Privacy Policy

Last updated: September 20, 2026

Yakitori is a local-first writing tracker for macOS. This policy explains what the Yakitori account service ("we") collects, why we collect it, and the choices you have. The app's writing data does not leave your Mac through us.

The short version

• Your writing stays on your Mac. We never receive your manuscript, document text, or keystrokes.
• We collect the minimum needed to run your account, license, and — only if you opt in — your public profile and leaderboards.
• We use a few essential cookies. No advertising trackers.

What we collect

Account and sign-in. Your email address, whether you have verified it, and account timestamps. Access is passwordless, so we never store a password.

Sign-in security. When you request a sign-in link or code, we store a hash of it, its expiry, and the IP address that requested it. We also keep short-lived rate-limit counters and device-approval codes to prevent abuse.

Devices and licensing. A random installation identifier generated by the app, the platform (macOS), the app version, and first/last-seen times. To enforce one free trial per Mac we store a one-way hash of a hardware identifier computed on your device; the raw hardware identifier never reaches us. We also keep license and purchase records.

Payments. Purchases are processed by Stripe. We receive confirmation and identifiers for the purchase and your license, but never your full card number.

Public profile (optional). If you create one: username, display name, bio, avatar URL, privacy settings, your follow/block relationships, and any reports you make.

Published statistics (opt-in). If you choose to appear on leaderboards, we store the aggregate metrics you publish — net words, words added and removed, active time, focus time, and session count for a period. These are totals only; never your manuscript or document-level data.

Server logs. Standard technical logs (IP address, user agent, requested URL, timestamp) used for security and abuse prevention.

What we never collect

Manuscript contents, document text, document names, raw keystrokes, clipboard contents, or screenshots. Yakitori infers activity from the system idle counter and queries Word or Pages only for an exact word count where supported; none of that text is uploaded.

Where your writing data lives

Writing history is stored by the app on your Mac. If iCloud Drive is available and enabled, the app stores its database in your personal iCloud Drive so it can sync between your Macs; that transfer is between you and Apple, not us. Our servers do not receive it.

Cookies

The website sets a session cookie (to keep you signed in) and a CSRF cookie (to protect forms). These are strictly necessary to operate the site. We do not use advertising or third-party analytics cookies.

Who we share it with

We do not sell your data. We share the minimum necessary with providers that help us operate:

• Payments: Stripe.
• Email: our transactional email provider, used to send sign-in links and codes.
• Hosting: our hosting provider, which stores the database.
• Apple: if you enable iCloud Drive, your local data syncs through your own Apple account.

We may disclose information if required by law or to protect our users.

Retention

We keep account data while your account exists. License, transaction, and related audit records may be kept as long as needed for tax, accounting, and legal reasons, and may outlive account deletion. Sign-in and rate-limit records are short-lived. Trial records (including the one-way device hash) are kept to prevent repeated trials.

Your choices and rights

You control profile visibility, statistics visibility, and leaderboard participation independently, and can turn them off at any time. Depending on where you live, you may have rights to access, correct, export, or delete your personal data, or to object to certain processing. To make a request, email support@yakitoriapp.com.

Deleting your account

You can ask us to delete your account by emailing support@yakitoriapp.com. We remove your account, profile, API tokens, installations, and license association. We may retain transaction, license, and audit records where required by law or to enforce our terms, and trial records needed to prevent repeated trials.

Security

We use TLS in transit, store API tokens as hashes rather than plaintext, and restrict access to production systems. No system is perfectly secure; please use a well-protected email account.

Children

The service is not directed to children, and you must be old enough to enter a contract where you live.

International transfers

Our providers may process data in the United States or other countries. Where required, we rely on appropriate safeguards for such transfers.

Changes

We may update this policy. Material changes will be reflected by the date above and, where appropriate, notified to you.

Contact

Yakitori — support@yakitoriapp.com.