Privacy Policy

1. What We Mean by Personal Information

For purposes of this Privacy Policy, "Personal Information" means any information from or about a person that either identifies that person directly or that makes that person identifiable when it is combined with other information from or about that person from any source.

2. Information We Collect

Information You Provide To Us

When you use the Services or otherwise communicate with us, we collect the information you provide to us directly, including:

• Account information: your mobile phone number (if you sign in with it), the information we receive from your sign-in provider (see below), your username, profile details you choose to add (such as a display name or profile picture), and a record that you checked the box confirming you are 18 or older and agreeing to our Terms of Service and this Privacy Policy, including the time and the version of the Terms of Service you accepted, and, if you set up your profile in an App or access Mature games on the Site, your birthday and a further confirmation that you are 18 or older.
• Guest play: if you play without an Account, we collect your confirmation that you are 18 or older and agree to our Terms of Service and this Privacy Policy, the inputs you send during the turns you play, and the device and usage data described below.
• Stories, chats, and other inputs: the games, stories, and characters you create, and your prompts, messages to AI characters, choices, and other inputs. We also collect the AI-generated text and images produced for you. Together these are "Inputs and Content."
• Photos and images: photos you upload, such as a selfie used as your player "look" or images you assign to characters in a game or story you create. Every photo is re-encoded when you upload it, which removes location (GPS) and other embedded metadata (EXIF). We use your photos only to display them and to generate the images you request. Before a photo is saved, OpenAI and Google check a reduced-size copy to detect images of children or explicit content. If you upload a selfie for your player look, OpenAI's image model uses it as a reference to draw your look, and we record your consent to this use together with the version of this Privacy Policy. We do not use your photos to identify you, and we do not extract or store face geometry, face templates, or other biometric identifiers from them. OpenAI and Google return to us only a moderation result and, for your player look, the drawn image.
• Comments and replies: comments and replies you post on games and stories, which are visible to other users.
• Purchase information: when you buy on the Site, our payment processor, Stripe, collects your payment details, and we receive limited information such as a transaction ID, amount, card type, last four digits, and billing status. When you buy in an App, Apple or Google processes the payment, and we receive a transaction record and subscription status. We never receive or store your full card number.
• Reports, appeals, and support: information you provide when you contact us, report content or a user, file an appeal, send a copyright notice or counter-notice, respond to a survey, or take part in a promotion or referral program.

You can choose not to provide information that we request, but this may limit your ability to use the Services. If you contact us, we keep a record of that correspondence. If another user invites you to the Services by providing your contact information, we use it only to send that invitation and to credit the referral, unless you sign up.

Automatically Collected Information

When you use the Services, we and our service providers automatically collect technical information, using cookies, software development kits (SDKs), and similar technologies:

• Device data: IP address, device type and model, operating system, browser type, App version, language, time zone, cookie and device identifiers, and push notification tokens if you allow notifications.
• Usage data: the games and stories you play, the features you use, moves, purchases, session length, timestamps, pages viewed, referring pages, and crash and performance logs.
• Approximate location: your city or region, inferred from your IP address. We do not collect precise GPS location.
• Security data: information our bot-protection service uses to tell people apart from automated traffic.

Information You Post on the Services

The Services let you publish games and stories and post comments and replies, which other users and visitors can see. Please do not include personal information about yourself or anyone else in published content. Once you publish content, others may view, play, copy, or share it, and we cannot control what they do with it. Deleting published content removes it from the Services, but copies others made before deletion may remain.

Information From Third Parties

• Sign-in providers: if you sign in with Google, Discord, or Apple, we receive your name, email address, and account identifier, depending on your settings with that provider.
• App stores and payment processors: purchase and subscription status from Stripe, Apple, and Google. If you use an App, we also receive an age-range signal from Google Play or Apple's Declared Age Range indicating whether you are an adult.
• Advertising partners: information about your interactions with our ads and how you arrived at the Site.
• Other users: information another user includes when they report content or invite you to the Services.

How We Use Cookies and Other Technologies

We use the following technologies:

• Required cookies and similar technologies keep you logged in, remember your preferences, protect the Services (including bot checks by Cloudflare Turnstile), and process purchases. Because they are essential to operate the Services, you cannot opt out of them.
• Analytics. We use PostHog to understand how the Services are used, to fix bugs, and to improve features. PostHog is hosted in the United States, and our analytics events do not include chat text or images. For visitors in the EEA and UK, PostHog runs without storing cookies or similar identifiers on the device and without session recording, and we use it only for aggregated statistics about how the Site is used. For other visitors, session recordings and click tracking mask text and typed input.
• Advertising (Site only). The Site uses the Meta Pixel to measure our advertising campaigns and to show Yam ads to people who have visited the Site. The Meta Pixel sends Meta information such as your IP address, browser information, cookie identifiers, and information about your activity on the Site, such as pages you visit. Our Apps do not use the Meta Pixel. We do not send the content of your chats, your photos, or sensitive information to advertising partners. The Meta Pixel sends Meta only page views, sign-up completions, and game-progress events, which identify only the public name of the game, and we use Meta's Limited Data Use setting for all Site traffic. We do not send your name or email address to Meta. The Meta Pixel does not load for visitors whose device time zone is set to a location in Europe, including the UK, or whose IP address indicates that they are in the EEA or the UK.

You can manage cookies through your browser settings and through the "Your Privacy Choices" link in the Site footer and under Profile > Edit profile > Account. You can also opt out of interest-based advertising through Meta's ad settings and industry tools such as optout.aboutads.info.

3. Use of Collected Information

We use Personal Information to:

• Provide the Services: create and manage your Account; sign you in, including by sending one-time verification codes by text message if you sign in with your phone number; generate AI story text and images; save your games, stories, and progress; and display content you publish.
• Process payments: handle purchases, subscriptions, renewals, refunds, and chargebacks. Apple and Google send renewal notices for Subscriptions purchased in the Apps. For Subscriptions purchased on the Site, we email you a reminder at least once a year with the Subscription terms and how to cancel, and we email you before any price change.
• Keep the Services safe: confirm that users are adults; check uploaded photos for images of children or explicit content; check a sample of AI replies for explicit content; screen AI replies for content that encourages self-harm; detect, review, and remove content that violates our Terms of Service or Content Guidelines; operate our safety protocol, including holding your message and showing crisis resources when our systems detect possible suicidal or self-harm intent in what you type; investigate reports and appeals; prevent fraud, bots, and abuse; and enforce our Terms of Service.
• Show required notices: for example, the notice that your story is written by AI and the reminder that characters are AI, shown at the start of each session and at least every three hours during a continuing session (a new session starts after thirty (30) minutes without play), and, after three hours of continuous play, a reminder that you can take a break.
• Improve the Services: analyze usage to fix bugs and develop new features and stories. We do not use your chats, stories, photos, or other Personal Information to train or fine-tune any AI model, including large language models.
• Communicate with you: send service messages and safety notices, and send push notifications if you allow them. You can turn off push notifications in your device or browser settings, and you can unsubscribe from any marketing email we send.
• Advertising: measure our ads and show Yam ads on other services, as described in Section 2, without using the content of your chats, your photos, or sensitive information.
• Comply with law: respond to lawful requests, keep records required by law, and report child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC) as federal law requires. We also keep aggregated, de-identified counts of crisis-resource referrals to meet state reporting requirements.

Legal bases (EEA and UK users). We rely on the following legal bases. Contract: to provide the Services. Legitimate interests: to keep the Services safe, prevent fraud, and improve the Services, balanced against your rights. Consent: for advertising cookies, marketing, and processing of sensitive information where consent is required; you can withdraw consent at any time. Legal obligation: to comply with the law.

4. AI Processing, Human Review, and Sensitive Information

AI providers. We send your Inputs and the related story context to third-party AI providers so they can generate responses, images, and, when those features are available, character voices and video, and help moderate content. Our current providers are:

• Google (Gemini models), OpenAI (GPT models), and Anthropic (Claude models) for story text (we access Google models through Google Cloud Vertex AI);
• OpenAI for images, including generating your player "look" from a selfie you upload; and OpenAI and Google to check uploaded photos for images of children or explicit content;
• ElevenLabs, to generate character voices from story text, when voice features are available; and
• Seedance, to generate video from story content, when video features are available. We do not send your uploaded photos to Seedance.

Google, OpenAI, and Anthropic process your data under their standard API terms. Under those terms, they are not permitted to use it to train their models. ElevenLabs and Seedance process your data under terms that likewise do not permit them to use it to train their models. Google may briefly cache parts of prompts to improve performance. We do not have zero-retention agreements with them, so they may keep it for limited periods under their own terms, for example to monitor for abuse and to comply with law. The first time you send your own words in a story, we tell you that your story is written by AI and name our AI providers, and we ask for your agreement before your data is first sent to them. If you are in the EEA or the UK, we also ask for your explicit consent to process sensitive information you share in chats. You can withdraw this agreement at any time in Profile > Edit profile > Account > “Withdraw AI consent” (available to signed-in users). Because the Services cannot generate stories without these providers, withdrawing it stops new AI-generated responses until you agree again.

Human review. Other users cannot see your private chats. Authorized Yamstudio staff may review limited Inputs and Content only in these cases:

• our automated systems flag it as a possible safety or policy violation;
• you or another user reports it, or it is included in a sample of AI replies we check for explicit content;
• we are investigating fraud, abuse, or a security incident;
• we need to maintain, debug, or improve the safety and quality of the Services, in which case we review only the content needed;
• you ask us for support and give us permission; or
• the law requires it.

Sensitive information. Romance and emotional storytelling can reveal personal things. Your chats, preferences, and story choices may reveal sensitive information, or allow it to be inferred. Examples are your sexual orientation, sex life, or emotional or mental state. Messages you write may also include information about your health. We treat Inputs and Content as sensitive. We use it only to provide, secure, and improve the Services. We do not use it to infer characteristics about you for advertising, and we do not sell or share it for advertising. Please do not include government ID numbers, financial account details, or other people's personal information in your Inputs.

5. Third Parties We Share Personal Information With

We do not sell your Personal Information for money. We disclose Personal Information only to the following categories of third parties:

• AI providers, as described in Section 4;
• Service providers that help us run the Services and may use Personal Information only to provide services to us. These include hosting and database providers (Vercel, Supabase, Railway, and our Redis provider), payment processing and subscription management (Stripe and RevenueCat), text-message delivery (Twilio), push notifications (Google Firebase and browser web-push services), analytics (PostHog), bot protection (Cloudflare), tools we use to notify our team about reports (Discord and Notion, which receive only the report type, a reference number, and a link; reports themselves are stored in our own systems), and email and customer support tools;
• App stores, Apple and Google, which process purchases made in the Apps under their own privacy policies;
• Our advertising partner Meta, through the Meta Pixel on the Site, in compliance with applicable law. Under some U.S. state laws this may count as a "sale" or "sharing" of Personal Information; see Section 12 to opt out;
• Other users and the public: games and stories you publish, comments and replies you post, and your username and profile picture. Private chats are not shared with other users;
• Public authorities, such as law enforcement, if we are legally required to disclose information; to report child sexual abuse material to NCMEC; to respond to an emergency involving risk of death or serious injury; or to protect our rights or the rights, property, or safety of our users or others; and
• Our subsidiaries and affiliates, or a subsequent owner or operator of the Services and their advisors, in connection with a merger, acquisition, financing, restructuring, sale of assets, bankruptcy, or other corporate reorganization, in accordance with this Privacy Policy.

We may also share information with your consent, and we may share de-identified or aggregated information that can no longer reasonably be linked to you. We may add third-party providers from time to time and we will update this Privacy Policy on our website when we do.

6. Links to Other Websites

The Services may link to third-party websites and services, and you may sign in with a third-party account such as Google, Discord, or Apple. This Privacy Policy applies only to the Services. Your interactions with third-party services are governed by the privacy policies of the companies that provide them. We encourage you to read those policies.

7. Security

We use reasonable administrative, technical, and physical safeguards designed to protect Personal Information, including removing location metadata from uploaded photos and storing uploaded photos privately, with access only through links that expire after one hour. However, no system is completely secure. We cannot guarantee that unauthorized third parties will never be able to defeat those measures. If a data breach affects your Personal Information, we will notify you as required by law.

8. Do Not Track Signals and Similar Mechanisms

Some web browsers transmit "do-not-track" signals. Because there is no agreed standard for these signals, we do not currently respond to them. We honor Global Privacy Control (GPC) signals as a request to opt out of the sale or sharing of Personal Information for the browser or device from which we receive the signal.

9. Children

The Services are only for adults 18 and older and are not directed to children. Every user must confirm that they are 18 or older before playing. Mature games on the Site require an additional confirmation, including a birthday showing that you are 18 or older, and are not available in the Apps. Accounts with an under-18 birthday or age signal are blocked from Mature content, tips, and purchases, and an under-18 age signal blocks use of the App. We do not knowingly collect Personal Information from anyone under 18. If we learn that we have collected Personal Information from someone under 18, we will delete it and close the Account, except where the law requires us to keep it (for example, a child-safety report). If you believe a minor is using the Services, contact us at hi@yamstudio.ai or use the in-Service report tool.

10. Managing Your Privacy

You can update your Account information in your profile settings. You can turn off push notifications in your device or browser settings and unsubscribe from any marketing email using the link in that email.

Deleting your Account. You can delete your Account at any time on the Site at hiyam.ai/profile/edit, or in the App under Settings > Delete Account, or by emailing hi@yamstudio.ai with enough information for us to identify your Account. When you delete your Account, we delete your Account information, chats, stories, drawn looks, photos (including selfies), and comments from our active systems, except as described in Section 14. Games you have published remain on the Services but are credited to “Deleted user.” Before you delete your Account, you can set a game to Private or Unlisted, edit it to remove personal information, or delete it. After you delete your Account, you can ask us to unpublish a game or remove personal information from it by emailing hi@yamstudio.ai. Deleting your Account cancels any Subscription purchased on the Site, so you will not be charged for future renewals. If you have a Subscription through Apple or Google, cancel it in your App Store or Google Play settings; deleting your Account does not cancel it automatically.

11. Your Rights (EEA and UK)

Yamstudio is based in the United States and does not maintain an establishment in the European Economic Area or the United Kingdom. If you are in the European Economic Area or the United Kingdom, you have the right to access, correct, erase, or receive a portable copy of your Personal Information.

You also have the right to object to or restrict our processing of it, and to withdraw your consent at any time. To exercise these rights, contact hi@yamstudio.ai. We will respond promptly in accordance with applicable law. You may also lodge a complaint with your local supervisory authority. We encourage you to contact us first, so we have an opportunity to address your concerns directly.

12. U.S. State Privacy Rights

California Civil Code Section 1798.83 requires certain businesses that share customer Personal Information with third parties for those third parties' direct marketing purposes to respond to requests from California customers about that practice. We do not share Personal Information with third parties for their own direct marketing purposes.

Depending on where you live, state privacy laws may give you the following rights with respect to Personal Information we have collected about you, subject to certain exemptions. We honor these requests from all U.S. users, whether or not a state privacy law applies to us:

Requests to Know and Access

You have the right to request that we disclose the categories of Personal Information we have collected about you; the categories of sources; the business or commercial purposes for collecting, selling, or sharing it; the categories of third parties to whom we disclose it; and the specific pieces of Personal Information we have collected about you, in a portable format.

Requests to Correct and Delete

You have the right to request that we correct inaccurate Personal Information about you, and that we delete Personal Information we have collected from you. When we receive a verified request, we will do so unless the law requires or allows us to keep the information.

Right to Opt Out of Sale, Sharing, and Targeted Advertising

Our use of the Meta Pixel on the Site may be considered a "sale" or "sharing" of identifiers and internet activity information, or "targeted advertising," under some state laws. You may opt out at any time using the "Your Privacy Choices" link in the Site footer, by enabling Global Privacy Control in your browser, or by emailing hi@yamstudio.ai. We do not sell or share Personal Information of anyone we know to be under 16, and we do not use Personal Information for profiling that produces legal or similarly significant effects.

Sensitive Personal Information

We use sensitive Personal Information only to provide the Services and keep them safe. Where a state law requires your consent to process sensitive Personal Information, we ask for it on the AI consent screen. We do not sell or share it.

Categories of Personal Information

In the last 12 months, we collected the following categories of Personal Information:

• identifiers (name, email address, phone number, username, IP address, and device and cookie identifiers);
• customer records and commercial information (purchase and subscription history);
• age (a confirmation that you are 18 or older);
• internet or other electronic network activity (usage and interaction data);
• approximate geolocation;
• audio or visual information (photos you upload);
• sensitive Personal Information (account login credentials, and information about sex life or sexual orientation that may be revealed in Inputs and Content); and
• inferences drawn from the above (story preferences).

We collect these categories from the sources in Section 2, use them for the purposes in Section 3, and disclose them to the categories of recipients in Section 5. Our use of the Meta Pixel on the Site may be considered a "sale" or "sharing" of identifiers and internet activity information under some state laws. Retention is described in Section 14.

Authorized Agents

You may designate an authorized agent to make requests on your behalf. You must give the agent written permission, and we may require you to verify your identity directly with us. Alternatively, an agent with power of attorney under California Probate Code sections 4000–4465 may submit a request on your behalf.

Methods for Submitting Requests and Our Response

You may submit requests by email to hi@yamstudio.ai or through the "Your Privacy Choices" link in the Site footer. We verify requests by confirming that you control the email address or phone number associated with your Account. Any additional information you give us for verification is used only for that purpose. We will acknowledge your request within 10 business days and respond within 45 days of receipt. If we need more time (up to 90 days in total), we will tell you why in writing. We do not charge a fee unless a request is excessive, repetitive, or manifestly unfounded. If we deny your request, you may appeal by replying to our decision with the subject line "Appeal." If we deny your appeal, you may contact your state attorney general.

The Right to Non-Discrimination

You have the right not to be discriminated against for exercising your privacy rights. Unless the law permits it, we will not deny you the Services, charge you different prices, or provide you a different level or quality of service because you exercised these rights.

13. International Transfers of Personal Information

Yamstudio is based in the United States, and we and our service providers process Personal Information in the United States and in other countries where our providers operate. Their data-protection laws may differ from those where you live. Where the law requires it for transfers from the EEA, the UK, or Switzerland, we rely on appropriate safeguards. We use, transfer, and disclose Personal Information only for the purposes described in this Privacy Policy and in compliance with applicable law.

14. Data Retention

We keep your chats, stories, drawn looks, and comments for as long as your Account is active, unless you delete them sooner, and delete them when you delete your Account. If you delete a game, you can recover it for ninety (90) days, after which it is permanently deleted. Analytics data associated with your Account is deleted when you delete your Account. Games you have published remain on the Services after you delete your Account, credited to “Deleted user.” We keep photos you upload, including selfies used for your player look, until you delete them or your Account, or until three (3) years after you last sign in, if earlier. When we delete information, we remove it from our active systems. Our database provider keeps daily backups for seven (7) days, so residual copies of deleted records are overwritten within seven (7) days. Uploaded photos are not included in those backups, so a deleted photo is removed immediately. Our app hosting provider does not store user content, and our short-term cache keeps data only for seconds to minutes and is not backed up. We keep server logs and AI usage records for twelve (12) months and then delete them. We keep purchase records as long as tax and accounting laws require. We keep records of serious safety violations, reports, and appeals as long as needed to protect users, to prevent banned users from returning, and to comply with law. Our AI providers keep data only as described in Section 4. Even if you ask us to delete Personal Information, the law may require us to keep it. Once those requirements end, we will delete it.

15. Changes to the Privacy Policy

We may update this Privacy Policy as we update and expand the Services. You can tell when it was last updated by checking the "Last updated" date at the top of this page. If we make material changes, we will notify you by email or text, or by a notice in the Services, before the changes take effect. Where the law requires your consent to a change, we will ask for it.

16. Contacting Us

If you have questions about this Privacy Policy or our privacy practices, or want to exercise your rights, contact us by email at hi@yamstudio.ai or by mail to Yamstudio, Inc., 2261 Market Street STE 66599, San Francisco, CA 94114.