Your memories are your own. Period.

We only collect what is necessary to run the service. This includes your email for your account, your shipping address for book delivery, and technical logs (like your IP address) used for security and fraud prevention. Payment information is handled exclusively by Stripe; we never see or store your credit card details. Your content, including photos, voice reflections, and signatures and handwriting/drawings, is encrypted before it ever reaches our servers, and stays encrypted at rest. The exception is when your finalized pages are decrypted to generate a PDF, either to produce your physical book or when you request a digital export. That decrypted PDF is stored temporarily on our servers, up to 30 days after your book is first finalized, or 14 days if you request a fresh export later, before it's automatically and permanently deleted.

We use your data to generate your monthly reflection prompts, layout your yearbook, and print your physical book. When you authorize AI features, most processing uses temporary keys that are destroyed immediately after use. Reflection prompt generation is optional: it only runs when you tap to request one, never automatically. When you do, the relevant decrypted text is briefly sent to our servers and our AI provider to process it, then the result is re-encrypted before saving.

You are in control of your personal data. Because yeerbook uses zero-knowledge encryption, we do not hold your master decryption keys and cannot decrypt your memories on our servers. Under applicable privacy laws (such as GDPR and CCPA), you may contact support for a copy of your account metadata: information like your account details and order history that isn't part of your encrypted content. To access your fully decrypted memories, you can request a digital PDF export of a finalized yearbook from your authenticated dashboard. Only one export can be generated at a time. If one is already processing or available, you'll need to wait for it to complete or expire before requesting a new one. Once generated, your PDF is available for download for 14 days, after which it's automatically and permanently purged from our servers. You may also delete your account at any time from your account settings. Your account and content become inaccessible immediately and are fully purged, including from backups, within 30 days.

We never use your personal memories, photos, or voice reflections to train AI models. Your data is used exclusively to provide the yeerbook service to you. We believe your history should belong to you, not an algorithm.

We never sell your data, and we never show ads. Yeerbook is paid for by the people who buy a book, not by advertisers. We do not share your content or personal data with advertisers or data brokers. The partners listed below process data only to run the service.

Because we do not hold your master keys, we cannot recover your data if you lose your password. To protect against this, we provide you with a high-entropy Recovery Phrase. This phrase acts as a secondary master key that only you possess. We recommend storing it in a physical, secure location (like a safe or a password manager). Without either your password or this phrase, your memories are cryptographically lost forever.

We believe in a clean web. We do not use cross-site tracking cookies. We only use essential session cookies to keep you logged in and functional.

While your free trial runs and afterwards, we keep your encrypted content so you can come back to it. If you do not sign in, purchase, or redeem a credit for 12 months, we may delete the content of your yeerbook, and we will email you before we do. You can delete your account and all of its content at any time from your settings.

When an owner makes a group yeerbook, we collect each member's name and email address, when they confirmed it, which version of these terms they agreed to, and a one-way fingerprint of their IP address. We use these only to run the book (emails asking for their memories and telling them when there is something new, letting them in, letting the owner manage the list). Members of the same group yeerbook can see each other's names: the book has a list of the full names of everyone in it, with the owner first, and it never shows email addresses. Members can unsubscribe from emails at any time with one click, can download everything they added, and can leave at any time with or without deleting what they added. As with any signer, signing also creates an unclaimed account and a saved copy of what they signed under the email address they joined with, so they can claim it later; contact support to have that copy removed. Buying a printed copy of a finished book also creates an unclaimed account under the buyer's email address if they do not have one, and the shipping address entered at checkout is saved on it. That address stays on the account until the account is deleted, and a member can claim the account at any time by choosing Forgot password on the sign-in page. Payment for a printed copy is handled by Stripe, so we never see card numbers, and the name and shipping address are shared with our print and shipping partner only to make and deliver that copy. Group books are protected differently from personal books: the content is still encrypted before it is stored, but to let members read the book without a password we keep a shared key for the book on our servers, protected by our own encryption key. This means the personal-book statement that a database leak leaves your data safe does not apply to group books, and anyone holding a member's personal link can read that book. When the owner removes someone, we change the shared key so an old copy of it stops opening stored content, but we cannot recall anything that person already saw. The name of a group book is also kept readable on our servers, so we can put it in the emails and on the invite page. We use Resend to send these emails.