1. Introduction

Yealo ("we," "our," or "us") operates the yealo.us website and mobile application (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

We respect your privacy and are committed to protecting the personal data you share with us. Please read this policy carefully to understand our practices regarding your personal data.

Geographic Scope — US-Only Service

Yealo's services are offered to and intended for users in the United States only.

2. Information We Collect

2.1 Information You Provide

Account Information: Email address and password when you create an account.
Event Data: Event names, dates, descriptions, and settings you configure.
Media Content: Photos, videos, and audio files uploaded by you or your event guests.
Payment Information: Billing details processed securely through Stripe. We do not store your full credit card number.
Communications: Messages you send us through our contact page or support channels.

2.2 Information Collected Automatically

Device Information: Browser type, operating system, device type, and screen resolution.
Usage Data: Pages visited, features used, time spent on the Service, and interaction patterns.
Log Data: IP address, access times, and referring URLs.
Cookies: We use essential cookies for authentication and session management. Non-essential cookies (analytics, advertising) are used on free-tier events that display third-party ads.

2.3 Guest-Uploaded Content

When guests upload photos or media to your event, we collect the media files and basic metadata (upload time, file type). Guests are not required to create an account. Guest uploads are associated with the event, not with individual guest identities.

2.4 Biometric Data (Face Grouping — Coming Soon)

Face grouping is a planned feature that is not yet available. When it launches and an event host enables it, we will process uploaded photos to detect faces and generate mathematical representations called "face embeddings." Under certain state laws (Illinois, Texas, Washington), these embeddings may be classified as biometric data.

What we collect: Face embeddings (numerical vectors derived from facial geometry). We do not collect fingerprints, iris scans, or voiceprints.
Purpose: Solely to group photos by person within an event gallery for easier browsing.
Retention: Face embeddings are retained only for the duration of the event's retention period and are permanently deleted when the event expires or is deleted by the host.
No sale or sharing: We never sell, lease, or trade biometric data. Face embeddings are not shared with any third party.
Opt-in: Face grouping is only activated when the event host explicitly enables it. Hosts can disable it at any time, which deletes all face data for that event.

3. How We Use Your Information

To provide, operate, and maintain the Service.
To process events, media uploads, and gallery sharing.
To process payments and manage subscriptions.
To send transactional emails (account confirmation, event notifications, receipts).
To provide face grouping once it launches, when you opt into it. Your photos are not used to train AI models.
To improve and optimize the Service based on usage patterns.
To display relevant advertisements on free-tier events (see Section 4 for details).
To detect and prevent fraud, abuse, and security incidents.

4. Advertising

Free-tier events may display advertisements served by Google AdSense and other third-party ad networks. Third party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads based on your visit to our site and/or other sites on the Internet. Paid-tier events never display advertisements.

For more information on how Google uses data when you use our service, see How Google uses information from sites or apps that use our services.

You may opt out of personalized advertising by visiting Google Ads Settings or www.aboutads.info.

5. Data Sharing and Disclosure

We do not sell your personal information. However, when we serve personalized advertisements via Google AdSense on free-tier events, information about your browsing activity may be shared with Google for cross-context behavioral advertising, which may constitute "sharing" of personal information under the California Consumer Privacy Act (CCPA/CPRA). You may opt out of this sharing as described in the Do Not Sell or Share My Personal Information section below.

We may share your data with:

Service Providers: Supabase (database and authentication), Google Cloud (web hosting), Cloudflare (CDN and media storage), Stripe (payments), Resend (transactional email), Twilio (SMS), and imgproxy (image processing).
Ad Partners: Google AdSense and other ad networks (free tier only).
Legal Requirements: When required by law, court order, or to protect our rights and safety.
Event Guests: When you share your event link, guests can view the gallery and photos you've made visible.

6. Data Retention

We retain your account data for as long as your account is active. Event data and media are retained according to your tier's storage window (14 days to 1 year for active access, plus cold storage periods). After retention periods expire, data is permanently deleted.

You can request deletion of your account and all associated data at any time by contacting us.

7. Your Rights (CCPA)

Because Yealo is a US-only service, your privacy rights are governed primarily by the California Consumer Privacy Act (CCPA/CPRA) and similar US state privacy laws. California residents and all US users have the following rights:

Right to Know: Request disclosure of the personal information we collect, use, disclose, sell, or share about you.
Right to Delete: Request deletion of your personal information (subject to certain exceptions).
Right to Correct: Request correction of inaccurate personal information we hold about you.
Right to Opt-Out: Opt out of the sale or sharing of your personal information, including for behavioral advertising.
Right to Limit: Limit the use and disclosure of your sensitive personal information.
Right to Non-Discrimination: Not be discriminated against for exercising your privacy rights.

To exercise any of these rights, contact us at privacy@yealo.us. See also the Do Not Sell or Share My Personal Information section for opt-out options.

8. Cookies

We use the following types of cookies:

Essential Cookies: Required for authentication, session management, and core functionality. These do not require consent.
Analytics Cookies: Help us understand how the Service is used.
Advertising Cookies: Used by ad partners to serve relevant ads on free-tier events.

You can manage or block cookies at any time through your browser settings. We also automatically honor the Global Privacy Control (GPC) signal — if your browser sends a Sec-GPC: 1 header, we treat it as an opt-out of sale or sharing of your personal information.

9. Data Security

We implement industry-standard security measures including encryption in transit (TLS/HTTPS), encrypted storage, access controls, and regular security reviews. However, no method of electronic transmission or storage is 100% secure.

10. Children's Privacy

Our Service is not intended for children under 13. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

12. Do Not Sell or Share My Personal Information

Your opt-out options: You may opt out of this sharing by:

Enabling Global Privacy Control (GPC) in your browser — we automatically honor the Sec-GPC signal as an opt-out. No further action is required.
Visiting Google Ads Settings to opt out of personalized ads from Google.
Visiting www.aboutads.info for additional industry opt-out options.

California residents and all US users have the following rights under the CCPA/CPRA:

Right to Know — Request disclosure of the personal information we collect, use, disclose, sell, or share.
Right to Delete — Request deletion of personal information (subject to exceptions).
Right to Correct — Request correction of inaccurate personal information.
Right to Opt-Out — Opt out of the sale or sharing of personal information, including for behavioral advertising.
Right to Limit — Limit the use and disclosure of sensitive personal information.
Right to Non-Discrimination — Not be discriminated against for exercising these rights.

To exercise any of these rights, contact us at privacy@yealo.us.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

Email: privacy@yealo.us
Website: yealo.us/contact

Your data.Your terms.