Last updated: October 27, 2026 · Yeeted (beta) · see also the Terms of Service and the Cookie Policy
When you create an account we collect your email address, a hash of your password (we never store the password itself), a record of your acceptance of our terms (timestamp and terms version), and your data access choice (what you allow Yeeted staff to see) with a history of every change to it, and your email preferences (which optional emails you want from us) with a history of every change to them. When you use the service we store the things you deploy: your application code and built images, the contents of managed databases you attach, secrets you set (encrypted at rest), application logs and metrics, and an audit trail of every account action, whether it was made in the dashboard, by an agent or through the API (who did what, when, from which IP address and with which browser or client). When you visit our websites we record how you found us (the ad or link you arrived from) and how you used the site, as described under Advertising and analytics. Payment details for paid plans are collected and processed by our payment provider - card numbers never touch our systems.
We use this data to operate the service - running your deployments, storing and serving your data, showing you your logs and metrics, securing accounts, preventing abuse, and billing paid plans - and to understand how people find and use Yeeted, including which of our advertising campaigns work, as described under Advertising and analytics. Whether our staff may look at your code, data, logs or metrics is up to you, as described under Data access below. We do not sell personal data, share it with advertising platforms, use it to show you targeted ads, or train models on your code or data.
Account email is always sent, because the account cannot work without it: verification codes, password resets, security notices and billing. Everything else is optional, and you choose when you sign up and can change it at any time on your Profile:
Every optional email has a link to unsubscribe from that kind of email, without signing in. We keep a record of each change to these choices (what changed, when, and whether it was made at signup, on your Profile or through an unsubscribe link) as evidence of what you agreed to.
When you deploy, we store your source code (and the images built from it) because we have to in order to build, run, relaunch, and roll back your application. That is automated platform operation. Whether a person at Yeeted may read it is your choice, described next.
Connecting a git host is optional: every project has Yeeted's own git. If a project owner connects GitHub, Bitbucket, GitLab or Codeberg on the Git connections page, we store, for that host: the access token and refresh token the host gives us (encrypted at rest, never shown to anyone, including you and your agents), your account id and user name on the host, the permissions it granted, the list of repositories connected to your projects, and for each connected project the webhook secret the host uses to notify us of a push.
We use the access only for the repositories you or your agent connect to a project: to fetch their
code to deploy it, to push to them when you choose to, and to add and remove the push webhook. We do not
read or change any other repository, even where the host's permission would reach it. The permissions
we ask each host for are the narrowest it offers for that: on GitHub repo and
admin:repo_hook; on Bitbucket account read, repositories write and webhooks read and
write; on GitLab api; on Codeberg write:repository and
read:user.
When you disconnect a host, we remove our webhooks from your repositories, ask GitHub or GitLab to revoke our access, and delete the tokens straight away. Bitbucket and Codeberg do not let us revoke our own access, so after disconnecting, remove Yeeted under App authorizations in your Bitbucket settings, or under Applications in your Codeberg settings. Your projects keep their code and versions, and we keep the host user name and the list of connected repositories so they can show that the host needs reconnecting. Deleting a project removes it from that list, and closing your account removes all of your connections, as described under Retention and deletion. Your data download lists your connections and repositories, never the tokens.
You choose whether Yeeted staff may look at your code, data, logs and metrics. You make the choice when you sign up, and you can change it at any time on Profile, under Data access. A change takes effect immediately. It is off by default: unless you turn it on, our staff tools refuse to show any of it.
The four things you can allow:
And why we may look:
Yeeted may need this access to give you support help. If you have not allowed it, we may not be able to tell a platform problem apart from a problem in your app, and we will tell you which kind of access would help.
What the choice does not change. Automated platform operation is not staff access and is not affected: building, running, storing and backing up what you deploy, and collecting logs and metrics so the product works for you (for example, so you can see them in your dashboard and your agent can read them). Our staff still see the account and project details needed to identify your account and run the platform: ids, names, plan, status, domains, how you signed up, your region, and the health of the servers your apps run on. Support staff can also see your account settings (your email preferences and data access choice, each with its history, and which version of the terms you accepted and when) so they can answer your support questions.
Abuse and legal exceptions. A Yeeted administrator may override your choice to investigate abuse or when the law requires it. An override needs a written reason, and it is recorded in our staff audit trail with the reason, what was looked at, and whose account it was. Support staff cannot override.
Every staff action on your account is recorded, and it appears in your own Activity as "Support". The one exception is an abuse or legal override: it is recorded in our staff audit trail with its reason, but it is not shown in your Activity or your data export, because telling the subject of an investigation would defeat it. We never use your code or data to train models or to build competing products.
Please don't push anything sensitive or proprietary. Yeeted is a beta platform, and even with data access off an administrator can look in an abuse or legal case. Put credentials in Secrets (encrypted at rest and injected at runtime) rather than in your code, and don't deploy trade secrets, third-party confidential material, regulated data, or anything whose exposure would harm you or someone else.
Your account is homed to one geographic area (for example the US or the EU) when you sign up. Everything you deploy or store - applications, databases, logs - remains physically within that area and is never moved or replicated outside it. Account and login records are held in our global authentication system so you can sign in from anywhere. EU hosting isn't available yet: an account that chooses Europe at signup is hosted in North America, and signup asks you to acknowledge that first.
We advertise Yeeted on Google, Meta (Facebook and Instagram), Reddit, ChatGPT and other sites, and we measure which ads and links bring people who go on to use Yeeted. We do this in our own systems.
When you arrive. When you open one of our pages from an ad, a tagged link, a search engine or
another site, our server reads the address of the page you asked for. It records the campaign details in
that address (the utm_ tags and the ad platform's click id, such as gclid,
fbclid or rdt_cid), the site that sent you, the page and the time. It also
records the IP address and browser details that come with the request (such as browser type and language)
to tell people apart from bots and attacks. Requests that probe our servers for weaknesses are recorded
the same way. Nothing is read from or stored on your device for this, so it
happens whether or not you accept the consent banner. We do it under our legitimate interest in knowing
which campaigns work and keeping automated traffic out of our numbers. The IP address, browser details
and click id are removed after 30 days. These records are counted per campaign and are not linked to you
across pages or visits.
If you accept analytics. We set one first-party analytics cookie with a random identifier, listed in the Cookie Policy, and load Google Analytics. Only then do our pages tell us which pages you view on our sites, how long you spend on each and whether you use it, so we can see the first and the most recent ad or link you arrived from. Before you accept, and after you decline, our pages send us none of this.
Linking your visits. If you have accepted analytics, signing up or signing in to the dashboard links your earlier visits to your account. Joining the waitlist links them to your waitlist entry, and later to your account. Connecting an agent does not link your visits. If you have not accepted, nothing is linked.
Product milestones. For every account we record, from our own records, when it reaches milestones such as verifying its email, its first deploy, coming back on a later day and upgrading to a paid plan. We use this to improve the product, under our legitimate interest. It needs nothing from your device. It is linked to how you found us only if you accepted analytics. If you decline analytics while signed in, we stop recording your milestones and delete them.
What we never do. We do not send your personal data, your account details, or what you do on Yeeted to Google, Meta, Reddit, OpenAI or any other advertising platform, and we do not put their advertising pixels or tags on our pages. We do not build advertising audiences from your data. The only tool from such a company is Google Analytics: it runs only if you accept, with its advertising features off, and receives the pages you visit and basic details of your browser and device.
Your choice. Everyone sees the same banner, on the first visit to each of our sites (yeeted.ai, www.yeeted.ai and dashboard.yeeted.ai), and Accept and Decline are equally easy. When you follow a link between our sites your latest answer goes with you, so you are not asked again. You can change your answer at any time with Cookie settings at the bottom of every page. Withdrawing deletes our analytics cookie and the Google Analytics cookies and stops any further linking; what was recorded before is kept as described under Retention unless you ask us to delete it. We keep a record of each answer (what you chose, when, and which version of the banner you saw) as evidence, linked to your account if you have one. Declining changes nothing else about Yeeted.
We share data only with the service providers needed to operate: our payment processor (billing details for paid plans), our infrastructure providers (the servers your deployments physically run on, within your home area), our DNS provider, and our email delivery provider (the emails described above). Three services also load on some of our pages:
We do not share personal data with anyone else except where the law requires it.
The Cookie Policy lists every cookie and item of browser storage we set, what each one is for, whether it needs your consent and how long it lasts. In short: your login session (when you sign in) and a record of your answer to the banner (once you give one, kept 12 months) are set without asking, because the site needs them; the analytics cookies (kept 6 months) are set only if you accept.
You can download everything we hold about you (account record, email preferences and their history, projects, database metadata, billing history, your audit trail, and the analytics records linked to your account: your consent answers, your visits, how you found us and your product milestones) from your account at any time, and export full dumps of your databases in standard formats. You can correct your account details, close your account yourself, and request immediate erasure. You can withdraw consent at any time with Cookie settings, and object to what we do under our legitimate interests by writing to us. If you are in the EU/EEA or UK, these correspond to your GDPR rights of access, portability, rectification, erasure and objection, and you can also complain to your data protection authority.
Access to the service is authorized through OAuth 2.0 - agents and scripts hold short-lived, revocable tokens, never passwords. Secrets are envelope-encrypted at rest, credentials are redacted from logs, and each customer's workloads run in isolated virtual machines on isolated networks.
Privacy questions or requests: [email protected].
Yeeted is a research preview; this policy will evolve with the product and material changes will be announced to account holders.