Yarrow
Privacy Policy
Effective November 11, 2026 · Version 2026-11-11.2
Summary
- Your conversations and Book are stored encrypted (AES-256) on a server in San Jose, California.
- To reply to you, write your Book and speak aloud, Yarrow sends your words to Google, OpenAI and ElevenLabs. Under their business terms, they do not train their models on it.
- We do not sell your data, share it for advertising, or use trackers or ads.
- You can delete any conversation, or everything, at any time.
- Yarrow is for people 18 and older, and it is not therapy or crisis care.
Who we are
Yarrow is a reflective companion: you talk or type, it listens and asks questions, and it writes your conversations into a private Book. Yarrow is run from California, USA. Questions about this policy or your data: hello@hiyarrow.com.
Yarrow is in private beta
Yarrow is an early, invite-only beta, shared with a small group of people while it is being built. During the beta it is run by its founder personally, ahead of forming a company. When the company is formed, it will take over responsibility for Yarrow and your data under this same policy; we will update this page with its name and tell you before that happens.
- Features change often during the beta, and some may be added or removed.
- We work to keep everything you write safe and backed up, but a beta can have bugs. If anything is ever lost or damaged, we will tell you.
- Your feedback is welcome at hello@hiyarrow.com. If you send us something you wrote in Yarrow to show a problem, we use it only to fix that problem.
- The beta is free. If Yarrow ever asks for payment, it will be your choice, and nothing you have written will be held back.
What we collect
- Your account: your email address, the name you ask Yarrow to call you, when you were invited and last signed in, and when you accepted this policy and confirmed you are 18 or older.
- Your conversations: what you say or type, Yarrow’s replies, and when each was said. When you speak, Yarrow receives the text of your words, not a recording, unless you switch Talk to “Hearing: recorded”.
- Your Book: what Yarrow writes from your conversations (titles, overviews, points, drawings, a question to carry, a quote), your edits to it, and how it is organized into books.
- Your notes: topics you write down and questions you save, with your thoughts on them.
- Usage counts: how many requests were made to each AI provider each day, and how much text. Counts only, no content, so we can see what Yarrow costs to run.
- Invite requests: if you ask for an invite on hiyarrow.com, the email address you give.
- On your device only: your settings (voice, ambience, light or dark) and small reminders, kept in your browser’s storage, not on our server.
We do not collect your location, contacts, photos, or anything from other apps, and we do not use analytics or advertising trackers.
How we use it
- To hold your conversations and reply to you.
- To write and keep your Book and your notes, and to learn from your own corrections to your overviews when writing your next ones (kept privately, in your own encrypted folder, never used for anyone else).
- To sign you in, with a one-time code sent to your email.
- To keep Yarrow safe: an automated check looks for signs that someone may be in danger, so Yarrow can respond with care and point to help.
- To understand what Yarrow costs to run, from usage counts only.
We never use your conversations to train AI models, and we never sell them or use them for advertising.
Who processes your data
Yarrow relies on these service providers. Each processes only what it needs, for Yarrow, under its own business terms. None may sell your data or use it for its own advertising.
| Provider | What it receives | Why | Where | Its terms |
|---|---|---|---|---|
| Fly.io | Everything Yarrow stores, encrypted (see "How it is stored"). | Runs Yarrow’s server and holds its encrypted storage. | Data centers in San Jose, California, USA. | SOC 2 Type 2. Takes a daily snapshot of the encrypted storage, kept for 5 days. |
| Google (Gemini API) | What you say or type in a conversation, the name you chose, short summaries of your recent conversations, and Yarrow’s replies. | Writes Yarrow’s replies in conversation, and the short explanations in knowledge cards. | United States. | Under Google’s paid API terms: not used to improve Google’s products; kept up to 55 days only to detect misuse. |
| OpenAI (API) | What you say or type, for an automatic safety check; your finished conversations; Yarrow’s replies when read aloud in an OpenAI voice; recordings, when Talk is set to “Hearing: recorded”. | Checks messages for signs someone may be in danger, writes your Book (titles, overview, points, drawings), reads replies aloud, and transcribes recordings. | United States and possibly other countries. | Not used to train OpenAI’s models. Kept up to 30 days to detect misuse (transcriptions are not kept). |
| ElevenLabs | The text of Yarrow’s replies, never what you said. | Reads Yarrow’s replies aloud in some voices. | United States. | Yarrow has opted out of ElevenLabs using this text to train its models. |
| Resend | Your email address, and the sign-in code or welcome message sent to it. | Sends Yarrow’s emails. | United States. | SOC 2 Type 2. Keeps sent emails and their logs for 30 days. |
| Cloudflare | Ordinary traffic data (such as IP address) when you visit hiyarrow.com. | Hosts the hiyarrow.com website and answers the address lookups for the app. Your conversations never pass through it. | Global network. | Processes visitor data on Yarrow’s behalf; does not sell it. |
Your browser’s speech recognition. When you talk to Yarrow, your browser turns your voice into text before anything reaches Yarrow. In Chrome this is done by Google; in Safari, by Apple, on your device or on Apple’s servers. This happens under your browser maker’s own privacy policy, and Yarrow receives only the text.
Names and details are not removed. Yarrow sends your words as you said them. It does not currently remove names or other personal details before sending them to the providers above. Yarrow never sends your email address to an AI provider. If you would rather not share something, such as a full name, an address or an account number, you can leave it out or use a stand-in.
How it is stored and encrypted
- In transit: everything between your device and Yarrow travels over encrypted HTTPS connections, as does everything between Yarrow and its providers.
- At rest: every file of your data is encrypted with AES-256-GCM before it is written to disk. Each person has their own randomly generated 256-bit key.
- Envelope encryption: your key is itself encrypted with a master key that is never stored on the disk; it is held separately as a secret of the server. A copy of the disk, a snapshot or a backup cannot be read without it.
- The honest limit: to talk with you and write your Book, the running server must decrypt your data, so it holds the master key while it runs. Encryption protects your data on disk and in backups; it does not stop the server itself from reading it.
Who can see your data
- You, when signed in. No other person using Yarrow can reach your data: each person’s data is kept and read only under their own sign-in.
- Yarrow’s server, automatically, to do its work.
- The service providers above, only as described.
- Yarrow’s team: as the operator, Yarrow technically could access the server. Our rule is that we do not read anyone’s conversations, Book or notes, except when you ask us to (for example, to help with a problem), when the law requires it, or to prevent serious harm. If we ever must, we will tell you unless the law forbids it. The admin view shows only email addresses, sign-in dates and usage counts, never content.
We will disclose data to authorities only when legally required, and we will push back on requests that are overly broad.
How long we keep it, and deleting it
- Your data is kept for as long as you have an account.
- You can move any conversation to the trash, and empty the trash to delete it.
- Very short conversations, kept in History rather than written up, are deleted automatically 30 days after the last thing said in them. You can also move one to the trash sooner.
- To delete your whole account and everything in it, email hello@hiyarrow.com from your account’s email address. We delete it within 30 days and confirm.
- After deletion, encrypted copies may remain in daily server snapshots for up to 5 days, and in providers’ abuse-monitoring logs for up to 30 days (OpenAI, Resend) or 55 days (Google), before they are removed.
- Sign-in codes expire after 10 minutes and are never written to disk.
Cookies and your device
Yarrow sets one cookie to keep you signed in (for up to 90 days if you choose “Keep me signed in”, otherwise until you close your browser), and one that records your time zone, so dates in your Book are your own. Your settings are kept in your browser’s storage. There are no advertising or analytics cookies, so there is nothing to opt out of; Yarrow responds the same way whether or not your browser sends a Do Not Track signal. Emails from Yarrow load their fonts from Google Fonts when you open them.
Your rights
Wherever you live, you can:
- See and take your data: the Book’s “Where all of this lives, and how to take it back out” page shows what is kept for you, and Usage shows how much, and we will send you a full copy on request.
- Correct it: rename entries and books, and edit your overviews, in the Book; or ask us.
- Delete it: as described above.
- Be free of selling and advertising: we do not sell or share your personal information for advertising, so there is nothing to opt out of.
- Not be treated differently for using any of these rights.
California residents have these rights under the California Consumer Privacy Act (as amended by the CPRA), including the right to know, delete and correct, and to limit the use of sensitive personal information; we use what you share only to provide Yarrow to you. To make a request, email hello@hiyarrow.com from your account’s email address so we can confirm it is you. We answer within 45 days.
Age
Yarrow is for people 18 and older, and everyone confirms this when they first sign in. It is not directed to children. If we learn that someone under 18 has an account, we will delete it and its data.
Not a medical or crisis service
Yarrow is a reflective companion, not therapy, medical advice or crisis care. If you are in danger or thinking of harming yourself, contact local emergency services or a crisis line straight away (in the US, call or text 988).
Where your data is
Yarrow and its storage are in the United States, and its providers process data in the United States (OpenAI possibly in other countries too). By using Yarrow, you understand your data is handled there.
If something goes wrong
If we learn of a breach that affects your data, we will tell you without undue delay, and as California law requires, with what happened and what we are doing about it.
Changes to this policy
When this policy changes in a way that matters, we update the version and date above, and Yarrow asks you to read and accept it again the next time you open it.
Governing law
This policy is governed by the laws of the State of California, USA.