Privacy Policy
Yamora is for adults aged 18 or older. Most persistent dating, messaging, and learning data stays in the user's own Chrome profile or mobile browser storage. Optional privacy-bounded model-improvement contribution and mobile push notifications begin only after the user's explicit choice.
1. What Yamora does
Yamora is a local-first dating product with a Chrome extension and a mobile PWA companion. It helps adults create a dating profile, discover mutually compatible people, express interest, form reciprocal matches, communicate privately, and improve compatibility ordering on the user's device.
2. Data processed and kept on the user's device
Yamora may locally process and store:
- profile details, photos or other user-selected media, age, gender, relationship intent, preferences, and interests;
- exact coordinates used to calculate distance locally, plus coarse location material used for peer discovery;
- Interested and Pass choices, matches, compatibility state, conversation outcomes, and local learning state;
- messages, reports, cryptographic identity material, encrypted-session metadata, and settings; and
- features derived locally from pages for which the user granted optional website access.
Exact device latitude and longitude stay in Yamora's local profile state. When the user allows the optional city-name lookup, Yamora rounds the device location to an approximately 2 km grid and sends only that rounded point to BigDataCloud to obtain a human-readable city or area name. The exact device coordinates are not included in that request. BigDataCloud also necessarily receives normal network information such as the requesting IP address. The resulting city/area label is editable by the user.
When the user types in the public city/area field and chooses to use autocomplete, Yamora may send only that typed city/area query to Photon (photon.komoot.io), which returns OpenStreetMap-based place suggestions. Exact device coordinates are not sent to Photon. Photon necessarily receives ordinary request/network information such as the requesting IP address.
Yamora does not request Chrome browsing-history permission. Raw page text, page titles, search text, and URLs used for current-page analysis are transient inference inputs and are not retained in Yamora's behavioral database. Users can control or remove optional website access and disable learning.
2A. Same-browser reinstall recovery
After profile setup, Yamora can keep a bounded automatic recovery copy in browser IndexedDB under Yamora's dedicated recovery origin. This exists so a user who removes and reinstalls Yamora in the same Chrome profile can choose Restore existing profile and recover without browsing for a backup file.
The recovery copy is written and read by packaged Yamora extension code inside a script-free recovery page. The recovery payload is not uploaded to or stored by Yamora's Cloudflare Worker or D1 database. Cloudflare still necessarily receives ordinary network information such as IP address when the recovery page itself is loaded.
The bounded recovery copy can include profile fields, preferences and privacy choices, verification state, profile photos or voice introduction, Yamora cryptographic identity material, and the exact device-location state needed to resume private distance matching. That exact location remains in browser-local storage and is not sent to the recovery server, peers, Photon, or the signaling relay. Automatic recovery does not silently restore browsing-learning website permission and does not silently re-enable or re-enroll optional remote model-improvement contribution.
The automatic recovery copy is limited to the same Chrome profile. Clearing browser site data for the Yamora recovery origin can remove it. Manual encrypted backup and recovery-kit files remain the fallback for another Chrome profile or computer, or when the browser-local copy is unavailable.
3. Peer and network processing
To provide discovery and communication, Yamora shares a bounded public dating profile, public profile media chosen by the user, reduced compatibility signals, coarse location or discovery material, and user-chosen communications with other Yamora peers. Peer application events, messages, and peer media use authenticated end-to-end encrypted sessions.
Relay and network providers necessarily process temporary connection information such as IP addresses while routing traffic. Yamora's signaling relay does not create a persistent database of profiles, exact locations, matches, or message contents. For direct WebRTC setup, Yamora may contact a public STUN service, which necessarily receives ordinary network information such as the requesting IP address but is not sent the user's Yamora profile, messages, photos, voice introduction, exact location, compatibility data, or peer-session encryption keys. Connection metadata can also be visible to internet and infrastructure providers as necessary to deliver the service.
4. Optional mobile push notifications
On supported mobile browsers, push notifications are off by default and are enabled only after the user chooses to enable them and the browser grants notification permission. Yamora creates a random opaque push-inbox capability and a separate random management secret. The relay sends the registration through an authenticated internal service to Yamora's Cloudflare D1-backed push registry, which associates the browser's PushSubscription with the opaque inbox and stores only a SHA-256 hash of the management secret; it does not register a Yamora profile ID or candidate ID with the push service.
Push payloads contain only the generic event type message or match. Yamora does not include message text, profile identity, names, photos, voice introductions, exact or coarse location, compatibility data, browsing-derived data, or peer-session encryption keys in push payloads. The browser or operating-system push infrastructure necessarily processes the PushSubscription endpoint and ordinary delivery/network metadata needed to deliver the notification.
Push registrations are retained for up to 90 days since their last update unless the user disables notifications, the subscription becomes invalid, or the registration is removed earlier. Disabling notifications unregisters the browser subscription when possible and rotates or clears the local push capability.
5. Optional pseudonymous model improvement
Contribution is off by default. Before it is enabled, Yamora presents an in-product disclosure describing the data and purpose and requires the user to take an affirmative consent action. If enabled, an installation may periodically send:
- quantized, derived compatibility and reciprocal-feature values;
- Interested/Pass, mutual-match, and bounded conversation-outcome labels;
- bounded baseline and model prediction snapshots;
- coarse day buckets and random pseudonymous installation, export, and example references; and
- minimum-size aggregate age-band and gender quality cells used to evaluate model performance disparities.
These contributions exclude names, profile or candidate IDs, photos, audio, URLs, raw browsing or search text, exact coordinates, raw behavior vectors, message text, credentials, and payment information. The contributed data is used only to train, evaluate, secure, and improve Yamora's reciprocal matching functionality. It is not used for advertising, data brokerage, creditworthiness, or unrelated profiling.
5A. Optional public-website analytics
Yamora's public marketing website uses Google Analytics with consent mode. The Google tag can load with analytics storage, advertising storage, advertising user data, and ad personalization set to denied by default. In that denied state Google may receive limited cookieless consent/measurement signals, but analytics cookies are not read or written. Full analytics storage is enabled only after the visitor explicitly chooses Allow analytics in the website's analytics notice. The visitor's choice is stored locally in the browser so the site can remember the preference.
When analytics consent is granted, Google Analytics is used to understand aggregate website visits and public-site interactions such as clicks to the Chrome Web Store, the mobile PWA, the privacy policy, or the voluntary support page. Yamora disables Google Signals and ad-personalization signals in this website configuration. Yamora does not intentionally send dating-profile information, messages, photos, precise location, browsing-derived extension data, matching data, or model-improvement data to Google Analytics.
Visitors can reopen Analytics settings in the public website footer to change the local choice. Browser/site-data controls can also clear the stored preference and any Google Analytics cookies created after consent.
5B. Reports and moderation
When a user explicitly reports another person, Yamora may send a signed, bounded evidence package to Yamora's Cloudflare moderation gateway. The package can contain the reported public profile, the reporting user's chosen reason/details, and up to 30 relevant conversation messages. Exact coordinates, browsing-derived state, attraction vectors, raw AI behavior vectors, credentials, and unrelated local data are excluded. Blocking remains a separate local/peer safety action and can work even if network report submission fails.
Production moderation reports are retained for up to 90 days by default unless they are deleted earlier or longer preservation is required for security, abuse response, or applicable law. Authorized human review may occur for submitted reports where needed for safety, abuse response, or legal compliance.
6. Service providers and transfers
Yamora uses or may use the following service providers depending on which disclosed features are configured and enabled:
- Cloudflare for Yamora's production signaling/encrypted relay fallback, D1-backed optional model-improvement collector, moderation gateway, opaque mobile push registry, public STUN service, and the script-free browser recovery page. Recovery payloads themselves remain in browser IndexedDB and are not stored by the recovery Worker or D1. Cloudflare necessarily receives ordinary network information such as IP address when providing these services;
- Render, where configured, for hosting the public mobile PWA surface. Yamora's production relay and model-improvement collector use the Cloudflare path described above;
- BigDataCloud for the optional client-side city/area lookup. Yamora sends a rounded approximately 2 km location point rather than the exact device coordinates; the provider also receives normal network information such as IP address as part of delivering the request;
- Photon / OpenStreetMap-based geocoding for optional city/area autocomplete. Yamora sends only the city/area text typed into that field, not exact device coordinates;
- GitHub Actions, when the automated model-improvement lifecycle is enabled, for ephemeral model training, evaluation, signing, and rollout;
- the browser or operating-system push-delivery infrastructure selected by the user's device when optional mobile notifications are enabled;
- Google Analytics for optional, consent-gated measurement of visits and public-site interactions on Yamora's marketing website. This website configuration disables Google Signals and ad-personalization signals; and
- Google Chrome and the Chrome Web Store for extension execution and distribution.
If a user voluntarily opens Yamora's external support page, Ko-fi and its payment providers, which may include PayPal, process information the user provides directly to them under their own privacy policies. Yamora does not transmit dating-profile, browsing-derived, location, messaging, or model-improvement data to Ko-fi or PayPal.
These providers process data only as needed for the relevant disclosed function. Infrastructure may process data outside Israel, subject to the provider's contractual and security controls.
7. Voluntary support
Yamora may offer a link to Ko-fi where a user can voluntarily support the project. Contributions unlock nothing and do not affect ranking, visibility, matches, features, support priority, or data handling. Ko-fi and its payment providers process the transaction under their own terms and privacy policies. Yamora does not receive or store payment-card, bank-account, or payment-account credential information. Yamora stores only local support-prompt and link-open state and does not send that state to peers or the model-improvement collector.
8. Human access and disclosure
Yamora does not sell user data. User data is not used or transferred for personalized, retargeted, or interest-based advertising.
Humans do not read user data except when the user explicitly consents to human access to specific data for support, when access is necessary to investigate security or abuse, when required by applicable law, or when the information has been aggregated and anonymized for permitted internal operations. Information may also be disclosed when legally required or as part of a merger, acquisition, or sale of assets, subject to applicable law and continued protection.
9. Retention, consent withdrawal, and deletion
When optional production model improvement is enabled, accepted model-improvement export batches are retained for up to 730 days unless deleted earlier or longer retention is legally required. Users can pause future sharing or select Delete my contributed copy inside Yamora. This deletes the installation's retained export batches, revokes its upload token, and clears its sharing consent. A deletion marker prevents later uploads from concealing that removal.
The next scheduled model lifecycle retrains without deleted contributions or retires the affected model if the remaining evidence is insufficient. Because the lifecycle runs daily and clients normally check for signed updates every six hours, a previously cached model may remain locally usable for approximately 30 hours after the server-side deletion process begins. Urgent requests can be sent to yamora.privacy@gmail.com.
Optional mobile push registrations are retained for up to 90 days since their last update and may be removed earlier when notifications are disabled or the browser push subscription becomes invalid.
Submitted production moderation reports are retained for up to 90 days by default unless deleted earlier or longer preservation is required for security, abuse response, or applicable law.
Automatic same-browser recovery data remains in the dedicated browser-origin storage until it is replaced by a newer recovery copy, removed through Yamora's Delete all Yamora data flow, cleared through browser site-data controls, or otherwise removed by the browser. Uninstalling Yamora clears extension-local storage but may intentionally leave this browser-local recovery copy so a reinstall in the same Chrome profile can restore the profile.
Extension-local data remains until the user removes it in Yamora, removes the relevant Chrome profile/mobile site data, or uninstalls the extension/PWA, subject to browser and operating-system behavior. The separate automatic same-browser recovery copy follows the retention behavior described above. Peer recipients retain communications on their own devices. Provider backups, security records, or legally required records may remain for the period required by provider operations or applicable law.
10. User choices and rights
Users can decline optional model contribution and optional mobile notifications without losing access to Yamora's dating features. They can disable mobile notifications, pause model-improvement sharing, and request deletion from within Yamora when the corresponding feature is configured. For access, correction, deletion, objection, consent withdrawal, or another privacy request that cannot be completed in-product, contact yamora.privacy@gmail.com. The operator may request enough information to verify the request without collecting unnecessary identity data and will respond within the period required by applicable law.
11. Security
Yamora uses HTTPS and WSS for server transmission, authenticated encrypted peer sessions, strict server-side schemas, capability-bounded push registration, installation-bound collector credentials when model contribution is enabled, Cloudflare D1 controls for opaque push registrations and contributed data, signed and expiring model envelopes, staged rollout, monitoring, and automatic rollback where the corresponding production services are configured. The automatic recovery origin serves a script-free page; recovery data is written and read by packaged extension code into browser IndexedDB rather than a Yamora server database. No system can guarantee absolute security.
12. Children
Yamora is intended only for adults aged 18 or older. A person known or reasonably believed to be under 18 is not permitted to use Yamora. Suspected underage use can be reported to yamora.privacy@gmail.com; the operator will investigate and delete associated operator-controlled data where appropriate and legally permitted.
13. Chrome Web Store Limited Use
Yamora's use and transfer of information received from Google APIs complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. Data obtained through extension permissions is used only to provide or improve Yamora's disclosed, user-facing dating functionality and to maintain its security and reliability.
14. Changes
This policy may be updated when Yamora's practices or legal obligations change. Material changes will be disclosed before they take effect, and renewed consent will be requested where required. The effective date at the top of this page will be updated.