← Home
← Home
YapID achieves a 93% privacy score across 7 criteria including data minimization, IP handling, identity linkability, session encryption, third-party exposure, tracking prevention, and replay protection. This is the highest score of any authentication service we are aware of.
The short version: We store almost nothing about you. No email, no IP address, no name, no tracking. Only a cryptographic hash that proves you own your 12 words — without revealing who you are.
This Privacy Policy explains what data YapID ("we", "us", "our") collects, why we collect it, and how it is used. We operate id.yaphub.xyz and related services.
YapID is designed from the ground up to collect the absolute minimum data necessary to function. Privacy is not a feature we added — it is the foundation of everything we built.
| Data | Collected | Purpose |
|---|---|---|
| SHA-256 hash of your public key | Yes | Identify your account without storing your actual key |
| Session identifiers | Yes | Maintain login sessions |
| Session timestamps | Yes | Session expiry and security |
| Refresh token identifiers | Yes | Token rotation security |
| One-time nullifiers | Yes | Prevent replay attacks |
| Premium status | Yes | Link YAP Premium subscription |
| Email address | Never | — |
| IP address | Never | — |
| Name or username | Never | — |
| Device fingerprint | Never | — |
| Location data | Never | — |
| Browser/OS information | Never | — |
| Your 12-word passphrase | Never | — |
| Your private key | Never | — |
| Cookies | Never | — |
Your 12-word passphrase never leaves your browser. Here is exactly what happens:
Result: Even if our entire database were stolen, an attacker would have no way to link any account to a real person, and no way to recover any 12-word passphrase.
Your session token is stored encrypted in your browser's IndexedDB using AES-256-GCM with a non-extractable cryptographic key. This means the token cannot be read even if an attacker executes JavaScript on a page that embeds YapID — because the decryption key never leaves the WebCrypto API's secure context.
When you sign in to a website using YapID, that website receives only:
5ea84ef5-0210-4eb9-9350-7cd3dd60a748). This is not linked to any personal information.Third-party sites do not receive: your name, email, avatar, IP address, passphrase, public key, or any other identifying information.
Different websites that use YapID each see the same accountId for a given user. This is necessary for persistent identity. However, because the accountId is a random UUID with no link to any real-world identity, this does not constitute a privacy risk unless a user voluntarily identifies themselves to those websites.
We retain data only as long as necessary:
Database backups are taken every 6 hours and retained for 7 days, then permanently deleted.
Because we store no personal data as defined by GDPR, most GDPR rights (right to access, right to erasure, etc.) do not technically apply — there is no personal data to access or erase.
However, if you wish to remove all trace of your account from our systems, you can use the "Logout from all devices" feature at id.yaphub.xyz/profile. This will invalidate all your sessions. Your account hash will remain in the database but is not linked to any personal information.
For complete account deletion requests, contact us at Support Chat. We will delete the account hash, effectively making the account unrecoverable.
Our full source code is available at github.com/YapID. You can verify every claim in this Privacy Policy by reading the code.
We take security seriously and implement industry-standard protections:
If you discover a security vulnerability, please report it to Support Chat.
YapID uses the following third-party services:
We are actively working to self-host these dependencies to eliminate all third-party connections.
YapID does not knowingly collect any information from children under 13 years of age. Because we collect no personal data, we cannot determine user ages. If you are under 13, please do not use this service.
We may update this Privacy Policy from time to time. We will notify users of significant changes by updating the "Last updated" date and posting a notice on our website. Continued use of the service after changes take effect constitutes acceptance of the updated policy.
For privacy-related questions or requests: