Privacy policy

Who is responsible

yof is provided by Mondaily Ltd (placeholder: the company is being registered in the United Kingdom). Company number: to be added after registration in England and Wales. Registered address: to be added after registration.

Mondaily Ltd is the controller of your account data. For the personal data inside your repositories, sites and databases, we act as your processor (see the DPA). Privacy questions and requests: privacy@yof.io. Anything else: support@yof.io.

Your account

• Email address, and a one-way hash of your password if you choose one (we never store the password itself).
• Sign in with GitHub: your GitHub id and primary verified email. The token GitHub gives us is used once and not stored.
• Sign in with Google: your name, email address, Google account id and profile picture.
• Sign in with Microsoft: your name, email address and Microsoft account id. yof asks Microsoft only for these (openid, email, profile), never for your mail, calendar or files.
• Passkeys, if you add one: the public key only.
• For each signed-in device: the browser's description, the IP address and when it was last active, so you can see and end your sessions. At sign-up we keep a one-way hash of the IP address and network to stop mass sign-ups.

Google sign-in

yof uses Google only to sign you in. When you choose Sign in with Google, yof receives your name, email address, Google account id and profile picture, and uses them only to create your account and sign you in. yof never asks for access to your Gmail, your Google Calendar or any other Google data. It never sells what it receives from Google, never uses it for ads and never uses it to train AI models.

yof's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Google API Services User Data Policy
• Limited Use requirements

Your apps, checks and findings

• For each app: its address, how you proved it is yours, and your settings (daily watch, badge, language). If you set up the AI assistant test, its address and, encrypted, the header it needs.
• For each check: the status, score and findings. Findings show where a problem is with secrets masked. The proof yof keeps lists paths, table names, header names and DNS names, never the content of your pages.
• The free check on the yof.io home page needs no account and stores nothing. To stop abuse it is limited per IP address and per site, and a result is cached in memory for 10 minutes.
• Website checks in a cloud browser run on AWS in Frankfurt and only for proven sites. Its error logs, which can include the site address, are kept 14 days.

GitHub, Guard and Patch

• Guard reads the changed files of a pull request. yof keeps the review's facts (repository, pull request number, commit, status, number of findings), never your code.
• Patch reads the linked repository (up to 400 files, 8 MB). It sends package names and versions to OSV to look up known vulnerabilities, and keeps a summary of each run and the list of packages.
• When Patch writes a fix with its AI model, yof keeps that change (up to about 30 KB). After you merge it, a copy is kept to make future fixes better, until you delete your account. Patch's model is run by us on AWS in Frankfurt; no outside AI company receives your code.
• If you connect a database for Patch, the connection string is stored encrypted and accepted only after yof proves the account is read-only. yof runs only fixed catalog queries and never reads your rows.

Orders and reports

• Orders: the products, amounts, your email address and Stripe's payment references. Card details go straight to Stripe.
• Delivered report files are stored for you. Each report's id and hash are listed in the public register; the public check page shows the product, date, scope and score band by default, and you choose what else, if anything, it shows.
• Trust pages are off unless you publish one, and show only what you select.
• Affiliates: your code, payout email, payout method, tax country and accepted terms, kept to pay commissions.

Support and the yof chat

The yof chat answers from your own apps and findings. If you ask for a person, we open a support ticket with your message and reply by email.

If you write to us with the contact form on yof.io, we keep only what you send (your name, email, company if you give one, and your message) to answer you by email, for two years from the day it arrives, and then delete it. It is not linked to any analytics id.

The CLI and editor extensions

The yof CLI and the VS Code and JetBrains extensions send no telemetry. The CLI looks up package names and versions at npm, PyPI and OSV unless you pass --offline; in the extensions these lookups are off until you turn them on.

Analytics

On yof.io nothing is measured until you accept in the privacy banner (see the Cookie policy). In the yof app, page views and a heartbeat are measured as part of running the service and linked to your account; Do Not Track, Global Privacy Control or the “Do not measure my use of the app” switch in your account settings turn this off. IP addresses from the website are kept 7 days, individual events 90 days.

Why we use your data, and on what legal basis

• To provide yof: checks, reports, Guard, Patch and support: needed for our contract with you (GDPR and UK GDPR Art. 6(1)(b)).
• To bill paid orders and keep tax records: a legal duty (Art. 6(1)(c)).
• To keep yof secure and stop abuse: rate limits, sign-in protection, logs, the sign-up checks: our legitimate interest, which we have weighed against your rights (Art. 6(1)(f)); you can object.
• To keep a copy of fixes you merged, so future fixes get better: our legitimate interest, which we have weighed against your rights (Art. 6(1)(f)); you can object.
• To measure the app so it works and stays fast (page views and a heartbeat, switched off by Do Not Track, Global Privacy Control or the switch in your account settings): our legitimate interest, which we have weighed against your rights (Art. 6(1)(f)); you can object.
• Website analytics on yof.io and product news by email: your consent (Art. 6(1)(a)), which you can withdraw at any time.

Who helps us

The providers that process data for yof, what each receives and where, are listed on the Subprocessors page. Each works under a written agreement that limits it to our instructions. We never sell your data.

Where your data goes outside the UK and the EU

yof's database and the machines we run are in Frankfurt, Germany (EU). The encrypted backup copy is in Switzerland, which the EU and the UK both recognise as giving adequate protection.

Some providers on the Subprocessors page choose their own region and may process data in the United States or another country. For those transfers we rely on one of these safeguards:

• an adequacy decision: for the United States, the EU and US Data Privacy Framework and its UK Extension, where the provider has joined it;
• otherwise the European Commission's standard contractual clauses (Decision (EU) 2021/914), with the UK's International Data Transfer Addendum for data from the UK;
• for data from Saudi Arabia, the United Arab Emirates, Qatar, the DIFC or ADGM, the transfer rules of those laws, which allow transfers to countries with adequate protection or under appropriate safeguards such as these clauses.
• You can ask for a copy of the safeguard that covers a provider: write to privacy@yof.io.

How long we keep it

• Deleting an app removes its checks and findings at once.
• Deleting your account closes it after a 14-day window in which you can restore it. After it, yof erases your apps, checks, findings, watch history, Guard and Patch records, Patch's kept copies of your fixes, stored database connections, deploy hooks, trust pages, report settings and unused credits, and removes the yof GitHub App from your own GitHub account. An installation on an organisation, or one another account also uses, is left for them to manage. A read-only database role you made for Patch stays in your database until you remove it.
• Some records are kept after that, without your name, email or account: paid orders (products, amounts, dates and Stripe's references) as long as tax law requires; for each issued report, its id, hash, issue date and signature in the public register, so a copy someone holds can still be checked (the report itself and its files are erased); and for each attack test, the consent and the site it covered, as proof the test was allowed.
• An unpaid order is released after 24 hours. Paid order records are kept as long as tax law requires.
• Invoices, payments and the records tax law needs are kept for 6 years after the end of the financial year they belong to (UK company and VAT law), then deleted. Support messages are kept for 2 years after the conversation ends.
• Database backups are kept 30 days (AWS, Frankfurt) and 35 days (encrypted copy, Switzerland).

Your rights

You can ask to see your data and get a copy, correct it, erase it, restrict how we use it, take it with you in a common format, and object to how we use it. You can always object to direct marketing, and we then stop. Where we rely on your consent you can withdraw it at any time; that does not affect what was done before. Write to privacy@yof.io.

It costs nothing. We answer within one month, or tell you within that month if we need up to two more months for a complex request. We may ask you to confirm who you are first, and we use that only to answer you.

You can complain to a data protection authority at any time. In the UK that is the Information Commissioner's Office (ico.org.uk). In the EU it is the authority in the country where you live or work, or where you think the problem happened. In Switzerland it is the Federal Data Protection and Information Commissioner. In the United Arab Emirates it is the UAE Data Office, in Saudi Arabia the Saudi Data and AI Authority (SDAIA), in Qatar the National Data Privacy Office, and in the DIFC or ADGM their own Commissioner. We would like the chance to help first, but you do not have to ask us before you complain.

Automated decisions

yof makes no decision about you based only on automated processing that has a legal effect on you or affects you in a similarly significant way. yof's scores and findings are about apps and code, not about people. Automated checks do run on accounts: sign-up abuse checks and rate limits. They can block an action, but a person reviews it if you ask.

If you think an automated step got something wrong about you, write to privacy@yof.io and a person will look at it.

When you talk to an AI

yof uses AI. When you chat with it, it is clear that you are talking to an AI, not a person. Patch's AI model runs on our own machines; its fixes reach your code only as pull requests you review.

AI answers can be wrong. Check an answer before you rely on it, especially for anything legal, financial, medical or about safety.

Emails we send you

We send emails you need to use yof: sign-in, security, receipts, trial and renewal reminders, and changes to these terms. You cannot switch these off while you have an account.

We send news about our products only if you said yes, or, if you are a customer, about similar products of ours, with a way to say no when you signed up and in every message. Every such email names us, has our postal address once the company is registered, and has a one-click unsubscribe link that works for at least 30 days. We stop within 10 business days at the latest, usually at once.

Children

yof is not meant for children. You must be at least 16, or older where the law where you live sets a higher age, to create an account. We do not knowingly collect data from children under 13, or under 16 in the EU and the UK. If we learn that we have, we delete it. If you think a child has given us data, write to privacy@yof.io.

If you live in the United States

This part is our notice at collection under the California Consumer Privacy Act and the similar laws of other US states.

What we collect, by the categories those laws use: identifiers (name, email address, account ids, IP address); commercial information (orders and payments); internet activity (pages viewed in the app, sign-in sessions); approximate location (country, region and city from our hosting provider); professional information (your apps, repositories and the findings about them); sensitive information: account sign-in details only. We collect it from you, from your use of yof, and from the services you choose to connect. We use it only for the purposes in this policy and keep it for the periods under How long we keep it.

We do not sell personal information and we do not share it for cross-context behavioural advertising, and we have not done so in the last 12 months. We do not knowingly sell or share the data of anyone under 16. We use sensitive data (your sign-in details, and the content of messages you keep with us) only to provide the service, so there is nothing to limit. We do not target ads or profile people for decisions with legal effects.

Your rights: to know what we collect, use and disclose, to get a copy, to correct it, to delete it, and to opt out of sale, sharing and targeted advertising (we do none of them). Your browser's Global Privacy Control signal is honoured as an opt-out. We will not treat you differently for using these rights. Write to privacy@yof.io; yof works online only, so email is how requests come in. An authorised agent can write for you with your signed permission, and we may ask you to confirm it. We answer within 45 days.

If we turn down your request, you can appeal by replying to our answer. We decide within 60 days and explain why. If you are still not satisfied, you can contact your state attorney general.

If you live in the United Arab Emirates, Saudi Arabia or Qatar

The rights above also cover what the UAE Personal Data Protection Law, the Saudi Personal Data Protection Law and Qatar's Law No. 13 of 2016 give you: to be told how your data is used, to see and get a copy of it, to correct, complete or update it, to have it destroyed when it is no longer needed, to restrict or stop its use, and to object to decisions made only by automated processing. Write to privacy@yof.io.

Your data is stored outside your country (see Where your data goes), with the safeguards described there. We do not use your data for any purpose other than the ones in this policy without telling you first and, where the law asks for it, getting your consent.

If you are a business in the DIFC or ADGM and we process personal data for you, our Data processing agreement includes the processor commitments those laws require.

Changes to this policy

When we change this policy in a way that matters, we tell you by email or in yof before the change applies, and the date at the top changes. If a change needs your consent, we ask for it.