Privacy Policy

This policy covers the Yocrow website at yocrow.dev, the Yocrow dashboard and the Yocrow software you install on your device. In this policy, “Yocrow”, “we” and “us” refer to the operator of the Yocrow service.

Yocrow connects your AI agent to the official MCP servers run by providers such as GitHub, Linear and Notion. Those providers are independent companies with their own privacy policies, which apply to any information they receive from you.

Yocrow is designed so that the most sensitive information never reaches our servers. The following stays on your device.

• Provider credentials. Sign-in tokens and access tokens for your providers are stored in your operating system’s secure storage, such as macOS Keychain or Windows Credential Manager.
• The content of agent calls. The requests your agent sends to a provider and the results it receives travel directly between your device and that provider.
• Your connected provider settings. The access level you chose for each provider is stored in files on your device that only your user account can read.

We collect only what is needed to run your account and the service.

• Account details. Your name, email address, profile image and account identifier, received from the sign-in method you use.
• Companion Keys and devices. For each key you issue we store a one-way fingerprint that can verify the key but cannot recreate it, together with when it was issued, used or revoked. For each signed-in device we store its name, operating system, processor type, Yocrow version and when it was last active.
• Connected providers. Which providers your account has connected, so that plan limits can be applied.
• Agent call records. For each call your agent makes through Yocrow we record the time, the provider, the action name, whether the action reads or changes data, whether approval was required, whether it succeeded, the reason for any failure and how long it took. We also store a one-way fingerprint of the request, which cannot be turned back into the request and is never shown. We never record the request itself, the result or any credential.
• Account activity. Security events such as Companion Keys being issued or revoked and devices being signed out. These appear in audit logs on paid plans.
• Billing details. Your customer identifier and subscription status. Payment card details are collected and held by our payment provider and are never visible to us.
• Error reports. Technical details of errors in our service, with credentials and personal details removed before they are sent.

We use the information above to

• sign you in and keep your account secure
• sign in your devices and verify that requests come from them
• show your agent call history and audit logs in the dashboard
• apply the limits of your plan and process payments
• find and fix errors in the service
• respond when you contact us

We do not sell your information, use it for advertising or use it to train AI models.

We share information only with the companies that help us run Yocrow, and only for the purpose listed.

• Clerk provides sign-in and account management.
• InsForge hosts our database and backend.
• Dodo Payments processes payments as the merchant of record, which means it is the seller on your invoice and handles taxes and card details.
• Umami counts page views and a few button clicks without cookies or personal data, so we can see where visitors leave.
• Sentry receives error reports with credentials and personal details removed.

We may also disclose information when the law requires it, or to protect the rights, safety or property of our users or of Yocrow.

The website uses cookies only where they are required. Sign-in cookies keep you signed in to the dashboard, and our payment provider uses cookies during checkout. Our analytics (Umami) is cookieless, and we do not use advertising cookies.

Agent call records are shown for the period your plan includes, which is seven days on Free and thirty days on Basic. Records older than that period are no longer shown. We keep account information for as long as your account is open.

When you ask us to delete your account, we delete your information from our systems within 30 days. The only exception is information the law requires us to keep, such as billing records kept for tax purposes.

You can manage your information at any time.

• Revoke Companion Keys from the dashboard.
• Sign out a device and remove every provider connection on it by running yocrow logout.
• Disconnect a single provider on your device by running yocrow disconnect followed by the provider name.
• Update your name, email address and sign-in method from the account menu in the dashboard.

You can also ask us for a copy of your information, ask us to correct it or ask us to delete it by emailing connect@yocrow.dev. Depending on where you live, you may have further rights under local law, including the right to complain to a data protection authority.

All traffic between your device, the dashboard and our servers is encrypted. Companion Keys and device credentials are stored only as one-way fingerprints, so a copy of our database would not reveal them. The list of providers your device can connect to is digitally signed, so your device only connects to provider servers we have approved.

No system is completely secure. If we learn of a breach that affects your information, we will notify you as the law requires.

Our service providers may process information in countries other than the one you live in. Where that happens, we rely on the safeguards those providers offer for international transfers.

Yocrow is not intended for anyone under 16, and we do not knowingly collect information from children.

We will update this policy when our practices change and will change the date at the top of this page. For significant changes, we will notify you by email or in the dashboard before they take effect.

Questions about this policy or your information can be sent to connect@yocrow.dev.