is where you read and delete them.
• Account deletion is self-serve at account.yeil.app/security/delete-account. Cancels subscriptions, deletes personal data, and signs you out. If you'd rather we do it, email legal@yeil.org.

We aim to respond to verifiable requests within 30 days. If we need more time, we'll let you know.

If you're in the EU or UK, GDPR gives you rights of access, rectification, erasure, restriction, portability, and objection, plus the right to lodge a complaint with your local data protection authority. If you're a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, or another US state with a comprehensive privacy law, you have similar rights under that law: broadly, you can ask us to show you what we hold, correct it, delete it, or stop processing it for certain purposes. We don't sell personal information.

Sign-in uses a 24-word recovery phrase, not a password. Sessions ride in httpOnly, same-site cookies. The phrase is generated on your device by your browser's cryptographic random source and never leaves it; what we hold is the public keys derived from it, plus key material sealed to those public keys that only your phrase can open. We cannot reconstruct the phrase, and if you lose it we cannot recover your account. The secrets we do still hash server-side, such as two-factor recovery codes and API tokens, are hashed with scrypt.

Transport is TLS everywhere it's available, including inbound and outbound SMTP. Your message bodies, previews, and attachments are encrypted at rest with a per-message authenticated-encryption key, sealed to your mailbox's public key. That mailbox key is wrapped under a master key, and that master key is sealed to an X25519 key derived from your recovery phrase. There is no password and no password reset: you sign in by entering the phrase, or by approving the new device from a device you are already signed in on. Decryption happens on your own devices: your browser and the yeil app derive your keys locally when you sign in and unseal messages there, so we cannot read the mail delivered to you, the copy saved to your Sent folder, or your drafts. Mail you send is different, and we would rather say so than imply otherwise: the message passes through our servers in plaintext so we can assemble it, DKIM-sign it, and relay it, and it then waits in our outbound queue encrypted under a key we hold until it is delivered. A scheduled send is held the same way until its send time.

Message headers (sender, recipient, subject, and dates) are stored in plaintext so we can sort, thread, and search your mail; keep sensitive information out of subject lines. When mail arrives, we process it briefly in plaintext at our edge to run spam and filtering checks before it is encrypted to your mailbox. We don't yet encrypt message headers, and encrypting them (so even metadata is sealed) is on our roadmap.

Breach notification. If we discover a security incident that affects your personal data, we'll notify you (and any required authority) without undue delay. Where applicable law sets a specific deadline (GDPR Article 33, for example, sets 72 hours), we'll meet it. The notice will include what we know about what happened, what data is involved, what we're doing about it, and what you can do to protect yourself.

No system is perfectly secure. If you discover a vulnerability, please email security@yeil.org.

We use a small number of cookies for sign-in: a session token that keeps you signed in, and a short-lived cookie that carries state during the two-factor authentication step. Both are httpOnly, same-site, and expire when their purpose is over. We don't use analytics cookies, advertising pixels, or third-party trackers anywhere in the apps. In mail, we strip external tracking pixels from incoming messages by default.

You must be at least 18 to use yeil. We don't knowingly collect data from anyone younger. If you believe a minor has signed up, let us know and we'll delete the account.

We'll update this page when we change practices. The “last updated” date at the top tells you when it last changed. For material changes we'll surface a notice the next time you sign in.

Questions, requests, or complaints? legal@yeil.org.

yeil
2 Main St #1402
Sparta, NJ, USA