Before you read this: Yesterself has not shipped yet. This policy is published now, in advance, so that anyone deciding whether to wait for the app can read exactly what it will and will not do before installing anything. It takes effect on the version 1.0 release date printed below.
Yesterself Privacy Policy
Version 1.1 · Effective 14 December 2026 · Plain language, and accurate. If any sentence here turns out to overstate what our software does, the software is the bug — write to us and we will fix one or the other.
The short version
Yesterself is a journal that runs on your phone. Your letters are written, stored, searched and read on your device. If you subscribe to Yesterself Post, encrypted copies are also stored on our server so your devices can share them — sealed with a key that never leaves your phone. We cannot read them. Not for support, not for advertising, not for a court order. There is no account, no email address, no password, and no analytics anywhere in this product.
Who we are
Yesterself is published by the company named at https://yesterself.khreshitech.solutions/legal.html, which is the data controller for the small amount of information described below. That page carries our registered name, our address, our EU and UK representatives, and the person who answers privacy questions; it is kept current so this policy does not have to change when an address does. You can reach us at hello@khreshitech.solutions — one mailbox, for privacy questions and requests, for vulnerability reports (see https://yesterself.khreshitech.solutions/.well-known/security.txt), and for everything else. It is a mailbox a human reads. The app itself never sends email and never asks for your address.
How the app is built, in one paragraph
Your journal lives in an encrypted database on your phone. Speech-to-text uses the recognizer built into your phone's operating system, in its on-device mode; the "resonance" feature that finds echoes of one letter in another, the quarterly Season of Selves, the narration voice and the Annual Volume book are all produced on your device by software we ship inside the app. Nothing is sent anywhere to be processed, with one exception you control on older Android phones, described under Voice. If you turn on sync, each letter is encrypted on your phone with a key derived from your 12-word recovery phrase, and only the sealed result is uploaded.
If you never turn on sync
Then the app never contacts our servers at all. Not once. There is no account for us to create, no identifier for us to store, and nothing about you in any system of ours. Everything in the free tier — writing, morning mail, capsules, resonance over your last 90 days, import, export, the widget — works entirely on your phone, offline. Three things end that silence, and each is something you do on purpose: starting the free trial, buying Yesterself Post, or turning on sync. The first time you do any of them, the app signs in to our server with the key on your phone, and that sign-in is what creates your account — the public key and the device record described in the next section, and nothing else.
If you subscribe to Yesterself Post and turn on sync
Your phone creates a 12-word recovery phrase. That phrase produces two things: an identity (a public key, which becomes your "account" — there is no username) and the keys that encrypt your letters. We receive the public key and the sealed letters. We never receive the phrase or any key derived from it.
Here is exactly what our server stores. This list is complete; if it ever grows, this policy changes first.
| What we store | Why |
|---|---|
| Your account's public key | It is your account. It is not linked to a name, email, or phone number. |
| Encrypted letters, capsules and voice recordings | So your other devices can fetch them. We cannot open them. |
| For each encrypted item: an id, which device sent it, a sequence number, whether it was a new letter / an edit / a deletion, which earlier item it replaces, when it was uploaded, and its size | The mechanics of syncing. |
| Your devices: an id you generate, platform, model name, app version, when each was last seen, and — from version 1.1 — a push token | To sync between them and to let you remove one. |
| Subscription status and the store's transaction identifiers | Because Apple and Google require verified purchases, and because you should not be charged for something you cannot use. |
| If you create a stewarded milestone capsule: the sealed capsule, one half of a key (useless alone), and a hashed claim code | So the letter can reach the person you chose. |
| For that capsule, in the clear: the release date you chose; whether you chose a fixed date alone, or a fixed date or a long silence, whichever comes first; how long that silence is, if you chose one; and the last time one of your signed-in devices checked in with our server | We have to know when to release the letter, and a release triggered by silence has to know when you were last active. This is the one date about a letter that our server can read, and it is there because you asked us to act on it. |
What we can never see, no matter who asks
The words in any letter, capsule, note or transcript. The date a letter is about (we see when you uploaded something, never which day it belongs to). The delivery date of an ordinary capsule, which is sealed inside it — a stewarded milestone capsule is the one exception, and the table above says so. What you said in a voice recording, or your voice. Which letters echo which — those calculations happen on your phone and their results never leave it. Your name, email, phone number, contacts or location, because we never collect them. Your recovery phrase or any key, because they never leave your phone.
What our server can infer, honestly stated
Because we store sealed items with their sizes and upload times, someone with access to our database could tell that an account writes most evenings, roughly how much, how often it edits, and whether a letter had audio attached. They could not tell what any of it says. We think you should know the shape of what we hold, not just the reassuring part. The sync server — the one machine the app ever talks to — keeps no web logs at all: no IP addresses, no browser or device strings, no page paths. While a request is being served, the connection itself carries an IP address, as every internet connection does, and it is discarded when the request ends. Our website is a different machine, and the section on it below says what that one keeps.
Buying a subscription
Purchases happen through Apple's App Store or Google Play, never through us. We never see your card, your billing address, or your Apple/Google account. Their systems tell ours "this purchase is valid until this date", and we store that answer against your public key. Apple and Google collect their own data under their own policies, which we do not control. If you joined a TestFlight or Play beta, Apple or Google know your email address for that purpose — we do not receive it.
Notifications
Morning mail, evening reminders and capsule deliveries are scheduled by your phone, not by us; they contain dates only, never a word of your letters. From version 1.1 our server may send an empty "wake up and sync" push to your other devices. It carries no content and no identifier beyond the delivery token, so anyone watching push traffic learns only that some Yesterself account synced something.
Voice
Recording and transcription happen on your device, using the speech recognition built into iOS and Android in their on-device modes. On iOS, and on Android 12 and later, the app refuses to transcribe unless the system confirms that the recognizer is running on the phone. Android 10 and 11 cannot confirm that, so on those phones the app tells you so before your first transcription and asks whether to go ahead; if you would rather not, you can still record without a transcript, or type. Audio is encrypted before it is stored anywhere, including on our server. We never receive an unencrypted recording.
Importing and exporting
Files you import are read on your device and never uploaded. Exports are written on your device and go wherever you send them. Export is free on every tier, forever, with no cooldown and no watermark — this is a promise we consider load-bearing.
Steward kits
If you name a steward for a milestone capsule, we ask for nothing about them — no email, no phone number, not even a real name. You hand them the kit yourself. Our server holds a sealed capsule, half a key (which is random noise on its own), and a hashed code. Only the kit and the server together, and only after the date you chose, can open the letter.
Cookies and our website
Our website is static pages. No cookies, no trackers, no analytics, and no embedded fonts or scripts from anyone else. It is served by an ordinary web server on a machine we share with our other websites, and that web server keeps standard access logs: the address each visit came from, the page it asked for, the time, and the browser's description of itself. Those logs stay only as long as the server's routine rotation keeps them — weeks, not months — and we never join them to anything the app does; the app never talks to that machine at all. The one interactive page — the steward claim page — is served by the sync server, not the website, so the no-logs rule above covers it; it runs its decryption in your browser and sends us only the capsule id and claim code.
How long we keep things
Encrypted letters stay while your account exists. If your subscription lapses, we keep your encrypted text indefinitely so a return works years later, and we keep your encrypted voice recordings for 24 months after the lapse before deleting them — the app shows you the exact date. Device records are deleted 12 months after last use. Purchase records are kept as financial records even after account deletion, with the link to your account removed. The sync server's logs, which contain none of your data, are kept 30 days; the website's access logs are described above. Emails you send us are kept 24 months.
Deleting everything on our side
In the app: Settings → Advanced → Delete server data. It removes your account, every encrypted letter and recording, and every device record, immediately and irreversibly. It does not touch your phone — your journal stays yours. One honest caveat: our encrypted backups roll over on an hourly/daily/monthly schedule and the oldest monthly copy is up to 12 months old, so deleted ciphertext survives in backups until it ages out. Nothing in those backups is readable by us either.
Your rights
If you are in the EU/EEA, the UK, California, or anywhere with similar law, you have rights to know what we hold, to get a copy, to correct it, to delete it, to restrict or object to processing, and to complain to a regulator. Because of how Yesterself is built, most of these are things you can do yourself, instantly, without asking us:
- A copy of what you wrote: Settings → Export. Free, every tier, any time. We could not produce this for you if we wanted to — we do not have the key.
- A copy of what we hold: Settings → Devices → Download full backup. You get exactly our records, in one file: your public key, the encrypted items with their metadata, your device list, your subscription and purchase records, and the release terms of any stewarded capsule. It works whether or not your subscription is still running.
- Deletion: Settings → Advanced → Delete server data.
- Correction: edit or delete letters in the app; the server's copy follows.
If you would rather ask us, write to hello@khreshitech.solutions. We will answer within 30 days. Because we hold no name or email, we verify a request by asking you to prove control of your account the same way the app does — by signing a short, dated statement with your key from inside the app. Settings → Advanced → Privacy request produces one in a tap, and you paste it into your email to us. It proves that you hold the account's key and nothing more: it is valid for seven days, and it cannot be used to sign in, to sync, or to delete anything. We are not able to identify you any other way, and we will not accept an email address as proof, because doing so would create exactly the account-takeover hole this design exists to avoid.
We do not sell personal information, we do not share it for advertising, we do not profile you, and we make no automated decisions about you. There is nothing to opt out of, which is why you will not find an opt-out link.
Law enforcement and legal requests
We respond to valid legal process. What we can produce is what we hold: public keys, encrypted data, and the metadata listed above. We cannot produce the contents of anyone's journal, because we cannot read it, and no key exists on our side that could. We have no way to reach you one to one — no email address, and no message channel from our server into the app — so we cannot notify you privately about a request that concerns your account. What we can do, whenever we are legally allowed to, is publish that it happened: in the report of the requests we receive, once a year, at https://yesterself.khreshitech.solutions/transparency.html, and, for anything urgent, at https://yesterself.khreshitech.solutions/security.html.
The risk we cannot engineer away
We could, technically, publish an app update that behaves badly — that is true of every app on your phone, including every end-to-end encrypted one. The design here removes our ability to read your past letters, and the sync server's source code is published so its behavior can be checked by anyone. The app you install is, in the end, a matter of trust. We would rather write that sentence than pretend otherwise.
Telling you when something goes wrong
We hold no email address, so we cannot email you, and the app has no message channel from us to you: it fetches sealed letters and sync mechanics from our server, and nothing else. So if there is a security incident, we will publish a full account at https://yesterself.khreshitech.solutions/security.html and in the open-source server repository within 72 hours of confirming it, and describe it in the next release's notes. Those are the only channels we have, for every tier, and they are the same whether or not you ever turned on sync. If this matters to you, the security page is the one to bookmark.
Children
Yesterself is not directed to children under 13 (or under 16 where local law sets that age). We do not knowingly collect anything from them — in truth, we do not knowingly collect anything from anyone, since we hold no identity. If you believe a child's data is on our server, contact us and we will delete the account's server-side data.
International transfers
Our server is in the European Union (Germany or Finland). If you are outside the EU, your encrypted data is stored there. Apple and Google process purchase information in their own locations under their own terms.
Changes to this policy
If we change anything that matters, we will raise the version number, ship the new text inside the app before the change takes effect, and keep every previous version published at https://yesterself.khreshitech.solutions/privacy-history.html. We will never make a change that quietly widens what we collect; a change like that would require changing the software's architecture first, and we would rather not.
Things we will never do
Sell or rent your data · show you ads · put an analytics or crash-reporting SDK in this app · send your writing to a cloud AI · ask for your email address · read your journal · make export a paid feature · make you a product.
This page is the published copy of the policy held in the product's own specification (16-security-privacy.md §8). The two are checked against each other on every build, in both directions: a sentence cannot change here without changing there, and nothing can be added here that the specification does not carry. Whether the software keeps each sentence is a separate question, answered by the release audit rather than by this footer. Security researchers: see the vulnerability disclosure policy and security.txt.