Privacy Policy

1. Data Controller

Data controller:
YarnDraft Studio
Based in: Hungary
Contact email: [email protected]
Website: https://yarndraft.com

For privacy-related questions, contact us at the email address above.

2. Summary

YarnDraft is designed as a local-first desktop application.

By default, your YarnDraft projects are stored on your own device. Your stories, dialogue, flow charts, characters, variables, puzzles, notes, assets, exported files, and other project content remain under your control.

YarnDraft may process data locally on your device for application functionality, debugging, project editing, import/export, and configuration.

Data may leave your device only when you choose to use features that require external communication, such as update checks, support contact, AI provider integrations, MCP workflows, GitHub/GitLab/Azure sync, or other third-party integrations.

3. Scope of This Policy

This Privacy Policy applies to:

1. the YarnDraft desktop application;
2. YarnDraft installers, MSI packages, NSIS installers, and portable ZIP packages;
3. optional AI provider integrations configured by you;
4. optional MCP server or external editor/tool workflows;
5. optional GitHub, GitLab, Azure, or similar synchronization/version-control integrations;
6. update notification checks;
7. support emails, bug reports, logs, and other communications you send to us;
8. the yarndraft.com website, including the documentation published on it.

This Privacy Policy does not apply to third-party services that you choose to connect to YarnDraft. Those services are governed by their own terms and privacy policies.

4. Data Stored Locally by YarnDraft

YarnDraft may store or process the following data locally on your device:

1. project files and project metadata;
2. story flow data, dialogue, variables, entities, nodes, edges, assets, notes, and exports;
3. application settings and preferences;
4. recently opened project paths;
5. local cache files;
6. local debug logs and diagnostic information;
7. configured integration settings;
8. API provider configuration entered by you;
9. sync or repository configuration entered by you.

Project data is normally stored locally unless you choose to sync, export, send, or process it through a third-party service.

You are responsible for managing your own local files, backups, exports, repositories, and storage locations.

5. Debug Logs and Diagnostic Data

YarnDraft may create local debug logs or diagnostic files to help identify application errors, crashes, performance problems, import/export issues, sync conflicts, or unexpected behavior.

Depending on the issue and configuration, debug logs may include:

1. timestamps;
2. YarnDraft version;
3. operating system information;
4. error messages and stack traces;
5. file paths;
6. configuration details;
7. integration-related error messages;
8. limited contextual information about the operation that failed.

Debug logs may accidentally include project-related information, file names, folder names, or other data that could be personal, confidential, or sensitive.

Unless a future version clearly states otherwise, debug logs are stored locally on your device and are not automatically sent to us

If you choose to send logs to us for support, you should review them first and remove any confidential, personal, sensitive, proprietary, or project-specific information that you do not want to share.

6. Support Requests and Bug Reports

If you contact us for support, send feedback, report a bug, or submit logs, we may process the information you provide, such as:

1. your name or display name, if provided;
2. your email address;
3. the content of your message;
4. attached screenshots, logs, project samples, or crash information;
5. technical details needed to investigate the issue.

We use this information to respond to your request, investigate problems, improve YarnDraft, and maintain application security and reliability.

You should not send confidential project files, API keys, credentials, secrets, unpublished story content, or sensitive personal data unless it is necessary for the support request and you are comfortable sharing it with us.

7. Update Notifications

YarnDraft may check whether a newer version is available and may display an update notification.

An update check may involve a request to an official update endpoint or release source. Depending on the technical implementation and hosting provider, such a request may involve technical data such as:

1. IP address visible to the server or hosting provider;
2. YarnDraft version;
3. operating system or platform;
4. time of request;
5. user agent or similar request metadata.

YarnDraft does not automatically install updates unless a future version clearly states otherwise.

8. Optional Usage Analytics

YarnDraft has a setting called anonymous usage analytics. It is switched off by default, and nothing in this section happens unless you switch it on.

If you enable it, YarnDraft may send a small number of events to PostHog, hosted in the European Union:

1. first_launch, the first time the application runs;
2. app_opened, at most once per day rather than once per launch;
3. project_created;
4. project_opened;
5. export_completed.

Each event carries the application version, your operating-system platform string, your locale, and a randomly generated installation identifier kept on your own device. That identifier is not derived from your name, your email address, your hardware, or anything else about you, and it is linked to no account because there are no accounts. Clearing the application's local data produces a new one.

No project content is included: no story text, dialogue, character name, file name, folder path, repository address, or API key.

Release builds of YarnDraft are currently published with no analytics key configured, so no events are sent even when the setting is on. This section describes what would be sent if that changes.

9. AI Provider Integrations

YarnDraft may include optional AI-related features that allow you to connect external AI providers using your own API keys, credentials, endpoints, or accounts.

If you configure an AI provider and use an AI feature, YarnDraft may send selected data to that provider as needed to perform the requested action. This data may include:

1. prompts written by you;
2. selected dialogue, story text, node data, project context, or summaries;
3. instructions, settings, or generation parameters;
4. metadata needed to process the request.

You decide whether to enable AI features, which provider to use, which API key to configure, and what project data to send.

We are not responsible for the data handling, pricing, output, availability, retention, training practices, or security of third-party AI providers. You should review the privacy policy, terms, data-processing rules, and pricing of any AI provider you connect.

You are responsible for protecting your own API keys and monitoring any usage or costs incurred through your own provider accounts.

10. MCP Server and External Tool Workflows

YarnDraft may include or support MCP server functionality or integrations with external tools, editors, agents, plugins, scripts, or automation systems.

When you enable MCP or external tool workflows, project data may be made available to the connected tool according to your configuration and the permissions of that workflow.

Depending on how MCP or external tools are configured, they may be able to read, write, modify, transmit, or process project files and related metadata.

You are responsible for deciding which tools to connect, what permissions to allow, and whether those tools are trustworthy.

11. GitHub, GitLab, Azure, and Other Sync Integrations

YarnDraft may support synchronization or version-control workflows using external services such as GitHub, GitLab, Azure, or similar providers.

If you enable these integrations, your project files, repository data, commits, branches, metadata, account information, access tokens, or related content may be transmitted to and stored by the selected third-party service.

Your use of those services is governed by their own terms and privacy policies.

You are responsible for:

1. repository permissions;
2. access tokens and credentials;
3. branch and commit history;
4. repository visibility, including public/private settings;
5. sync conflicts;
6. backups and recovery.

12. API Keys, Access Tokens, and Credentials

YarnDraft may allow you to enter API keys, access tokens, repository credentials, or other integration credentials.

These credentials are used to connect to the services you configure. They should be treated as confidential.

In the desktop application, API keys and integration secrets are written to your operating system's own credential store — Windows Credential Manager — under the service name app.yarndraft.desktop. They are stripped from the saved application settings rather than being kept in both places.

You should still protect your device account, file system, and backups: anything that can read your operating-system credential store can read those secrets.

You should revoke and regenerate any API key or access token that you believe may have been exposed.

13. The yarndraft.com Website

Analytics. The website uses PostHog, hosted in the European Union, in its cookieless mode. It sets no cookies, builds no visitor profile, and records no sessions. It counts page views and which page they were on. Because nothing persistent identifies a visitor, a returning reader cannot be recognised as the same person.

Downloads. The download links are counted. What is stored is a running total per platform and nothing else — no address, no identifier, no timestamp; the table has two columns, the platform name and a number. The request's user-agent string is read in order to decide whether the request looks like a crawler rather than a person, and it is not stored.

Hosting. The website is served by Cloudflare Pages. Cloudflare acts as our hosting and network provider, processes requests in order to serve them, and keeps its own operational logs, which may include IP addresses, under its own terms.

Email. Mail sent to [email protected] is delivered by Cloudflare Email Routing to a Gmail mailbox we operate, and replies are sent through Resend. Those providers handle the message in transit under their own terms.

Cookies. The website sets no cookies of its own, and at the time of writing serves no Set-Cookie header at all.

14. Legal Bases for Processing

Where the GDPR or similar data protection laws apply, our legal bases may include:

1. performance of a contract or steps requested before entering into a contract, such as providing the Software, license terms, support, and updates;
2. legitimate interests, such as improving YarnDraft, diagnosing bugs, maintaining security, preventing abuse, and responding to support requests;
3. consent or user action, where you choose to enable optional integrations, send logs, connect external services, or use AI features;
4. compliance with legal obligations, where applicable.

15. Data Sharing

We do not sell your personal data.

We may share data only in the following situations:

1. with third-party services you choose to connect, such as AI providers, GitHub, GitLab, Azure, MCP clients, or external tools;
2. with service providers that help us operate official websites, downloads, updates, email, support, or infrastructure;
3. when you send data to us voluntarily, such as logs, bug reports, or support attachments;
4. where required by law or necessary to protect legal rights, security, or users.

16. International Transfers

If you choose to connect third-party services, your data may be transferred to countries outside Hungary or the European Economic Area, depending on the provider and its infrastructure.

For example, AI providers, Git hosting providers, cloud services, and support platforms may process data in other countries.

You should review the privacy and data-transfer terms of any third-party provider you connect to YarnDraft.

17. Data Retention

Local project data, settings, logs, caches, and exports remain on your device until you delete them, uninstall YarnDraft, clear application data, or remove the relevant files.

Support emails, bug reports, and voluntarily submitted logs may be retained for as long as needed to respond to your request, resolve issues, improve YarnDraft, maintain records, and comply with legal obligations.

If you want us to delete support data you previously sent to us, contact us at [email protected]. We may need to retain certain information where required by law or where necessary for legitimate legal or security purposes.

18. Your Rights

Depending on your location and applicable law, you may have rights regarding your personal data, including:

1. the right to be informed about processing;
2. the right to access personal data;
3. the right to request correction of inaccurate or incomplete data;
4. the right to request deletion of personal data;
5. the right to request restriction of processing;
6. the right to object to certain processing;
7. the right to data portability where applicable;
8. the right to withdraw consent where processing is based on consent.

To exercise your rights, contact us at [email protected].

Because YarnDraft is local-first, many project files and local logs are controlled directly by you on your own device. You can delete local project files, logs, exports, caches, and settings directly from your device.

If you believe that your data protection rights have been violated, you may also have the right to contact the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) or another competent supervisory authority.

19. Children

YarnDraft is not specifically directed to children. We do not knowingly collect personal data from children through the Software.

If you believe a child has provided personal data to us, contact us so we can review and delete it where appropriate.

20. Security

We use reasonable technical and organizational measures to protect data that we receive.

However, no software, local storage system, network transmission, third-party integration, or cloud service can be guaranteed to be completely secure.

You are responsible for protecting your own device, operating-system account, project files, backups, repositories, API keys, access tokens, and connected service accounts.

21. Your Responsibilities

You are responsible for:

1. choosing what data to include in YarnDraft projects;
2. deciding which integrations to enable;
3. protecting API keys, access tokens, and credentials;
4. reviewing logs before sending them to us;
5. managing backups;
6. reviewing third-party terms and privacy policies;
7. ensuring you have permission to process any third-party personal data included in your projects.

22. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

The updated version may be included with a new release of YarnDraft or published on an official website or release page.

The "Last updated" date will indicate when the document was last changed.

23. Contact

YarnDraft Studio
Hungary
Contact email: [email protected]
Website: https://yarndraft.com