Privacy Policy

Effective Date: May 11, 2024

Yorba takes your privacy seriously. We’ve done our best to keep our Privacy Policy straightforward, and hope you read it all.

Please note that a lot of this information is provided within Yorba itself. For example, when you’re given the option to connect your inbox so that we can search it to find Accounts for you, we spell out exactly what we’re gonna look at and why. But still; we hope you read this.

From time to time, we may make minor changes to this policy – not because we’re changing our practices or ethics, but because we’re perpetually expanding and refining our services and might need to add language that covers new stuff. Whenever we make any ‘real’ change (as opposed to something trivial like a typo correction), we’ll note it under “Policy Updates”.

Policy Updates

August 2026 - Added a "How we use statistical inference, inbox data, and LLMs to detect Login results" section.

April 2026 - Added “Legal bases for processing (EU/UK members)” section.

February 2026 - Added a section about the Dedicated Deletion Team

May 2024 - We added more details to the end of the “Personal data we collect” section so you can see the sophisticated ways we keep your data safe.

October 2022 – We completely rewrote the policy with much more straightforward language, in the hopes that people without spare time and a legal degree might actually read it.

Personal data we collect (and why)

Here’s a list of the moments and functions that involve Yorba receiving your personal data (by which we mean any data that can identify or be used to identify an individual) directly from you.

We’re using the word “collect” as a catch-all to mean interact with or use in some way.

When you sign up for Yorba:

What we collect:

Your first and last name
Your email address

Why we collect it:

So that you can create an account unique to your identity
So that we can verify your identity
So that we can contact you

When you log in to Yorba and/or browse our website:

What we collect:

Device/IP data (i.e. Device ID, domain server, type of device operating system/browser used)
Web analytics (i.e. statistics re: the interaction between Yorba and your device/browser)
Geolocation data (i.e. IP address-based location info)

Why we collect it:

We aggregate and analyze this data in order to improve the performance of our services. We have no interest in individuals and do not track specific IPs.
This might fairly be considered non-personal data, but we’re erring on the side of transparency and mentioning it here. In the wrong hands, “anonymous” data isn’t always anonymous – which is one of several reasons why we’ll never sell such data to a third party.

When scanning for Accounts that charge you fees (i.e. paid subscriptions):

What we collect:

Name of banking institution(s) that you ask us to search
Name on the bank account(s) that you ask us to search
Information about financial transactions that may indicate the existence of any Account(s)

Why we collect it:

It’s one of the automated ways we find your Accounts – specifically, the ones that charge you a fee

When scanning your inbox(es) for Accounts associated with your email address(es):

What we collect:

The names and domain names of email senders that may represent Accounts, and the frequency with which they are sent and opened
“Unsubscribe” links (from emails sent via automated mailing list)

Why we collect it:

To help you track which organizations demonstrably possess your personal information
To help you identify the Accounts/organizations these emails originate from
To provide you statistics re: which mailing lists you actually interact with (vs. the ones that seem to just be clogging your inbox with crap)
So Yorba can provide you a convenient li’l “Unsubscribe” button and spare you the hassle of digging through your inbox to manually find each link one at a time

How we use statistical inference, inbox data, and LLMs to detect Login results

Yorba uses statistical inference to work out which emails represent an account you've signed up for. Here's exactly what that involves.

What we store

For a random sample of scanned messages, we store the words of the sender, subject, and body as a list of tokens, so we can check and improve how well our classifier works. The number of messages sampled will diminish towards 1% as our predictor improves. Before anything is stored, we automatically strip out email addresses, links (including the bits after the slash, where reset tokens and one-time codes hide), long numbers, and anything that looks like a code or key. We also replace the message's ID with an irreversible hash, so a stored sample can't be traced back to a specific personal message. This happens at the moment of capture. Nothing sensitive is written down and cleaned up later.

How we use it

Our classifier uses statistical inference on our own infrastructure using an open-source library. It never sends your data anywhere else.

Where Google comes in

Separately, we use Google's Gemini model to double-check a sample of our classifier's decisions. Gemini says whether it thinks a message is a signup email. We compare that against what our own classifier said, and where they disagree we fix our classifier. This runs on the above redacted samples, as a batch job, not while you're using Yorba.

What we don't do

We don't use your data to train or improve general-purpose AI models - not ours, not Google's, not anyone's. Yorba's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When you voluntarily provide us with personal info (e.g. by contacting us or filling out a feedback text box):

What we collect:

Whatever you want to tell us

Why we collect it:

To address whatever you’re telling us about

And here are instances in which we might receive your personal data from a source other than you.

When you contact customer support 
We may use a third party vendor to help provide customer support. They’ll pass along any info they’ve received from you that Yorba may need to know in order to resolve whatever issue you’re dealing with. That info might include personal data.

When you search for Accounts that are publicly associated with you 
Your personal data might turn up in publicly available search results, and/or be provided by trusted open source tools like haveibeenpwned.com.

When you (knowingly, voluntarily) connect services to Yorba in order to scan them for Accounts
 In some cases, technically we’re receiving some of the relevant personal data from your email providers and/or banks (as opposed to ‘directly’ from you). But in any case, this only happens with your explicit permission.

And lastly, here are a handful of other reasons we might collect the personal data described above:

To be able to provide customer support
To comply with local laws and regulations, some of which have data retention requirements
To prevent fraud and whatnot
To resolve disputes, collect fees, represent our legal rights, and other stuff like that

We will not collect other types of Personal Data, or use the Personal Data we collected for materially different, unrelated or incompatible purposes, without providing you notice.

Remember, any data we do collect from you is encrypted at the storage level using AES256--that’s a fancy way of saying Google can’t read the data stored on Google Cloud.

Not only is your data is protected in the database (at rest) but also in transit. This means that we secure all communications between Yorba Members and the Google Front End (GFE) using Transport Layer Security.

So that’s all to say that we have extensive security procedures in place to protect both the confidentiality and the security of your data.