Privacy

Four things, and nothing else:

• Your Apple ID subject identifier. When you sign in with Apple, Apple gives us a pseudonymous identifier for you that is unique to this app. It is how we recognise you on your next launch or on another device. It is not your Apple ID, your name, or your phone number.
• An email address, if you share one. Sign in with Apple lets you hide your address behind an Apple relay. If you choose that, we only ever see the relay address. If you share nothing, we store nothing.
• The photos in recaps you publish. Publishing a week uploads two renditions of each chosen photo — a small thumbnail and a long-edge 2048 px version. Location and camera metadata (EXIF and GPS) are stripped on the phone, before the upload starts.
• Device information. Platform, device model, OS version and app version, so we can tell which builds are in the wild and keep your sessions apart. Plus ordinary server request logs, which include IP addresses and are kept for a short period for security and debugging.

Alongside those, we store the parts of the app’s own state you choose to sync — your saved posts, the list of recaps, and your moment overrides — so a new phone picks up where the old one left off. Those are opaque blobs to us; we never inspect them.

• Your photo library. Yesterday reads it through Apple's Photos framework on the device and copies nothing.
• The search index. Yesterday builds a semantic index of your photos on the device, in the app's own storage. Those vectors are never uploaded.
• Your searches. The text you type is matched on the device. We do not see it, log it, or send it anywhere.
• Location history, contacts, health data and advertising identifiers. The app does not collect any of them and there is no advertising SDK in it.

A published recap gets a link with a random ten-character identifier. Anyone who has the link can open the page; nobody can guess it. The pages tell search engines not to index them, and our media bucket is never public — every image on the page is served through a signed URL that stops working fifteen minutes after it was issued.

Unpublishing a recap takes the page down and deletes the uploaded renditions from storage. You can do that from the app or from your account page. If you believe a recap should not be online, see reporting a link.

• Export. You can download everything we hold about you as a JSON file, from the app or from your account page on the web.
• Deletion. Deleting your account marks it immediately and unpublishes your recaps. A scheduled job then removes your database rows and every uploaded object within 30 days.
• Session tokens. On the web, your tokens live in memory and in the tab’s sessionStorage. They are gone when you close the tab, and we do not set cookies for them.

• Apple, for Sign in with Apple. We verify the identity token Apple issues against Apple's public keys.
• Google Cloud, which hosts the API, the database and the media bucket.
• An error-reporting service, which receives crash and exception reports (stack traces and request identifiers, not your photos).

We do not sell data, we do not share it with advertisers, and we do not run ad or analytics SDKs that track you across apps.

Yesterday is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has created an account, write to us and we will delete it.

If this policy changes in a way that affects what we collect, we will say so in the app before the change takes effect. Questions about any of it go to (no support address configured — set SUPPORT_EMAIL).