Privacy policy

One person builds and runs yapyap: Sander Boer (Xiduzo), based in the Netherlands. I am the data controller for this website. If anything below is unclear, write to me at [email protected] and a human (me) will answer.

This policy covers the yapyap website at yap-yap.app and the yapyap app. They are deliberately different: the website knows a little, and I designed the app to keep me knowing nothing.

I run Umami, an open-source analytics tool, on my own server. It sets no cookies, and it does not follow you to other sites. This is everything it records.

For each page you open:

• The page and its title.
• The site that sent you here, if your browser says.
• Your browser, operating system, device type, screen size, and language.
• A country, region, and city. Umami works these out from your IP address and does not store the address.
• A source tag, if the link you followed had one (utm_source or ref). The site removes every other parameter from the address before it sends the address to Umami.

Four things you can do here:

• You click a download button. I see the operating system, the file type, and whether the button was at the top or the end of the page.
• You click an App Store or Google Play link. I see which store, and where on the page the link was.
• You leave a page or click a link. I see how far down the page you got, to the nearest ten percent, and where the link goes. This tells me whether a page gets read and what people pick next.
• You open a question in the FAQ. I see which question. This tells me what the site did not explain.

To count a visitor once, Umami makes a code from your IP address, your browser, and a secret that changes every month. It stores the code and not the IP address. The next month you get a new code, so I cannot connect one month of visits to the next.

I use these numbers to see which pages people find, which pages they finish, and which pages lead to a download. They decide what I write next and what I fix. They do not tell me who you are. If you block the script, nothing is recorded and the site works the same.

The legal basis is my legitimate interest in seeing whether the site reaches anyone. The measurement needs no consent because it identifies no one.

yapyap runs on your own computer or phone. The app processes and stores recordings, transcripts, summaries, and any notes on your device. The app does not upload them to me, and I have no way to read them. There is no account to sign into and nothing syncing to a cloud you do not control.

If I ever stop maintaining yapyap, your copy keeps working with your data right where it is. That is not a privacy footnote. It is the entire reason the app exists.

On first run the app asks if it may send usage counts. Until you answer, it sends nothing. You can change the answer in settings at any time. There are three answers:

• On. Which features get used, how long a step took, and whether it failed. The app sends these with a random id it made for the install, the app version, and a rough picture of the machine: operating system, language, processor cores, a memory band, and the kind of graphics hardware. Your licence activation uses the same id.
• Version only. Which version runs, and which version an update came from. No id and no machine details.
• Off. Nothing leaves the machine.

No answer sends your audio, transcripts, file names, speaker names, or anything you typed. The counts go to the same Umami server as the website numbers.

yapyap works fully offline out of the box. If you decide to connect a third-party AI provider (your own cloud transcription or language model), the audio or text you send goes directly from your device to the provider you chose. It travels under their terms, with your key. That traffic does not pass through me. It is opt-in, it is yours to disable, and the local default never sends anything anywhere.

As few hands as I could manage. The website relies on these processors, each doing one narrow job:

• Resend delivers any email I send you, such as your licence key or an occasional product update.
• Cloudflare serves and protects the site. It processes your IP address to route traffic and block abuse.
• Umami (self-hosted) is the cookieless analytics above.

I do not sell, rent, or trade your data, and I never will. I would give your data to someone else only if the law genuinely compelled me to, and there is vanishingly little to give.

The site sets no tracking or advertising cookies. There is no consent banner because there is nothing to consent to.

Analytics rows hold no name, no email, and no IP address. I keep them only as long as they are useful. If you email me, I keep the thread until it is answered and stale, then it goes.

Because I am in the EU, the GDPR applies, and it gives you real leverage. You can ask to see what I hold, correct it, delete it, export it, or object to my using it. In practice I hold almost nothing about you. Say the word and what little there is goes.

Email [email protected] for any of the above. If you think I mishandled your data, you can also complain to your local data protection authority (in the Netherlands, the Autoriteit Persoonsgegevens).

yapyap and this site are not for children under 16, and I do not knowingly collect their data.

If this policy changes, I will update the date at the top. For anything material, I will say so on the corrections page rather than quietly edit this one.