Privacy Policy

1. Overview#

Yardmaster (the "App") is a desktop application published by Bold Arrow Group, LLC ("the Company," "we," "us," "our"), a North Carolina limited liability company. Yardmaster helps you run and manage AI coding agents on your own computer. The "Services" means the App and the related services described in our Terms of Service (the "Terms"): phone and browser access to the App, the Share pages we host, our websites, and our cloud services.

Yardmaster keeps most of your data on your computer. Your projects, agent sessions, the full text of your conversations, local cost tracking, settings, and any API keys you provide are stored on your own device and are not uploaded to us, except for the features described in Sections 4 to 6.

A limited set of data is handled in the cloud so we can run your account, keep your sign-in secure, host the Shares you publish, deliver the optional features you turn on, receive feedback you send us, and collect error reports and usage numbers. This policy explains both.

This policy also covers people who open a Share without a Yardmaster account (see "If you view a Share" in Section 4).

Where you are. The Services are offered only to people in the United States, and this policy is written for US users. We do not offer the Services in other regions today. If we ever do, we will provide terms for that region first.

2. Data stored locally on your device#

Stored in a local database (yardmaster.db, in your operating system's application-data folder) and a local configuration file, and not sent to the Company except as described in Sections 4 to 6:

• Sessions and conversations: your agent sessions and full message history (prompts, agent responses, system messages, attachments).

• Projects: names and local folder paths.

• Costs and usage (local): per-session AI cost and token estimates and a local cost log (see Section 6 for the numbers that leave the device).

• Automations, schedules, and saved prompts.

• Channels and integrations you connect (for example SMS, Slack, RSS, webhooks, and email): their message history and settings.

• Notes and knowledge, settings, and credentials (Section 3).

• Local logs: diagnostic logs and a local crash log for troubleshooting. They stay on your device unless you choose to send them with a report (Section 6).

• Settings search history: the words you type into Settings search, kept on your device for up to 365 days.

You can delete local data in the App and remove the App's data folder. Uninstalling the App does not remove its data folder; delete that folder yourself if you want the local data gone.

3. Credentials and API keys#

• API keys and sign-in tokens you provide are stored locally and encrypted at rest using your operating system's secure storage (Windows DPAPI, macOS Keychain, or Linux libsecret), with an encryption marker on the stored value.

• If your operating system's secure storage is not available, the App still saves your keys so it keeps working, but saves them as plain text in its local configuration file, where anyone using your computer account could read them. The App shows a warning at start when this happens.

• Keys are decrypted only in the App's main process to make the requests you direct; they are removed before reaching the App's interface layer and are not uploaded to the Company's servers.

• Keys you bring ("bring your own key") are used only to authenticate the requests you start with that provider, and (when you ask the App to check a key) are sent directly to that provider, never to a Company server.

4. Data we handle in the cloud#

When you use features that need our backend (Google Firebase and Google Cloud), we process a limited set of data:

• Account and identity: user ID, email address, display name, profile picture, the sign-in provider you used (Google or GitHub), your plan label, and, for shared workspaces, your workspace and role. We also keep access requests and invitation records, which are keyed by email address.

• No payments. The Services are free today and we do not collect payment details; before any paid plan launches, we will update this policy and the Terms and give you notice.

• Usage numbers (identified): while you are signed in, the App sends a numbers-only usage report about every 20 minutes (the first about one minute after start). It is keyed to your account, so it is identified, not anonymous. Section 6 lists what it contains. The raw local cost log stays on your device.

• Feedback and problem reports: if you send feedback or a bug report, or use a one-click "report this problem" button, we receive what you wrote, any screenshots you attach, recent errors and app details, together with your account ID and email address. Reports are stored in Google Firebase (screenshots in Google Cloud Storage) and deleted automatically after 180 days. A copy is emailed to the Company's team through Cloudflare's email service.

• Shares you publish: when you publish a Share (a page made from your work), its content and files are stored and hosted in the cloud. You choose who can open it: anyone with the link, anyone with a password, or only people signed in with Google who use an email domain or an email address you name. Choose access with care.

• Share comments: if you turn comments on, anyone who can open the Share can read the comments, whether or not they are signed in. On password or Google-protected Shares, a reader must pass the same check first. Posting a comment requires Google sign-in.

• Agent email: if you use the agent-email feature, email sent to your agent's address is received by Cloudflare, queued in our cloud until the App collects it, and deleted after 90 days at the latest.

• Phone notifications: if you pair a phone, notifications the App sends to it pass through Google Firebase Cloud Messaging (a global Google service). They can include a session name, an SMS sender, preview and phone number, or an email sender and subject.

Sign-in security. Each time the App checks in with your account, we look up the country and region of your internet address using a location database we run ourselves (no outside service is asked). We keep your current country and region, and the list of countries you have signed in from, for the life of your account, so that we can tell when a sign-in comes from a new country. When that happens, we email you a security notice (at most three a day).

We also keep a dated sign-in history entry (about once a day, or whenever the country changes). It stores the country, the region and a salted, one-way hash of your internet address, never the address itself. Each entry is marked for deletion after 90 days, but the automatic clean-up that removes old entries is not running yet, so until it is, entries can be kept longer. They are all deleted when you delete your account, and you can ask us to delete them sooner.

This is a security feature, so there is no setting to turn it off. If you do not want it, you can stop using the Services and delete your account (Section 9).

Knowledge capture (off by default). Yardmaster can build a searchable store of facts from your work, either for a shared team workspace or for you alone. It is off unless you turn it on for a project. When it is on, after each finished session the App sends up to 12,000 characters of the session's text to Anthropic (a Claude Haiku model) on your own Claude sign-in or API key, which pulls out short facts.

Those facts are stored in the Company's knowledge store (Google Cloud SQL in the United States), with search data made by Google Vertex AI. Team facts can be seen by everyone in that team workspace. Before sending, the App tries to remove secrets such as keys and passwords, but this filter is best-effort and only catches known patterns; a password written in ordinary words can reach Anthropic and can be stored.

Notes about other people. If you also turn on notes about people (off by default), the store can hold notes about your colleagues, who have not agreed to this policy. Only record what you would be comfortable with that person seeing, and never record sensitive details about them, such as health, money or private life. Anyone who learns that we hold notes about them can ask us to delete those notes by emailing legal@yardmaster.io.

Facts are kept until they are deleted. Deleting your account does not delete them (Section 9), but you can ask us to delete the facts you added by emailing legal@yardmaster.io.

Cloud backup and sync (if you turn them on). If you turn on cloud backup or cross-device sync, the App uploads your backup or sync files to Google Cloud Storage. The App encrypts these files on your computer before they are uploaded, with a key we do not have, so we cannot read what is in them. We keep only your latest cloud backup, until you replace it or delete it in the App. Sync files stay in the cloud until we delete them at your request.

Deleting your account does not delete your cloud backup or sync files today. Delete your backup in the App first, and email legal@yardmaster.io to ask us to delete your sync files.

If you view a Share. People who open a Share do not need a Yardmaster account, and this part is for them. For each counted view, we record the time, the viewer's country, a salted hash of their internet address and a hash of their browser details. These records are deleted automatically after 180 days. The Share's owner can see the view records for their Share.

If a Share is limited to Google sign-in, we see the Google email address the viewer signs in with. Comments a viewer posts are stored with the Share. If the Share's owner allows reader questions, a question a viewer asks is stored for up to 7 days. It is sent to OpenRouter to be answered by an AI model, paid for by the Share's owner on the owner's own account, using the Share's text.

Share pages keep small items in the viewer's browser (see "Cookies and browser storage" below). Some Shares also load code, pictures or fonts from other websites, such as unpkg (a public code library service), Google (for Google sign-in) or sites the Share's author chose; those websites receive the viewer's internet address. We collect and keep the view records described here. What a Share contains is up to its owner.

Our websites. When you click a download button on our download page, the page sends one count per visit to our own help site. The count holds only: the campaign tags in the page address (if any), the name of the website that linked you there (the site name only, not the full page address), your type of computer (Windows, Mac or Linux) and the time. It contains no internet address, no ID, no cookie and no browser details, and nothing is stored in your browser.

To stop abuse, your internet address is turned into a scrambled code that changes every day and is used only to limit how many counts one visitor can send; it is never stored with the count. Counts are deleted automatically after 180 days. Feedback you leave on a help page is kept for 365 days.

What we do not upload. We do not upload your local session history or project code as part of normal operation. The exceptions are features you choose to use: knowledge capture (above), Shares you publish, cloud backup and sync, feedback and problem reports you send, and the AI providers you use (Section 5), which receive your prompts and context directly.

Where your data is processed. Our cloud backend (Google Firebase, Firestore, Cloud Storage, Cloud Functions, Cloud Run and Cloud SQL) runs in a United States region (us-central1, Iowa). Error reports go to Sentry, a US-based service. Email we send and agent email we receive pass through Cloudflare's global network, and phone notifications pass through Google Firebase Cloud Messaging, a global Google service, so that content can be handled outside the United States.

The Services are offered only in the US (Section 1). We do not run cloud regions outside the US, and we do not use other legal transfer tools, such as Standard Contractual Clauses. If you use the Services from outside the US, your data is sent to and processed in the US, where privacy laws may differ from the laws where you are.

Cookies and browser storage (functional only).

• Phone and browser access to the App. If you pair a phone or browser with the App, the App's own local server sets one functional cookie, amc_web_token, so the paired browser stays signed in. Its value is your access token, not a tracking or advertising identifier.

• Protected Shares. When a viewer unlocks a password Share or signs in with Google to open a Share, our Share pages set a signed functional cookie (__session) that remembers the unlock. The App's own Share viewer sets the same kind of cookie so a Share's owner can view it.

• Share pages. Share pages may store small items in the viewer's browser, such as a random device ID for reactions, reading-width preference, and progress in interactive Shares.

These items are used only to make these features work. We set no advertising or third-party tracking cookies, and we do not use these items to follow you across other websites. You can clear them in your browser at any time; a protected Share will then ask you to unlock it again.

5. Third parties and service providers#

We use the following. The first group runs on the Company's own accounts and acts as our service providers. The second group runs on your own account or key: you choose them, they receive data only if you turn on or connect that feature, and they act under their own terms with you, not as our service providers.

Services the Company operates#

Services you use on your own account or key#

• Anthropic (Claude): the default AI provider for agent sessions. Your prompts, code, file contents, conversation context and attachments are sent directly to Anthropic on your own Claude sign-in or API key when you run an agent. Anthropic also receives knowledge-capture text (Section 4) and, when you have not added another AI key, the text used by built-in helper features (below).

• Built-in helper features (session titles, summaries and daily digests, Plain Speak rewrites, reply suggestions, contact-name guesses, email pre-screening, and "Ask AI" in Settings search) use your own OpenRouter, Groq or OpenAI key if you have added one, and otherwise Anthropic on your own Claude sign-in or key. They receive the text they work on.

• Other AI providers you configure (for example OpenAI and Codex, Google Gemini, DeepSeek, Moonshot Kimi, Zhipu GLM, MiniMax, Meta, xAI, Together AI, OpenRouter, and other coding-agent engines you choose) receive your prompts and context when you use them, on your own key. OpenRouter also answers Share reader questions, on the Share owner's own account (Section 4).

• Voice features (off by default). If you turn on voice typing, your microphone audio is streamed to the provider you choose (Deepgram, ElevenLabs or Groq) on your own key, or processed on your device if you choose the on-device option. If you turn on read-aloud, the text to be read is sent to Fish Audio, xAI Grok or ElevenLabs on your own key.

• Messaging and SMS: Pushbullet (your SMS and MMS messages and synced contacts), Slack, AgentMail (the agent-email feature), and Klipy (GIF search terms you type in the SMS composer).

• Google accounts: connecting Gmail, Google Calendar and Google Drive is not available yet; it is waiting for Google's approval. Before you can connect them, we will update this policy to describe what those connections collect and how Google data is used.

• Work tools: Atlassian Jira and Confluence, when you connect them, exchange issue and page content, and member names and emails, with your own Atlassian account.

• Files: Dropbox and Microsoft OneDrive, when you connect them.

• Design and creative tools: Canva, Zapier, Mobbin, and the Game Studio asset services Meshy, fal.ai and ElevenLabs (sound effects), when you use them.

• Remote phone access: Tailscale, on your own Tailscale account, carries all phone-access traffic when you turn remote access on (off by default).

• Automations: Discord and any web address you enter in an automation receive what that automation sends.

• In development (off by default): TypeSafe AI, on your own key, receives the last part of an agent's message when you turn the feature on.

Connections the App makes for itself#

The App also contacts these services without sending your content, which reveals your internet address to them: Hugging Face (downloads of on-device models), npm (tool updates), the Anthropic status page, unpkg (code libraries used inside Shares, also loaded by the browsers of people who view those Shares), Vimeo (link previews), and the Company's own public endpoints for the model list and a remote off switch for AI features that cost money. If you ask the App to download a video, it connects to the site you name.

Voice is off by default. Voice typing and read-aloud are turned off out of the box; unless you turn them on in Settings, no microphone audio or voice data leaves your device. If you turn voice on, audio and voice data go to the providers listed above, and this can be sensitive personal information (see Section 8).

6. Diagnostics and product usage numbers#

Yardmaster collects error reports and usage numbers to keep the App reliable. Both are on by default, and each has its own off switch in Settings > Diagnostics > Reports to the team: Send usage numbers and Send error reports. When a switch is off, nothing of that kind is sent.

Only you can turn a switch back on: AI agents, a paired phone and an imported backup can turn them off but never on. Turning Send error reports back on takes effect the next time the App starts. Turning Send usage numbers back on sends totals again, and because the report includes running totals, those totals also cover the time it was off.

Three kinds of reports can leave your device. Everything else the App records for diagnostics stays on your machine.

When it starts. Error reporting begins when the App first launches, before you sign in and before you see the Terms screen, with its switch on by default, so an error on a first run can be reported. The switch is honored from the very first launch, but you can reach it in Settings only after the first-run screens. To stop error reports, turn off Send error reports; nothing more of that kind is sent from then on.

Usage numbers are sent only while you are signed in. You sign in before the Terms screen appears, so a usage report can be sent while that screen is showing. To stop usage numbers, turn off Send usage numbers in the same place.

• 1. Error and crash reports (Sentry). When the App hits an unexpected error or crashes, we send a text report to Sentry. It contains the error message and stack trace, a short trail of recent activity in the App (such as recent log lines, web requests and clicks, and the name of a project when a session starts in it), the app version, your operating system and its version, the platform, the processor type, and the App's runtime versions.

• Session signal and crash dumps. Sentry also receives a small "app session" signal each time the App runs, used to measure how often it crashes. Native crash dumps (memory snapshots) are not uploaded; they stay on your device.

• 2. Usage numbers (identified). For signed-in users only, the App sends a numbers-only report about every 20 minutes. For that day and in total, it counts sessions, AI cost, input and output tokens, active and engaged time, turns, messages by type, personal bests, and spend and refusals for the App's built-in AI features that cost money, by purpose.

• What else the usage report holds. It also holds your Claude plan label, the app version, the platform, and a random per-install ID (to tell your own computers apart; it is not a device fingerprint). It contains no project names, no session titles, no search terms, and no text you typed.

• 3. Feedback and problem reports you send. When you send feedback or use a one-click "report this problem" button, the report includes what you wrote (or the file path or phrase involved), recent errors, app details and any screenshot you add, tied to your account (Section 4). These are sent only when you choose to send them. Automatic problem reports that are waiting to be sent are dropped if you turn their switch off first.

Older versions and crash dumps. Versions of the App released before this policy uploaded native crash dumps to Sentry when the App crashed, and a crash dump can hold parts of whatever was in the App's memory at the time. Updating the App to the current version stops this.

What stays on your device: native crash dumps; a local crash log (the error, cleaned recent log lines, how long the App had been running and memory use at the time) that you can read or attach to a support request; and the words you type into Settings search, which are kept only locally and removed after 365 days.

One exception: if Settings search finds nothing and you press Ask AI, your question is sent to the AI provider your helper features use (Section 5).

Reducing personal details: before a report is sent, the App removes email addresses, keys, tokens, phone numbers, internet addresses and the user-name part of folder paths, and Sentry's own collection of personal data is turned off. This is best-effort: details written inside free text in an error message may remain. Reports are sent over encrypted connections (TLS).

What we don't do: we do not read your code or your agent conversations for these reports, and we do not sell this data.

Related setting. A setting controls whether crash evidence left by a previous launch is added to the local crash log at the next start. It sends nothing.

7. How we use data#

We use data to provide, operate, and secure the Services; authenticate you; keep your sign-in secure and warn you about sign-ins from new countries; host the Shares you publish; run the optional features you turn on; provide support and respond to feedback; diagnose problems and improve reliability and features; prevent abuse; and comply with legal obligations.

We do not sell personal information, do not use it for advertising, and do not use your prompts, code, or conversations to train the Company's own models.

8. Your privacy rights (California and all US users)#

California law gives California residents rights over their personal information. We extend these rights to everyone who uses the Services, whether or not the law requires it. You have the right to know what personal information we collect and how we use and disclose it, to access it, to correct it, to delete it, and to get a copy in a portable form, subject to exceptions allowed by law.

We do not sell or share your personal information (including "sharing" for cross-context behavioral advertising, as California law defines it).

Categories of personal information (Notice at Collection):

• Sensitive personal information: we handle voice data only if you turn on voice features (off by default). If you do, you have the right to limit the use of sensitive personal information: exercise it by turning voice off in Settings (which stops any further voice data) or by emailing legal@yardmaster.io. Voice data is used only to provide the voice features you turned on, never to infer things about you, and is never sold or shared.

• How to exercise your rights: email legal@yardmaster.io. You may also use an authorized agent. We will verify your request against your account information and respond within 45 days (extendable once by 45 days if reasonably necessary, with notice). We will not discriminate against you for exercising these rights.

• If we say no: we will tell you why. You can ask us to look at your request again by replying to our answer. If you are still not satisfied, you can contact your state's attorney general.

If the privacy law of the state where you live gives you more rights than this section, we will honor those rights too.

9. Data retention#

Automatic deletion can take a few days after a period ends.

Deleting your account#

You can delete your account in the App's Settings. Deleting your account removes your sign-in, your account record and profile picture, your usage numbers, your sign-in location and history, your access requests and invitations, your membership in shared workspaces, and any record kept for you by an earlier version of our service. The text of your Share comments is replaced with "removed", and your name and email are removed from feedback you sent (screenshots attached to it are deleted).

Deleting your account does not delete:

• anything stored on your computer (delete the App's data folder for that);

• Shares you published and their files (delete them in the App first);

• knowledge-capture facts;

• cloud backup and sync files;

• records of administrative actions, which are kept for 2 years for security and legal reasons.

To have your knowledge-capture facts and your cloud backup and sync files deleted as well, email legal@yardmaster.io. We will delete them unless the law requires or allows us to keep them, and we will tell you if we keep anything and why.

10. Security#

We use technical and organizational safeguards: encryption of credentials at rest on your device (operating system secure storage, where available; see Section 3), encryption in transit (HTTPS and TLS), and access controls on our backend. No system is perfectly secure.

At-rest protection for your local data. By default, your local database (yardmaster.db) and saved attachments are not encrypted by the App; they rely on your operating system's full-disk encryption (for example BitLocker, FileVault or LUKS) and its file permissions.

Breach notification. If a breach affects your personal information, we will notify you and the appropriate authorities without undue delay and within any timeframe required by applicable law. We keep an internal incident-response process (detect, contain, assess scope, notify affected users and regulators as required, fix, and document).

11. Data-processing addendum (business and team customers)#

If you use Yardmaster on behalf of an organization and we process personal data for you through the team features, a data-processing addendum (DPA) is available on request; contact us at the address in Section 13. Each service provider the Company operates (Section 5) handles data under its own contract terms with us.

12. Children's privacy#

The Services are for people 18 or older and are not directed to children. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it and close the account. If you believe a child has given us information, email legal@yardmaster.io.

13. Contact#

Privacy questions or requests: legal@yardmaster.io, Bold Arrow Group, LLC, 29 Duncan Lane, Arden, NC 28704.

14. Changes#

We may update this policy. When we do, we change the "Last updated" date above. For a material change, we will also tell you in the App before it takes effect, for example by showing the agreement screen again. If you keep using the Services after a change takes effect, the updated policy applies. If you do not agree with a change, stop using the Services and delete your account.