# YBee Privacy Policy

The [full Privacy Policy](https://ybee.app/privacy.html) is the authoritative document describing how YBee handles personal data, communications, app creation data, publishing, and privacy rights.

## Key Summary

- **Account Data**: We process contact and authentication identifiers (such as email and user IDs). Password credentials and login tokens are managed securely through identity providers (Firebase Authentication) and are never received or stored in plaintext by YBee.
- **Offline-First App Building**: Natural language app creation runs locally on your device, prioritizing user privacy and reducing unnecessary cloud exposure.
- **AI Processing**: YBee may change or route between AI models, API aggregators, and providers. Depending on their terms, configuration, and available privacy controls, providers may retain or use prompts, generated output, or technical metadata for safety, service improvement, or model training; YBee cannot guarantee universal zero-retention or no-training treatment.
- **YBee Model Training**: YBee may use irreversibly anonymized or aggregated data to evaluate and train its systems. YBee does not use identifiable or pseudonymized prompts, projects, feedback, or generated output to train its own models.
- **Published Apps**: When you choose to publish an app to a public URL (`open.ybee.app`, `{slug}.ybee.here.now`, or `ybee.app`), the app assets are hosted to enable web access. Creators are responsible for any personal data their published apps independently collect.
- **Push Notifications & Device Tokens**: If you grant permission, we collect push notification device tokens (via Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM)) and device platform metadata to deliver operational and transactional notifications (such as build completions and publishing updates). You can disable notifications anytime in your device settings, and signing out unregisters your device token.
- **Reports & Safety**: Under EU DSA Article 16, reporting illegal or policy-violating content allows optional reporter identity. Name and email are not mandatory to file a report, though email is recommended if the reporter wishes to receive status updates.
- **Legal Bases**: We process data under lawful bases including contract performance, compliance with legal obligations, legitimate interests in platform safety and abuse prevention, or explicit consent where requested.
- **Your Rights**: Users can request access, correction, data export, or account deletion at any time via [delete-account.html](https://ybee.app/delete-account.html).

For privacy inquiries or exercising your rights, contact [privacy@ybee.app](mailto:privacy@ybee.app).