yaven is a macOS assistant that helps you triage and reply to messages, drafts in your voice, and acts on your connected accounts only when you approve. This policy explains what data yaven processes and why. It covers both the yaven app and this website, yaven.ai.

Our approach in one line

yaven is local-first. Your emails, messages, drafts, and the profile it builds about you are stored on your own Mac. We do not upload them to our servers or sync them to a cloud. A small amount of data does live on our servers so that yaven's agents can work while your Mac is off; it is listed in full under “What we store on our servers” below, and most of it is there only because you chose to share it.

What data we process, and why

1. Content you ask yaven to act on — emails, messages, calendar events, and what is on your screen at the moment you press a yaven shortcut. This is stored locally on your Mac. When you ask yaven to draft a reply or answer a question, the relevant text and/or a single screenshot is sent for that one request to our AI provider (Anthropic) to generate the response, and to the relevant service through our integration provider (Composio) when you approve an action. iMessage is read only on your Mac and only ever leaves your machine as a draft you have approved.

2. Account connections — when you link Gmail or Google Calendar, the connection is held by our integration provider (Composio). We can see which services you connected, never their contents. Composio keeps a log of each call yaven makes through it, including what was sent and returned, for up to a year, so problems can be diagnosed; after that it is deleted automatically.

3. Usage analytics in the app — while yaven is in beta, analytics are on by default, because they are how we find what is broken and what nobody uses. You can turn them off at any time in Settings → Privacy, which stops collection and clears the local analytics identity. Events go to PostHog under a random identifier made for your install, never your name or email address. What we record: which features you use and how often (for example, opening yaven, a draft sent, a task started), how long things take, which app you were in when you used a writing shortcut, your app version, which permissions you granted, which kinds of tools you connected (such as Gmail or Slack, not which accounts), counts (such as how many cards were waiting), and what each AI request cost. We never record the content of your messages, emails, or drafts, or the names of the people in them.

Beta diagnostics.One exception, also on by default during the beta and switchable on its own in Settings → Privacy: when you ask yaven to do a task, we record what you asked in your own words, which steps it took, whether each worked, and how it ended, each cut to a short line. Anything yaven read to do the task (an email thread, a web page, your screen, your files) is never included. It stops whenever analytics are off. Our server records counts from your agents' runs under the same anonymous identifier, and sends none when analytics are off.

4. Technical data in transit — requests to our relay carry an account identifier so the correct account is used. The relay stores nothing; it only logs errors transiently for debugging.

5. Crash reports — if yaven crashes or freezes, a technical report (where in the code it happened, the app version, and the same anonymous identifier used for analytics) is sent to Sentry so we can fix it. Crash reports do not include your messages or emails.

What we store on our servers

Some of yaven's agents (such as Events, Market Intelligence, Socials, and Outreach's search for new leads) run on our server on a schedule, so they can work while your Mac is asleep. For that, our server keeps:

Your account — the email address you sign in with, when you last used yaven, your app version, and, if analytics are on, the anonymous analytics identifier.
Business pages you share— in yaven you can describe your business (what you offer, who your ideal clients are, your competitors). These pages stay on your Mac unless you share one with the agents; a shared page's text is stored so the agents can use it. Stop sharing a page and it is deleted from our server.
Agent settings and results— the settings of each agent you turn on, and what it found for you: public events, news stories, social posts, and potential leads, all from the public web. We also store what you did with each (for example, going or not relevant), and counts of what each run did. When you set yaven up, our server can read your business's public website or LinkedIn profile to draft your business pages.
Feedback you send — what you write, and the screenshot only if you leave it attached.
Corrections, only if you turn them on— “Improve yaven for everyone” is off by default. If you switch it on, the corrections you make (a draft you rewrote, a to-do you marked wrong, a reason you gave for turning something down) are sent with quoted email removed. We read them to improve yaven's instructions and tests, never to train a model. Switching it off deletes all of them.
Slack arrival notices — if you connect Slack, a notice that a new message arrived in a conversation (which conversation and when), so your Mac knows where to look. The message text is never stored.
Usage records — the cost of each agent run, so we can keep usage within limits.

Your emails, messages, calendar, documents, and the profile yaven builds about you are never stored on our servers.

The yaven website

Joining the waitlist. When you submit the form on this site we store your email address, and — if you fill them in — your name, your role, and whether you use a Mac. If you select them, we also store what you want help with and which features interest you, along with the page and audience associated with the form. We use these choices to decide which features to build and improve. We also store how you arrived: the campaign tags (utm_*) on the link you followed, the domain that referred you, the page you landed on, and, if you came through a referral link, the code that sent you. We use this to invite you when access opens, to email you product updates when a new version of yaven ships, to work out which channels bring people who actually want yaven, and to credit whoever referred you. Every update email has an unsubscribe link, and unsubscribing does not lose you your place on the waitlist. Your address is not sold. This data is held in our database (Supabase) and mirrored to a private spreadsheet as a backup.

Website analytics. We count how the site is used with PostHog: pages viewed, the campaign and referrer a visit came from, and the steps of the waitlist form — seen, started, submitted, succeeded, failed. The events record which form and which button, never what you typed. Your email address, your name, and any referral code are deliberately excluded from analytics, and referral URLs are stripped of their code before an event is sent.

Website analytics are anonymous: we do not identify visitors, and we do not build a profile of you or combine this with the app's analytics. We set no cookieson this site and run no advertising or cross-site tracking. PostHog stores a single random device identifier in your browser's local storage so that a return visit is not counted as a new person; you can clear it at any time through your browser's site data settings. Automatic click recording, session replay, and heatmaps are all switched off. If your browser sends a Do Not Track or Global Privacy Control signal, we collect nothing at all.

We rely on our legitimate interest in understanding how our own site performs, balanced against the minimal, non-identifying nature of what is collected. Waitlist details are processed to take the step you asked for — putting you on the list.

How yaven uses Google user data

yaven's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. When you connect a Google account, yaven requests only the scopes needed to read and triage your mail, draft and send replies you approve, and show your calendar. Specifically:

Gmail — to read messages for triage and summaries, and to create, save, and send the replies you approve.
Google Calendar — to show your upcoming events and your next-meeting countdown.
Basic profile (email, name) — to identify your account.

We do not use Google user data for advertising, we do not sell it, and we do not use it to train generalized AI or machine-learning models. Google user data is used only to provide and improve the user-facing features above, and is transferred to others only as needed to provide those features (our AI and integration providers, listed below) or with your consent.

Permissions yaven asks macOS for

Accessibility — to deliver the global shortcuts and type drafts into your reply boxes.
Screen Recording — so the draft and ask features can see what is on screen at the moment you press the shortcut. yaven does not watch or record your screen in the background.
Full Disk Access — only if you connect iMessage, to read your local Messages database on your Mac.
Notifications — for approval and completion alerts.

Who we share data with

We use a small number of processors, each handling data only for the purpose listed:

Anthropic — generates drafts and answers, and runs the agents. Inputs are not used to train models.
TypeSafe — makes quick judgments yaven relies on, such as whether an email needs a reply, from the text of your messages and, when yaven works on screen for you, a screenshot.
OpenAI— a backup for reading your business's public website during setup, if Anthropic is unavailable. Inputs are not used to train models.
Composio — brokers your account connections and relays approved API calls.
Cloudflare — hosts our stateless relay, which holds no API keys in the app and stores no request content.
Railway— hosts our server and its database, which holds the data listed under “What we store on our servers”.
Exa and Firecrawl — search and read public web pages for the agents and for setup. They receive search terms and public web addresses, never your mail or messages.
Sentry — crash and error reports from the app and our server.
Slack — delivers the feedback you send to our team.
PostHog — anonymous analytics for the app (only if you have not disabled it) and for this website.
Supabase — hosts the waitlist database holding the details you submit on this site.

We do not sell your personal data, and we do not use your messages to train AI models. Our processors are based in the United States; where personal data is transferred outside the UK/EEA, the transfer is covered by each provider's data processing agreement and Standard Contractual Clauses (or equivalent).

Keeping your Mac secure

What yaven learns lives in your user account's Library folder on your Mac, protected by macOS like your other files. Anyone using your Mac while you are signed in can open it, as they could your email. We recommend turning on FileVault (System Settings → Privacy & Security → FileVault), so everything on your Mac, including yaven's data, is encrypted whenever it is off or locked.

How long we keep data

Content and the context profile are stored on your Mac for as long as you keep yaven installed; removing the app removes the local data. Analytics events, if enabled, are retained by PostHog for the period set in our analytics configuration. Data on our servers is kept while you use yaven: a shared business page until you stop sharing it, corrections until you switch them off, and everything else until you delete your data in the app or ask us to. Relay logs are transient. Waitlist details are kept until you ask us to remove them, or until we close the waitlist and have finished inviting everyone on it.

Your choices and rights

Because most of your data lives on your own device, you can delete it directly: Settings → Delete all data erases everything yaven stored on your Mac and signs you out, and from version 1.7.21 it also deletes your account on our servers and everything stored with it. If our servers can't be reached at that moment, yaven tells you and lets you try again; you can also email us and we will delete it. To delete only some of it, stop sharing a business page or switch off corrections and those are deleted straight away. To revoke yaven's access to your Google account at any time, visit your Google Account permissions. Depending on where you live, you may have rights to access, correct, delete, restrict, port, or object to the processing of your personal data. To exercise any right that involves data held by our processors, contact us at the address below and we will respond within one month. To be removed from the waitlist, email us and we will delete your entry.

Children

yaven is not intended for anyone under 16.

Changes

We will post changes here and, for material changes, notify you in the app or by email.

Contact

Questions about this policy or your data? Email support@yaven.ai, or write to yaven, 169 Madison Ave STE 31950, New York, NY 10016.