Skip to main content

​
Privacy Policy

Last updated: March 19, 2026 This Privacy Policy describes how SkyAI Ops (“we”, “us”, “our”) collects, uses, and protects information when you use YesPaPa, including the CLI tool, daemon, mobile app, and optional hosted relay service (collectively, the “Service”).

​
1. Overview

YesPaPa is designed with privacy as a core principle. The Service operates primarily on your local machine, and most data never leaves your device.

​
2. Information We Collect

​
2.1 Information you provide

  • Host name — The name you assign during yespapa init (typically your machine’s hostname)
  • Pairing data — When you pair the mobile app, a host identifier and authentication tokens are exchanged between your CLI and the app

​
2.2 Information collected automatically

  • Command metadata (hosted relay only) — When using the optional hosted relay, intercepted command names, timestamps, and approval status are transmitted to the relay server for real-time mobile notifications. Command arguments may be included for display in the approval prompt.
  • Push notification tokens — If you enable push notifications, we receive an Expo push token to deliver notifications to your device. We do not use this token for any other purpose.
  • Basic device info — Device type (for push notification delivery only). We do not collect device IDs, advertising IDs, or hardware identifiers.

​
2.3 Information we do NOT collect

  • We do not collect analytics or telemetry
  • We do not track your location
  • We do not collect contacts, photos, or files
  • We do not use advertising SDKs or trackers
  • We do not sell or share your data with third parties for marketing
  • We do not collect your TOTP seed — it never leaves your device

​
3. How We Use Information

We use the information we collect solely to:
  • Deliver push notifications for command approval requests
  • Display pending commands in the mobile app
  • Facilitate pairing between the CLI and mobile app
  • Provide usage statistics locally on your device (via yespapa stats)

​
4. Data Storage & Security

​
4.1 Local storage

  • TOTP seed: Encrypted with AES-256-GCM, key derived from your master key via Argon2
  • Command history: Stored in a local SQLite database at ~/.yespapa/yespapa.db
  • Mobile app data: Stored in platform-native secure storage (iOS Keychain, Android Keystore)

​
4.2 Hosted relay (optional)

If you use the hosted relay service:
  • Command data is stored in a Supabase-hosted PostgreSQL database
  • Data is encrypted in transit (TLS) and at rest
  • Command records are retained for 30 days, then automatically deleted
  • You can delete your data at any time by removing your host from the relay

​
4.3 Self-hosted option

You can self-host the relay server using the provided Docker image. When self-hosted, all data remains on your own infrastructure, and this Privacy Policy does not apply to the relay component.

​
5. Data Sharing

We share data only in these limited circumstances:
  • Expo push service — Push notification tokens are sent to Expo’s notification service to deliver approval requests. See Expo’s privacy policy.
  • Supabase (hosted relay only) — Command metadata is stored in Supabase infrastructure. See Supabase’s privacy policy.
  • Legal requirements — We may disclose information if required by law, legal process, or government request.
We do not sell your data. We do not share data with advertisers.

​
6. Your Rights

You have the right to:
  • Access your data — All local data is in ~/.yespapa/ and viewable via yespapa stats
  • Delete your data — Run yespapa uninstall to remove all local data, or remove your host from the relay
  • Opt out of the hosted relay — Use YesPaPa in offline-only mode with any standard TOTP authenticator
  • Export your data — The SQLite database can be queried directly
  • Revoke push notification permissions — Via your device’s system settings
If you are in the EU/EEA, you also have rights under the GDPR including data portability and the right to lodge a complaint with a supervisory authority. If you are in California, you have rights under the CCPA including the right to know, delete, and opt out of the sale of personal information (we do not sell personal information).

​
7. Children’s Privacy

The Service is not directed at children under 13. We do not knowingly collect information from children under 13. If you believe we have collected such information, contact us and we will delete it.

​
8. Data Retention

​
9. International Data Transfers

If you use the hosted relay, your data may be processed in data centers outside your country. We rely on standard contractual clauses and adequacy decisions where applicable.

​
10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the “Last updated” date. Continued use of the Service after changes constitutes acceptance.

​
11. Contact

For privacy-related questions or requests, contact us at: