YOY AI Limited ("YOY AI," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use YOY AI and its associated desktop application, mobile companion, update service, and related services (collectively, "YOY" or the "Service").
"You Own Your AI" is not just our name — it's our operating principle. We design YOY to keep your data on your device wherever technically possible. We transmit data to third-party AI providers only as required to deliver the features you use.
Please read this Privacy Policy carefully. By using YOY, you consent to the practices described here.
Data User (under PDPO) / Data Controller:
YOY AI Limited
Rm 819, 8/F Peninsula Centre
67 Mody Road, Tsim Sha Tsui East
Kowloon, Hong Kong SAR, China
Email: [email protected]
For Hong Kong privacy complaints, you may contact the Office of the Privacy Commissioner for Personal Data (PCPD) at pcpd.org.hk.
For EU/EEA residents, our representative contact for GDPR purposes is: [email protected].
For UK residents, our representative contact for UK GDPR purposes is: [email protected].
This Privacy Policy applies to:
This Policy does not apply to third-party AI providers you connect to via YOY (such as OpenAI, Anthropic, or Google). Those providers have their own privacy policies that govern how they process data sent to them through YOY.
When you create a YOY account, we collect:
When you use YOY, we may collect:
What we do NOT log: The content of your AI conversations. Your conversations are processed locally or transmitted to your selected AI provider. We do not store your conversation history on our servers unless you explicitly enable cloud sync (if/when available).
When YOY App Control is enabled, YOY maintains a local-only log of:
This log is stored locally on your device only. YOY AI does not have access to these logs unless you explicitly share them with us for troubleshooting purposes. You can clear App Control logs at any time in YOY settings.
When shell execution features are used, YOY maintains a local-only log of:
This log is stored locally on your device only. You can clear these logs in YOY settings.
When YOY checks for and installs updates, the following anonymous data is transmitted to our update servers:
We do not transmit: your name, email address, IP address (beyond what is inherently in a network request), conversation data, file names, or any other personal information as part of update checks.
When you use YOY's screenshot or vision features:
You are responsible for the content visible on your screen at the time of capture. If your screen contains sensitive personal data about others, do not use the screenshot feature without appropriate authorisation.
YOY maintains a local-only log of network requests made on your behalf (web searches, web browsing actions) for:
Network logs are stored locally, are not transmitted to YOY AI's servers, and can be cleared in YOY settings.
For error reporting, security, and performance optimisation, we may collect:
If you contact us for support, we collect:
When paid tiers are introduced, payment processing will be handled by a PCI-DSS-compliant third-party payment processor. We will not store full card numbers or sensitive payment credentials on our systems.
We use the data we collect for the following purposes:
| Purpose | Legal Basis (GDPR) | Legal Basis (HK/PDPO) |
|---|---|---|
| Providing and operating the Service | Contract performance | Necessary for service delivery |
| Account management and authentication | Contract performance | Necessary for service delivery |
| Processing AI queries via third-party providers | Contract performance + consent | Consent / primary purpose |
| Delivering automatic updates | Legitimate interests (security) | Necessary for security/service |
| Debugging, error analysis, and improvement | Legitimate interests | Legitimate business purpose |
| Security monitoring and fraud prevention | Legitimate interests | Legitimate business purpose |
| Communications (service notices, updates) | Contract performance | Primary purpose |
| Compliance with legal obligations | Legal obligation | Legal obligation |
| Analytics (aggregated, anonymised usage) | Legitimate interests | Legitimate business purpose |
We do not use your data to:
YOY is designed from first principles around local data ownership:
Data is transmitted off your device only when:
1. You initiate an AI query (sent to your selected AI provider)
2. You enable a feature that requires network access (web search, web browsing)
3. YOY checks for and downloads updates (anonymous version/OS/device ID only)
4. You use vision features (screenshot sent to your selected AI provider)
5. You contact support (information you choose to share)
When you use YOY to interact with a cloud AI provider, the following is transmitted to that provider:
YOY may connect to the following third-party AI providers (configuration-dependent):
| Provider | Privacy Policy | Data Processing Location |
|---|---|---|
| OpenAI | openai.com/policies/privacy-policy | United States |
| Anthropic | anthropic.com/privacy | United States |
| Google (Gemini) | policies.google.com/privacy | Global / US |
| Ollama (local models) | Local only — no data transmitted | Your device |
| [Additional providers as added] | [Provider-specific URLs] | Provider-dependent |
YOY AI is not responsible for the data handling practices of third-party AI providers. Their use of your data is governed by their own privacy policies. We strongly recommend reviewing those policies before selecting a provider.
| Data Type | Retention Period | Location |
|---|---|---|
| Account data | Until account deletion + 30 days | YOY servers |
| Conversation history | Local only — your control | Your device |
| App Control logs | Local only — your control | Your device |
| Shell execution logs | Local only — your control | Your device |
| Network request logs | Local only — your control | Your device |
| Update telemetry (anonymous) | 90 days for update analytics | YOY update servers |
| Error logs / crash reports | 30 days | YOY servers |
| Support communications | 3 years after resolution | YOY servers |
| Payment records (when applicable) | 7 years (Inland Revenue Ordinance, Cap. 112, Hong Kong) | Payment processor |
You may request deletion of your personal data at any time (see Section 9). We will delete or anonymise data as requested, except where we are required to retain it by law or for legitimate legal defence purposes.
The YOY desktop application does not use cookies. Our website (yoyai.io) may use:
We do not use tracking pixels, behavioural advertising cookies, or cross-site tracking on our website.
Under the Personal Data (Privacy) Ordinance (Cap. 486, Laws of Hong Kong) and the six Data Protection Principles (DPPs):
Under the General Data Protection Regulation (EU) 2016/679, you have the right to:
GDPR Lawful Bases: We process EU user data under: (a) contract performance; (b) legitimate interests; (c) legal obligation; and (d) consent (where indicated).
Data Protection Officer: [email protected]
UK users have equivalent rights under the UK GDPR (retained EU law, as amended by the Data Protection Act 2018). Contact [email protected] to exercise your rights.
California residents have additional rights under the California Consumer Privacy Act (as amended by the CPRA):
To exercise CCPA rights, contact [email protected]. We will respond within 45 days.
Email: [email protected]
Subject line: "Privacy Rights Request — [Your Right, e.g., Access / Deletion]"
Include: your registered email address and a description of your request
We will respond within 40 days (HK PDPO), 30 days (UK GDPR), or 45 days (CCPA). We may need to verify your identity before processing.
YOY is not directed at or intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent. If we become aware that a user under 13 has provided personal information without parental consent, we will promptly delete that account and its associated data.
If you are a parent or guardian and believe your child under 13 has used YOY without consent, please contact us immediately at [email protected].
We take reasonable and appropriate technical and organisational measures to protect your personal information, including:
No security measure is impenetrable. We cannot guarantee absolute security. You are responsible for maintaining the security of your device and account credentials.
YOY AI is based in Hong Kong SAR. When you use cloud AI providers (OpenAI, Anthropic, Google), your data is transferred to and processed in the United States and potentially other countries. These countries may have different data protection laws than your country of residence.
For Hong Kong users: Section 33 of the PDPO (cross-border data transfer restrictions) is not yet in force as at the date of these Terms. We nonetheless take reasonable steps to ensure that any overseas recipients of your personal data provide a standard of protection substantially similar to the PDPO Data Protection Principles.
For EU/EEA and UK users: Transfers to the US are made under Standard Contractual Clauses (SCCs) approved by the European Commission (or the International Data Transfer Agreement/IDTA for UK transfers), or under the EU-US Data Privacy Framework where applicable. Contact us at [email protected] for copies of applicable transfer mechanisms.
For all users: We only transfer personal data to third-party AI providers as necessary to provide the features you actively use. You can minimise data transfers by using local AI models (where available) which process queries entirely on your device.
YOY may include links to third-party websites, or perform web searches that return third-party content. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party services you access through or in connection with YOY.
We may update this Privacy Policy from time to time. When we do:
If you do not agree with material changes, you may delete your account and stop using YOY.
YOY's memory files (context files that store information about your preferences, projects, and ongoing tasks) are stored locally on your device. Memory content may be included in queries sent to your selected AI provider (as context). You have full control to read, edit, and delete memory files directly.
When microphone/voice features are enabled, YOY captures audio input via your device microphone for speech-to-text processing. Audio is processed transiently in memory — YOY AI does not store raw audio recordings on our servers. Audio may be transmitted to your selected AI provider for transcription and is governed by that provider's privacy policy. You are solely responsible for ensuring any third parties audible in recordings have consented. See T&C §10.7 for full terms.
When YOY performs browser automation on your behalf, the content of web pages visited and form data entered may be included in AI query context and transmitted to your selected AI provider. YOY AI does not independently store the content of web pages accessed during browser automation sessions beyond the local session context. You are responsible for ensuring automated browser interactions comply with third-party site terms. See T&C §10.6.1 for full terms.
The YOY phone companion pairs your mobile device with YOY. Data exchanged via the companion (notifications, camera images, location data) is processed locally on your devices. Location data is used only for contextual queries you explicitly initiate and is not stored on our servers.
Scheduled task configurations are stored locally. Actions executed by scheduled tasks may involve transmitting data to AI providers (in the same way as manual queries). The results of scheduled tasks are stored locally in YOY's memory system.
For any privacy-related questions, concerns, or requests:
Email: [email protected]
Subject line guidance:
Postal: YOY AI Limited, Rm 819, 8/F Peninsula Centre, 67 Mody Road, TST East, Kowloon, Hong Kong SAR, China
For unresolved complaints:
YOY AI Limited | Privacy Policy v1.2 | Effective 8 April 2026 | [email protected]
Registered in Hong Kong SAR | "You Own Your AI."
© 2026 YOY AI Limited. All rights reserved.