Yearnmore

Privacy Policy

Last updated: October 15, 2026

This policy describes how AURELLO CODE SOFTWARE GROUP LTD handles personal information for Yearnmore. We are the data controller at Griva Digeni 78, 2nd floor, Flat/Office V1, Neapoli, 3101 Limassol, Cyprus. Contact our privacy team at contact@aurello.app.

1. Information we collect

Account information: email address, display name, authentication identifier, and account status. A guest authentication identifier is created automatically so you can chat without registration. Email and password account saving is available. Google and Apple account linking are currently unavailable and marked “Soon”; if enabled later, they will provide basic profile information. Firebase manages email and password authentication; our application does not store your plaintext password. We do not ask for a date of birth.

Content: conversation messages, characters and their settings, portraits, shared photos and videos and their scene descriptions, rolling conversation summaries, remembered facts, reports you submit, and relevant moderation records. Private content is not included in the public catalogue. Public characters become visible after review.

Usage and technical information: free message allowances, credit ledger, test orders, device and browser information, network information such as IP address, and limited event information about visits, registration, and completed TEST credit orders. Do not include sensitive information in chats that you do not want processed to provide the service.

Support information: the contact details and information you choose to send us.

2. How we use information

We use account and content data to deliver conversations, portraits, photos, and videos, remember context, let you manage memories, secure accounts, enforce limits, and process reports. We use technical and event data to operate the website, understand service usage, and measure advertising. We use support information to respond to requests and retain information when required for legal obligations or establishing and defending legal claims.

Where the GDPR applies, service delivery relies on performance of a contract; security, troubleshooting, and abuse prevention may rely on legitimate interests; legal records rely on legal obligations. The appropriate basis for advertising and analytics depends on applicable law. Contact us for information or to exercise your rights. We do not treat use of this website as blanket consent to every form of processing.

3. Providers and disclosures

We use the following providers as needed for the service:

  • Google Firebase / Google Cloud: authentication, database hosting, account data, chats, characters, portraits, photos and videos, memories, and security infrastructure.
  • Replicate: model hosting and processing of conversation context, portrait prompts, and unlocked media descriptions and reference portraits to produce replies, images, and short videos. Context can include recent messages, summaries, remembered facts, and character information.
  • Vercel: hosting, website delivery, server functions, and operational logs.
  • PostHog: limited product analytics when configured. Automatic content capture and session recording are disabled. We do not send message text or character names in analytics events.
  • Meta Pixel: visit, registration, and TEST order measurement when configured. Meta can receive technical information and browser identifiers. We do not send chat content or character names in our event properties. Current checkout adds TEST credits only, takes no money, collects no card details and does not contact a payment processor. TEST completion events report $0 actual revenue in USD. Message text, memory text, intimate disclosures and inferred vulnerability are never used to target prices or payment offers.

We may disclose information where necessary to comply with law, respond to lawful requests, investigate abuse, protect safety, or establish or defend legal claims. A business transfer may include service data, subject to applicable safeguards and notice requirements. We do not claim that every provider has identical retention or data use terms.

4. Cookies and tracking

Authentication uses Firebase browser storage to maintain your session. Your instant-reply and discovery-interest preferences are stored locally. Unsent conversation drafts and reading positions are stored in your browser session so checkout can return to them without sending. PostHog may use identifiers and browser storage for event analytics. Meta Pixel may use cookies such as _fbp and _fbc and technical information for advertising measurement.

When their environment configuration is enabled, PostHog (including masked session replay), Mixpanel and Meta Pixel load on the website automatically. Yearnmore does not display a cookie banner or gate these scripts behind a consent prompt. Your browser can block or clear cookies and storage; blocking authentication storage may sign you out or prevent sign-in. We currently do not implement an in-product tracking opt-out. For privacy rights, objections, and opt-out requests, contact us at contact@aurello.app.

5. Retention, memories, and deletion

Messages, summaries, and account data remain stored while your account is active, subject to deletion requests, security requirements, and legal retention obligations. We do not promise a fixed retention period for provider logs or legally required records. Test order and credit records support credit reconciliation and abuse prevention.

Our story lets you keep, edit or forget a remembered detail, with its source message and date when available. Suggestions require your confirmation and do not automatically save sensitive details. Editing suppresses the old detail before replacing it. Deleted facts are excluded from memory retrieval, the stored rolling summary is cleared, and the deleted fact is not re-extracted as that exact fact. Deleting a memory does not erase the original message from your conversation history: the visible conversation history may still contain it. The deleted fact is masked from recent model context when it matches the stored fact. Contact us if you want underlying messages or your account deleted.

Portrait image bytes and unlocked chat photo and video bytes are stored durably in Google Cloud Firestore, rather than relying on temporary provider links. Some public catalogue portraits are also bundled with the website and delivered by Vercel. Public portraits can remain in browser and delivery caches for up to one year. Private portraits require account authorization and may be cached privately by your browser for up to one day. Unlocked chat photos and videos require the owning account and use no-store responses; the browser holds a temporary copy while displaying them. A locked preview uses an existing portrait; no new photo or video is generated until you unlock it. These stored media remain with the account subject to the deletion and retention practices above. Contact us for removal requests that require cache review.

Replicate receives the inputs needed for generation and temporarily hosts generated output before our server copies the media into Firestore. Its published default for predictions made through its API is to remove prediction inputs, outputs, files, and logs after one hour. Provider retention practices are separate from our durable account storage; see Replicate’s data-retention documentation.

6. Security and international transfers

We use access controls, encrypted connections, authenticated server routes, and database rules that deny direct client access. Authorized personnel may access information when needed for support, safety, or legal duties. No system is perfectly secure.

We are based in Cyprus. Providers may process data in the US or other countries. Where GDPR transfer rules apply, appropriate safeguards or an applicable adequacy mechanism must govern the transfer. Contact us to request information about the safeguards and provider locations applicable to your data.

7. Your rights

Depending on your location, you may have rights to access, correct, delete, or receive a copy of your data; restrict or object to processing; and withdraw consent where processing relies on consent. Contact contact@aurello.app. We may need to verify your identity before processing a request. We respond within applicable statutory deadlines. You can complain to the Cyprus Commissioner for Personal Data Protection or your local supervisory authority.

California residents may have rights to know and access categories and specific pieces of personal information, correct inaccuracies, request deletion, and opt out of sale or sharing for cross-context behavioral advertising. Meta measurement may constitute “sharing” under California law even when no money changes hands. To submit a request or an advertising-sharing opt-out, email us. We will not discriminate against you for exercising applicable rights. We do not exchange conversation text for money. We do not currently automatically honor browser Global Privacy Control signals.

8. Children and sensitive information

Yearnmore’s catalogue depicts fictional adult characters and does not solicit birth dates. We do not knowingly seek personal information from children where parental authorization is required by law. Parents or guardians concerned about a child’s account or information should contact us so we can investigate and address the request. Avoid entering unnecessary sensitive information. The service is not intended for crisis care or professional advice.

9. Updates and contact

We may update this policy as the service changes and will post the current version here, with notice of material changes where required. For privacy questions or requests, email contact@aurello.app or write to the company address above, marked “privacy.”