yankPrivacy Policy — yank
Last updated: 2026-06-10 · applies to extension version 0.1.0+
TL;DR
yank runs in your browser. For free use there is no account and no server — we cannot see your data because there is nowhere for it to go.
- API keys, macros, conversation history, recordings — all stored
locally in your browser’s IndexedDB /
chrome.storage. They never leave your machine. - Network requests go to exactly two places: (1) the LLM provider you
chose in Settings (Anthropic / OpenAI / DeepSeek / OpenRouter / Qwen /
etc.);
- the websites you tell yank to operate on.
- No analytics, no telemetry, no error-reporting beacons.
- If — and only if — you subscribe to Pro, you sign in and we store the minimum needed to remember that you paid: an account identifier and your subscription status. Never your macros, keys, recordings, or browsing. See §5.
1. What we collect
For free use: nothing. yank has no analytics, no telemetry, no log pipeline reaching the developer. The author is one independent developer publishing an extension.
For Pro subscribers: the minimum required to operate a paid subscription — an account identifier and your subscription state. This is described in full in §5. It does not include any of the content yank works with (macros, chats, recordings, API keys, or the pages you automate) — those always stay on your machine.
2. What stays on your machine
| Data | Where | Why |
|---|---|---|
| LLM API keys | chrome.storage.local (encrypted at rest by Chrome) |
So you don’t re-enter them every session |
| Saved macros | IndexedDB on your profile | The whole point — your “second run is free” library |
| Chat history | IndexedDB | So you can scroll back / resume conversations |
| Recordings | IndexedDB | Raw event traces used to generate macros |
| Cost log | IndexedDB | “$X spent / $Y saved this month” stats in Settings |
| Settings | chrome.storage.local |
Provider preferences, language, etc. |
All of the above is removed when you uninstall the extension (Chrome wipes extension storage on uninstall). You can also clear it manually via Settings → “Reset all data” or by deleting the extension’s IndexedDB database in DevTools.
3. What leaves your machine
For free use, two destinations only:
3.1 The LLM provider you configured
When yank needs the AI (Mode A turns, self-heal, macro generation), it sends a request to the API endpoint of the provider you picked in Settings. The request includes:
- The system prompt for the task (Mode A / failure-to-patch / etc.)
- Your conversation history with yank (so the AI has context)
- Any screenshots you let it take during Mode A
- The user message you typed
This is your provider, not ours. Your data is governed by their privacy policy. They are paid via your own API key — yank never proxies, never sees the response in transit.
Supported providers and their privacy docs (the ones you’d actually use):
- Anthropic: https://www.anthropic.com/legal/privacy
- OpenAI: https://openai.com/policies/row-privacy-policy
- DeepSeek: https://chat.deepseek.com/downloads/DeepSeek%20Privacy%20Policy.html
- OpenRouter: https://openrouter.ai/privacy
- Qwen / DashScope: https://help.aliyun.com/zh/legal/latest/dashscope-privacy-policy
If you use a self-hosted / “custom” OpenAI-compatible endpoint, requests go to wherever you pointed it. Same applies — yank doesn’t intermediate.
3.2 The website(s) you ask yank to operate on
When you tell yank “grab GitHub trending Rust”, it (a) loads
github.com/trending/rust in a tab, (b) reads the page DOM,
(c) types / clicks per your task. The exact same HTTP requests happen as
if you typed the URL into the address bar yourself — yank is just the
cursor.
yank does NOT:
- Send page content to any third party (other than the LLM provider you configured, see §3.1)
- Capture browsing activity from tabs you didn’t explicitly hand to yank (Mode A only acts on the tab you launched it from; Mode C only on the tab the macro targets)
- Inject tracking into pages
- Modify cookies, localStorage, or any data on pages it isn’t actively operating on
4. Permissions explained
The extension declares these permissions and uses them as follows:
| Permission | Why |
|---|---|
activeTab, tabs, scripting,
sidePanel |
Open the side panel; read DOM / click / type on the tab you handed yank |
storage |
Save your settings + API keys (local only) |
notifications |
Show “macro paused, click to resume” desktop notifications during long replays |
alarms |
Fire scheduled macro runs (Pro); keep the BG service worker alive while a recording or run is in flight |
downloads |
Save files when a macro downloads or exports data |
clipboardWrite |
Copy results (e.g. extracted data) to your clipboard |
identity |
Pro sign-in only — Google OAuth via the browser’s identity API. Unused if you never sign in |
| Host permissions for the LLM provider domains | Make API calls to OpenAI / Anthropic / DeepSeek / OpenRouter / Qwen |
<all_urls> |
Required so Mode A / Mode C can operate on any site you direct it to. yank only acts on tabs you explicitly attach it to — never background-scrapes |
Optional permissions (asked at runtime, not granted on install):
| Permission | When asked |
|---|---|
clipboardRead |
If a macro tries to read the clipboard |
bookmarks |
If a macro tries to read your bookmarks |
You can revoke optional permissions in Chrome’s extension settings page at any time without uninstalling.
5. Accounts & subscriptions (Pro tier)
Everything above describes yank in full for free users. Pro adds exactly one thing to the picture: a way to remember that you paid. Here is precisely what that involves.
5.1 Free tier — no account, fully local
If you never subscribe, you never sign in, and none of this section applies. yank stays 100% client-side as described in §1–§4.
5.2 Signing in
To unlock Pro you sign in with a third-party identity provider:
- Google — we receive a stable Google account ID (the
OpenID
sub) and your email address. We use the ID as your account key. Your email is used only to recognize your account and, if necessary, to contact you about your subscription — never for marketing, and never sold or shared. - Alipay (支付宝) — we receive a stable Alipay user ID only. No email.
We do not receive or store your Google/Alipay password, contacts, or any other profile data beyond the identifier (and, for Google, the email).
5.3 Payments — handled by Creem
Payments are processed by Creem (https://www.creem.io), acting as the Merchant of Record. This means:
- Creem — not yank — collects and processes your payment details. Your card number / payment credentials never touch yank’s systems.
- Creem is responsible for billing, invoicing, and collecting and remitting any applicable sales tax / VAT.
- Creem’s handling of your data is governed by Creem’s privacy policy. Please review it before purchasing.
When you subscribe, yank passes your account identifier to Creem so the payment can be tied back to your account. Creem notifies yank’s licence service of your subscription status; yank stores that status against your account identifier (see §5.4).
5.4 What yank’s licence service stores
A small backend, operated by the developer, stores only:
- Your account identifier (Google
sub, or Alipay user ID; plus, for Google sign-in, your email address) - Your subscription tier and status (e.g.
active/cancelled/expired) - Subscription validity dates and the Creem subscription/order ID (for reconciliation and to prevent double-processing)
That’s the whole record. Its only purpose is to answer one question when you open yank: “is this account currently Pro?”
5.5 What it never stores
The licence service does not receive or store: your macros, recordings, chat history, LLM API keys, the websites you automate, your browsing history, or any page content. All of that remains local to your browser, exactly as for free users.
5.6 Where it’s hosted
The licence service and its data store are hosted in Singapore (Tencent Cloud).
6. This website (yank.xassistant.cc)
The marketing site is static and first-party only. It sets no
cookies, runs no analytics, ads, or third-party
trackers, and makes no network calls off its own origin. The
only thing it keeps in your browser is a small functional
preference — your chosen language — stored in
localStorage so the site remembers it next time. Nothing
there identifies or tracks you, which is why no cookie-consent banner is
shown.
7. Your rights
Because almost everything lives on your own machine, you are mostly in direct control:
- Local data — export or wipe it any time via Settings (and uninstalling removes all of it).
- Account data (Pro only) — you can request access to, correction of, or deletion of the account record described in §5.4 by contacting us (see §10). Deleting your account removes that record; it does not affect your locally stored macros.
We honour access and deletion requests regardless of where you live; if you are in a jurisdiction with specific data-protection rights (e.g. GDPR / CCPA), those rights apply to the limited account data in §5.4.
8. Children’s privacy
yank is a developer tool for adults. It’s not directed at children under 13.
9. Changes to this policy
If the data practices change, this file is updated, its “Last updated” date is bumped, and the extension’s options page surfaces a notice. The policy that applies to any given release is whatever this file says at that release tag in the repository.
10. Contact
This is an indie project. Issues and questions:
- Email: ylx2020@gmail.com
For LLM-provider-specific or payment-specific questions (your data with them), contact the provider or Creem directly — yank cannot answer for them.
Summary in one line: BYOK + 100% client-side for free; Pro adds only an account ID and “are you paid?” — your data, your machine, your LLM bill.