Privacy Policy

This Privacy Policy explains what information Yes Yes Y'all ("we", "us", or "our") collects when you use our website at yesyesyall.co (the "Website"), how we use it, and your choices. By using the Website, you agree to the collection and use of information in accordance with this policy and our Terms of Service.

1. Information We Collect

Information You Provide

• Account information: When you create an account, we collect your email address, username, and password (stored in hashed form). You may optionally provide your full name, location, Twitter handle, and a personal URL.
• Third-party sign-in: If you sign in using Google, or Spotify, we receive your name, email address, and profile image from those services. We do not receive or store your password from these providers.
• User submissions: When you submit a video link, we collect the YouTube video ID and metadata you provide (artist name, song name, category).
• Contact form: If you use our contact form, we collect your name, email address, and message content.
• Favorites: We record which videos you add to your favorites list.

Information Collected Automatically

• Signup data: When you create an account, we record your IP address and browser user agent string for security and fraud prevention.
• Session cookies: We use cookies to manage your authentication session. These are functional cookies necessary for the Website to operate and are not used for tracking or advertising.
• Server logs: Our hosting provider (Vercel) may collect standard server log data including IP addresses, browser type, and pages visited.

Information We Do Not Collect

We do not use analytics or advertising tracking services (such as Google Analytics or ad networks). We do not use localStorage or sessionStorage to persist personal data in your browser. We do not sell your personal information.

2. YouTube API Services

The Website uses YouTube API Services to display and play music videos. By using the Website, you are also subject to Google's Privacy Policy.

When you watch a video on the Website, the YouTube IFrame Player loads content directly from YouTube's servers. YouTube may collect information about your viewing activity in accordance with Google's Privacy Policy. This data collection is governed by Google, not by Yes Yes Y'all.

We use the YouTube Data API on our servers to look up video metadata (title, thumbnail) when users submit video links. This server-side API usage does not expose your personal information to YouTube beyond what occurs through normal video playback.

You can manage your YouTube/Google privacy settings and revoke access at Google Security Settings.

3. How We Use Information

• Providing the service: To operate your account, display your profile, manage your favorites, and process your video submissions.
• Authentication: To verify your identity and maintain your session.
• Transactional emails: To send email verification links, password reset emails, and contact form confirmations via our email provider (Resend).
• Security and fraud prevention: To protect against unauthorized access, rate-limit abusive requests, and detect suspicious activity.
• Content moderation: To review user submissions for compliance with our Terms of Service.
• Social sharing: Editors and administrators may share approved video submissions to Bluesky. Shared posts contain only video metadata (title, artist, link) and do not include your personal information unless you are credited as the submitter by username.

4. Third-Party Services

We use the following third-party services to operate the Website. Each service receives only the minimum data necessary for its function:

5. Cookies and Session Management

The Website uses a limited number of cookies strictly necessary for functionality:

• Authentication session cookie: A secure, HTTP-only cookie containing an encrypted JWT (JSON Web Token) that keeps you signed in. This cookie is set when you log in and removed when you log out.
• CSRF token cookie: A cookie used to protect against cross-site request forgery attacks during form submissions.
• YouTube cookies:When you play a video, YouTube may set its own cookies in accordance with Google's Privacy Policy. These cookies are controlled by Google, not by Yes Yes Y'all.

We do not use advertising cookies, analytics cookies, or any third-party tracking cookies.

6. Data Sharing and Disclosure

We may share your information in the following circumstances:

• Service providers: With the third-party services listed above, solely to operate the Website.
• Legal requirements:When required by law, subpoena, or legal process, or to protect the rights, property, or safety of Yes Yes Y'all, our users, or others.
• Public profile information: Your username, display name, location, and user submissions are visible to other users of the Website. Your email address is not publicly displayed.

We do not sell, rent, or trade your personal information.

7. Data Retention

We retain your account information for as long as your account is active. If you request account deletion, we will remove your personal information, though we may retain certain data as necessary to comply with legal obligations, resolve disputes, and enforce our agreements. Server logs maintained by our hosting provider are retained according to their own data retention policies.

8. Data Security

We take reasonable measures to protect your information, including:

• Passwords are hashed using bcrypt and never stored in plain text.
• Authentication sessions use encrypted JWT tokens transmitted over HTTPS.
• Login attempts and contact form submissions are rate-limited to prevent abuse.
• Email verification is required for new accounts.

However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

9. Your Rights and Choices

• Update your information: You can update your profile information at any time through your account settings.
• Delete your account: You may request account deletion by contacting us through our contact page.
• YouTube/Google data: You can review and revoke access to your data through Google Security Settings.
• OAuth connections:You can disconnect third-party sign-in services (Google, Spotify) through each provider's settings page.

10. California Privacy Rights

If you are a California resident, you have the right to request information about the categories of personal information we have shared with third parties for their direct marketing purposes, if applicable. We do not share personal information with third parties for their direct marketing purposes.

11. Children's Privacy

The Website is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will take steps to delete that information. If you believe a child under 13 has provided us with personal information, please contact us through our contact page.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the version number at the top of this page. We encourage you to review this Privacy Policy periodically. Your continued use of the Website after changes are posted constitutes your acceptance of the updated policy.

13. Contact

If you have questions or concerns about this Privacy Policy or our data practices, please contact us through our contact page.