Privacy Policy

Account information

Your name, email address and avatar. If you sign in with Google or GitHub we receive your basic profile from that provider (for GitHub, also your username). If you sign in with an email and password, we store the password only as a salted bcrypt hash. If your company uses Okta single sign-on, we receive your profile from Okta. People who join through a guest link give a name and email address.

Sign-in and security data

A session token keeps you signed in. It is stored in the extension’s storage or your browser’s local storage and sent with each request. We store the IP address and browser user agent of sign-ins and of key actions, such as creating a thread, to secure accounts and investigate abuse.

Comments and threads

When you pin a comment we store your message, a screenshot of the visible part of the page, and details of the element you clicked: its CSS selector, DOM path, attributes, computed styles, framework hints, and the first 100 characters of its text (for a form field this can include its value or placeholder). We also store the page URL and title, the viewport size and the click position. Replies, @mentions and reactions are stored with the thread. Your team can see all of this.

Page addresses

On pages where Yocoolab is on, the extension sends the address of each page you open, including navigation inside a web app, to our servers to find the matching project. In Chrome and Edge, Yocoolab is on in a tab when you open it from the toolbar, the keyboard shortcut or the right-click menu, and on sites you choose to keep it on for. In Firefox, the add-on has access to http and https sites from install, so while you are signed in it loads on the pages you open and sends each page address. You can turn that access off in Firefox under Add-ons and themes, then Permissions.

Live presence

While the comment panel is open on a shared project, your cursor position (sent about 25 times a second) and whether you are typing go to our servers and are shown live to teammates on the same page. We do not record keystrokes.

Usage events

The extension sends events about which features are used, such as opening the panel or clicking a button, with the page URL. We store them to keep the service working and to improve it.

AI features

When you use an AI feature, such as turning a sketch into an HTML preview, generating variants of an element or asking the help assistant, the inputs (for example the screenshot or sketch, the element’s HTML and your prompt) are sent to an AI model that we host, to produce the result. If you set a local model (LM Studio) in the extension’s settings, generation runs on your own machine instead. When enabled on our servers, discussion summaries and voice transcription use OpenAI’s API, which then receives the thread text or the recording.

Send to Agent and the MCP server

Send to Agent marks a thread on our servers for your coding agent. The agent, connected through the Yocoolab MCP server on your computer, fetches the thread from our API with your token. The element-selection and companion features talk to that MCP server on your own machine, at 127.0.0.1:9800. What your coding agent does with the thread, and what it sends to its own AI provider (for example Anthropic, for Claude Code), is governed by that agent’s terms and privacy policy.

Settings on your device

Interface preferences, such as the panel position and theme, are kept in the extension’s storage on your device.

• To run the service: store comments, place pins on the right element, and show threads to your team
• To find which project a page belongs to
• To notify teammates of replies and @mentions
• To sign you in, secure accounts and prevent abuse
• To send email you need, such as invitations and password resets. We do not send marketing email
• To keep the service reliable and to fix problems

We do not sell your data, and we do not use it for advertising.

• Railway: hosts our servers and the PostgreSQL database
• Resend: delivers our email, so it receives the recipient address and the message
• Google, GitHub and Okta: when you sign in with them
• OpenAI: discussion summaries and voice transcription, when enabled
• Tools your workspace connects: if an admin connects Pendo, Jira, Linear, Slack or Telegram, Yocoolab sends that tool the thread data it needs, such as the comment, element selector, page URL and, for Jira, the screenshot

We do not share your data with anyone else unless the law requires it.

• Traffic between the extension, the dashboard and our servers uses HTTPS
• Passwords are stored only as salted bcrypt hashes
• Access to the database is limited to the Yocoolab service and the people who operate it
• Workspace roles and project access decide who can see your comments

We keep your data while your account exists. There is no automatic deletion schedule.

You can delete your account yourself in the dashboard, under Settings, then Privacy & Data. Deletion happens right away: your profile, sessions, memberships, permissions, notifications and reactions are removed, and the text of your comments is replaced with “[deleted]”. Threads you started stay with your team, with their screenshots, so the team’s history is not broken.

• Download your data as JSON from Settings, then Privacy & Data: your profile, the threads you created, your messages and related records. For a full workspace export, email us
• Delete your account from the same page
• Turn Yocoolab off for a site, or remove the extension, from your browser’s extension settings
• Revoke Yocoolab’s access from your Google or GitHub account settings
• Email us to access, correct or delete your data

Yocoolab is a tool for software teams and is not directed at children under 16. We do not knowingly collect data from children.

When we change this policy we update the date at the top. For material changes we will also tell you in the product or by email.

For privacy questions or data requests, email contact@yocoolab.com.