Privacy Policy

Last updated: May 10, 2026

Yap AI ("Yap," "we," "us") is a voice-dictation tool built by Kleesto. This policy explains what we collect, why, and how to delete it. We aim for plain language — if any term below isn't clear, email tools@kleesto.com and we'll explain.

1. Who controls your data

Kleesto, contactable at tools@kleesto.com, is the data controller for Yap. If you're in the EU/UK, this constitutes our UK GDPR / GDPR notice.

2. What we collect

  • Audio recordings. When you tap the microphone, your voice is captured locally and sent to our server for transcription. Audio is processed in memory and is not retained after transcription unless you explicitly enable audio archiving (off by default).
  • Transcripts. The text we return is saved to your account history so you can search and re-use it across devices. You can delete any entry at any time from the History tab.
  • Account information. Name, username, and email associated with your Clerk account.
  • Device metadata. A device identifier we generate (UUID), device type ("mobile" / "desktop" / "web"), and a friendly name (e.g. "George's iPhone") so the Manage Devices screen makes sense.
  • App settings. Language, accuracy preference, sanitize/polish toggle, custom shortcut — synced so they're consistent across devices.
  • Diagnostic data. Crash reports and error traces (no transcript or audio content). Used only to fix bugs.

3. What we do not collect

  • We do not log keystrokes from the keyboard extension.
  • We do not sell, share, or monetize your data with advertisers.
  • We do not train AI models on your transcripts or audio. Our transcription provider (xAI) processes audio under their data-processing terms and does not retain it for training.
  • We do not access the contents of any text field you type into beyond what you dictate.

4. Why we collect it

  • To convert your voice to text (transcription).
  • To clean up grammar, punctuation, and brand-name spellings (polish).
  • To sync your transcripts and settings across devices.
  • To diagnose crashes and outages.

Legal basis (UK/EU users): performance of our contract with you to deliver the service, plus legitimate interest in detecting fraud and improving reliability.

5. Third parties we share data with

We use the following processors. Each one only sees the slice of data needed for its job:

  • Clerk (clerk.com) — authentication. Sees email, name, and OAuth identifiers.
  • xAI (x.ai) — speech-to-text. Sees the audio you dictate; does not retain it for training under our enterprise terms.
  • Anthropic (anthropic.com) — transcript polish. Sees the raw transcript text; does not retain it for training under their commercial terms.
  • Vercel (vercel.com) — hosting our API and webapp. Sees request metadata (timestamps, IPs).
  • Sentry (sentry.io / self-hosted) — crash reporting. Sees stack traces and error context, no transcript content.
  • Postgres host — stores account data, transcripts, settings.

We do not sell or rent your data. We only disclose it to a third party when one of the above processors needs it to deliver the service, when you explicitly direct us to, or when a binding legal request requires it.

6. How long we keep it

  • Transcripts: kept until you delete them (per-entry or via Sign Out + Delete Account). The most recent 5,000 entries per account are retained; older entries are pruned automatically.
  • Audio: not retained server-side. Locally cached audio (used for playback in History) lives on your device until you delete the entry.
  • Account data: kept until you delete the account.
  • Crash logs: 30 days.

7. Your rights

You can, at any time:

  • View all your transcripts in the History tab.
  • Delete individual transcripts (swipe / dropdown menu) or all of them (Clear button).
  • Export your transcripts — email tools@kleesto.com from the address on your account and we'll send a JSON dump within 30 days.
  • Delete your account — email tools@kleesto.com with "Delete my Yap account" from the email on the account. We will erase your data within 30 days.
  • Object, restrict, or correct. Contact us via email and we'll respond within 30 days.
  • File a complaint with your data-protection authority. UK: ICO. EU: your country's DPA.

8. Children

Yap is not directed to children under 13 (under 16 in the EEA). We do not knowingly collect data from children. If you believe a child has signed up, email us and we'll delete the account.

9. International transfers

We process data in the United States (Vercel, Anthropic, xAI) and the EU (where the Sentry instance is hosted). Where applicable, transfers rely on Standard Contractual Clauses or equivalent safeguards.

10. Security

All connections to our servers use TLS 1.2+. Account passwords are managed by Clerk and never seen by us. API keys you generate (yap_live_…) are stored as SHA-256 hashes — the plaintext is shown to you exactly once at creation. We can revoke any leaked key from the Settings → Devices screen.

11. Changes to this policy

We'll update the "Last updated" date at the top whenever this policy changes. For material changes (new third-party processors, new data categories), we'll also notify you in-app.

12. Contact

Questions, requests, or complaints: tools@kleesto.com.