YoloPrivacy Policy
Yolo is a self-hosted media service. Everything it knows about you lives on servers you run yourself: your own Cloudflare account and your own home machine. Yolo's developer runs no server for your instance, receives none of your data, and has no analytics, advertising, or tracking in any Yolo app.
This policy covers every Yolo client: the player in a browser (its car profile for a Tesla's browser and its web profile for computers and phones), Yolo TV for Apple TV, and future clients such as an iPhone app. It also covers this website.
In short. A Yolo app talks only to the Yolo server whose address you give it, which you deployed yourself, and to your media node at home. Nothing is sent to the developer or to any third party by the app. Your viewing history, progress, devices, questions to your agent, and share links are stored in your own Cloudflare account, which you control and can delete at any time.
Who "you" and "the owner" are
Each Yolo instance has one owner, the person who deployed it from the open-source code to their own Cloudflare account and home machine. The owner is the controller of everything their instance stores. Yolo's developer, Haitian Liu, publishes the code and the apps but operates no instance for anyone and cannot see into yours.
Where your data lives
- The control plane runs as a Cloudflare Worker in the owner's own Cloudflare account. Its database (Cloudflare D1) and its logs (Workers Logs) belong to that account.
- The media node runs on the owner's home machine. It reads the owner's media, prepares streams, and runs the plugins the owner chose to load.
- Each screen keeps only its own sign-in credential and a few display preferences on the device itself.
Cloudflare hosts the owner's control plane under the owner's own agreement with Cloudflare, as a hosting provider for the owner; see Cloudflare's privacy policy.
What the owner's server stores
| Data | Why |
|---|---|
| Watch history and playback position | To resume where you left off on any screen, and to show recently watched items. |
| Queue, playlists, and subtitle and audio track preferences | To play what you lined up, in the languages you prefer. |
| Paired screens: the name and type you gave each one, and a hash of its credential | So each screen is recognized, and can be removed at once. |
| The owner's passkeys (public keys only) | To sign the owner in to settings and to approve new screens. |
| Questions asked through Ask, and the agent's short answers | To show a conversation and continue it. The agent's reasoning and tool results are not stored; conversations idle for 90 days are dropped. |
| Share links: a hash of each link, the item, and how often it was played | So the owner can see and revoke the links they made. Links expire after 7 days. |
| Playback diagnostics from the browser player | Written to the owner's Workers Logs, not to the database, to diagnose stalls and errors. Secrets are stripped before sending. They never include voice recordings or the words you said. |
What each client sends
The browser player (car and web profiles)
- To the owner's server: requests to browse, search, and play; playback reports (position, state, errors); the device credential it was given when paired; and the diagnostics described above, including the browser's user agent, screen size, and media capabilities, so the right stream can be chosen.
- To the owner's media node: requests for video and subtitle data, by the LAN address at home or the node's remote address when one works.
- It stores its credential and display preferences in the browser's local storage.
Yolo TV (Apple TV)
- To the owner's server and media node: the same browsing, playback, and progress requests as the browser player. Yolo TV sends no diagnostics or analytics of its own.
- It keeps the server's address and its credential in the Apple TV's Keychain.
- Images, subtitles, and video are loaded only from the owner's own server and node.
Future clients
New clients, such as an iPhone or iPad app, speak the same client protocol to the owner's own server and follow this policy. If a new client ever sends anything not described here, this policy will be updated before that client is released.
Local network access
Yolo TV, and future Apple clients, ask for permission to use your local network for two reasons:
- Finding your server. Your media node advertises its Yolo server on your home network by Bonjour (
_yolo._tcp), so the app can offer it instead of asking you to type an address. - Playing at home. When the screen and the media node are on the same network, video goes straight from the node to the screen instead of over the internet.
The app does not scan for, or report, any other device on your network.
Ask and voice
Ask lets a screen hand a request, such as "play the next episode", to the AI agent the owner installed on their home machine (for example Claude Code or Codex).
- A typed or spoken question goes to the owner's server and then to that agent on the owner's machine. The agent runs under the owner's own account with its provider, so that provider's terms and privacy policy apply to what the agent processes. Yolo's developer receives nothing.
- Voice in the browser player. When the owner's node has a transcription plugin, the player can record your request with the microphone, after the browser asks your permission. The recording (at most 30 seconds) passes through the owner's server to that plugin on the owner's node, and only the resulting words come back. The recording is never written to disk, logged, or stored. The transcription plugin is one the owner chose and configured; it may run on the owner's own machine or call a speech service the owner set up.
- Voice on Apple TV. Yolo TV does not record audio itself. Dictating with the Siri Remote uses Apple's system dictation, which Apple handles under its own privacy policy, and only the resulting text reaches Yolo.
Share links
The owner can make a link that lets a friend watch one item in a browser for 7 days, without pairing. A friend's page plays only that item; nothing the friend does is added to the owner's history or progress, and the friend is not identified. The owner's server counts how often each link is played.
Plugins and agents the owner chooses
The media node loads plugins the owner configures: media sources, AI subtitles, transcription, and agents. A plugin may contact the service it is for (for example, a source plugin fetches a video from the site it comes from). The owner can also connect an AI assistant to their server over MCP. These connections are made by the owner's own server under the owner's own accounts, not by the Yolo apps, and not by Yolo's developer.
What Yolo's developer collects
Nothing. The Yolo apps contain no analytics, crash-reporting, or advertising software, do not track you across apps or websites, and send nothing to the developer. Apple may share crash reports and usage statistics with developers if you choose to allow it in your device's settings; that is governed by Apple's privacy policy. This website is static, sets no cookies, and runs no analytics.
If you email support or open a GitHub issue, the developer sees what you send. Please do not include media tokens, device credentials, or personal data you do not wish to share.
Your control over your data
- Remove a screen in Yolo's settings, and its credential stops working at once and the screen returns to pairing.
- Revoke any share link in Settings → Share links.
- Delete conversations, history, and everything else by deleting the D1 database and Worker in your own Cloudflare account, and the data on your home machine.
- Deleting a Yolo app from a device deletes what it stored there; on Apple TV, remove the screen in Yolo's settings too, since the Keychain may keep its credential.
Children
Yolo is not directed to children. What plays on a screen is the owner's own media and choices.
Changes
Changes to this policy are published on this page with a new effective date, and their history is in the public repository.
Contact
Questions about this policy: support@useyolo.app, or GitHub Issues.