Privacy

Last updated 28 August 2026

What we store

• Your username and the secret token that opens your inbox.
• The messages you receive, and when they arrived.
• Your email, only if you chose to add one. We never ask for it at signup and the service works completely without it.
• Your theme, prompt and settings, including a question you wrote yourself and any words you asked us to filter out.
• Public answers you publish, and which message each one replies to.
• A notification address, if you turned notifications on. This is the anonymous endpoint your browser gives us, not an account of yours.
• Who invited you, if you arrived from someone's invite link, and how many people you have invited.

What we deliberately do not store

• Who sent a message. No account, no device id, no name.
• Sender IP addresses. To stop one person flooding one inbox we keep a keyed cryptographic fingerprint of the sender's address, not the address. It is keyed with a secret that is not stored in the database, so even someone holding a copy of the database cannot work backwards to an IP. It is enough to count, and useless for anything else. These rows are deleted within two hours.
• Location, contacts, or anything from your device.
• Third-party tracking or advertising profiles built from your messages. Your messages are never used to target ads.

Answers are public, and that is your choice

You can publish any message you receive together with your reply. Once you do, both the message and your answer are visible to anyone who opens your link. Nothing about the sender is published, because we do not have anything about them, but the words they wrote do become public.

A message arrives private and stays private unless you choose otherwise. You can take a published answer down at any time, and it disappears from your page immediately.

Notifications

If you turn notifications on, the alert we send says only that a message arrived. It never contains the message. That is deliberate: a notification travels through Google's or Apple's servers, and your messages are not theirs to see. The app fetches the actual text from us when you open it.

We store the notification endpoint your browser generates and nothing else. Turn notifications off and it is deleted.

The link a sender keeps

When somebody sends you a message, they get a link that shows them what they wrote and, if you published one, your public answer. It tells them nothing else, and it gives them no way to contact you again. It exists so they can find out whether they were answered.

How long we keep things

On the free plan, messages are kept for 30 days and then deleted. On Pro they are kept until you delete them. Rate-limiting fingerprints are discarded within two hours.

Deleted means the row is gone, not hidden behind a flag or a date filter. Expired messages are removed the next time the inbox is opened, and your inbox will tell you how many were deleted when it happens.

Deleting everything

Open your inbox, go to Settings, and choose to delete your account. Your username, your link and every message are removed immediately and the username becomes available to someone else. There is no recovery, no grace period and no archived copy.

Messages we hold back

Messages that threaten someone or encourage self-harm are stored but never delivered. We keep them because a real threat may need to be handed to the police, and deleting the only record of it helps nobody. They are not visible to the recipient and not visible to anyone at all unless a formal legal request arrives.

Invites

If you arrived through someone's invite link we record who invited you, so they get the free month we promised them. To stop one person collecting rewards by making accounts on their own phone, we store a keyed fingerprint of the device that used an invite. It is the same one-way kind described above and it is not an address.

Who else sees your data

The site runs on Cloudflare, which hosts the pages and the database and provides the bot check on the message form. If you turn notifications on, your browser's push service (Google on Android, Apple on iPhone) delivers the alert, which as described above contains no message content.

That is the entire list. There are no ads on Yiti today and no advertising company receives anything from us. There is also no payment processor yet, because there is nothing to buy. If either changes, this page changes first and the date at the top will say so.

Age

You must be at least 13 to use Yiti. If we learn an account belongs to someone younger, we delete it.

Your rights

You can see everything we hold about you in your inbox, and delete all of it from Settings without asking anyone. For anything else, write to hello@yiti.link.