youish

Privacy

Last updated: 30 September 2026

This notice explains what the operator of youish (“youish”, “we”, “us”) collects when you use youish.app, why we collect it, and the choices you have. It covers the journal, the letter workshop, practice, stories, and the contact page.

In short

  • Your journal is private. After you create a journal password, we cannot read the title or the text.
  • We do not sell your information. We do not use your journal to train AI models.
  • When you generate signs, the drawing you submit is sent to Replicate. The journal is not.
  • You can delete the account on this page. A forgotten journal password cannot be restored.
  • The minimum age depends on the country where you live. Under 18, a parent or guardian must agree.

Who we are

youish is a private journal for signs you invent. We do not take payment. Questions about this notice go to info@youish.app.

Information you give us

Account. When you create an account we store your name, email, a hash of your account password, and the time you last signed in. We do not store the account password itself. We cannot show it to you. If you forget it, write to us from that email and we can help you set a new one.

Journal. The journal is private to your account. We do not publish it, and other accounts cannot open it. There is no control that makes an entry public or visible to a search engine.

The journal password is separate from the account password. You create it in your browser and enter it twice. We do not receive that password, and we do not keep the key that opens the journal. The key stays in memory on that device only until you leave or refresh.

Until you create the journal password, the title and text of an entry are stored so your account can load them. After you create it, the title and text are encrypted in the browser with AES-256-GCM before they are saved. We store that encrypted text and the wrapped key material your browser needs to open it with the journal password. We cannot read it. If you forget the journal password, we cannot open the entries. There is no recovery code. A request from you, from support, or from a government cannot produce the title or the text, because we do not have the key.

Some fields stay outside the encrypted text so the journal can still be organised: tags, the time an entry was created or updated, alignment, line spacing, and letter spacing.

Letter workshop and practice. Letter maps, glyphs, fonts you generate, the reference style you select, practice progress, ink colour, text size, and keyboard layout are stored with the account. The journal password does not lock them. Uploaded sheets stay in this browser. They are not copied into the account.

Contact. A message from the contact page, or an email to info@youish.app, includes your name, an email if you give one, and the message. We keep it so we can read it and reply. It is not added to your journal, and it is not encrypted as a journal entry.

We do not collect payment card numbers. We do not offer sign-in with Apple or Google. We do not ask for your contacts, precise location, motion, or fitness data.

Information collected automatically

The site loads a Google tag. Google may receive technical information about the visit, such as the page address, browser, and device data, and may use cookies. We use that to understand how the site is used. We do not send your journal text, letter maps, or passwords to Google, and we do not combine the tag with your journal. Google’s use of that information is governed by Google’s policies: https://policies.google.com/privacy.

Our hosting provider may keep short technical logs of a request, such as an IP address, browser type, and the time of the request, so the site can run and so problems can be investigated. Those logs are not your journal.

This browser stores your session and your uploaded sheets on the device, using the browser’s own storage. Clearing the site data in the browser removes the sheets from that device.

You can set the browser to refuse cookies. The journal still works. Measurement of visits may not.

How we use it

We use this information to:

  • Create your account and show your journal, letter map, glyphs, fonts, and practice back to you
  • Encrypt the journal title and text in your browser after you set a journal password, and store the encrypted result
  • Generate signs from a drawing you submit
  • Reply when you write to us
  • Keep the service secure, and look into abuse or a broken account
  • Understand, in technical terms, how the site is used, so we can fix it
  • Meet a legal duty

We do not sell personal information. We do not share it for cross-context behavioural advertising. We do not send marketing email. We do not read a locked journal, and we do not ask you to paste a journal entry into a support message.

Sign generation and AI

When you generate signs, the drawing you submit is sent to Replicate so Flux can finish that job. We do not send your journal, your email, or your passwords. Replicate may process the image outside your country, including outside the European Economic Area. The drawing is used to finish that job. We do not keep it next to your email.

Your journal is not processed by an AI model. We do not use journal titles, journal text, letter maps, or glyphs to train a language or image model. A generated sign is not promised to be unique. It may resemble a known letter or someone else’s mark.

Who else receives information

We share information only in these cases:

  • Providers who run the service. Hosting and the account database store the account and the saved work, including encrypted journal text. Replicate receives the drawing for a sign-generation job. Google receives the visit data described above. They may use that information only to provide their service to us.
  • A legal duty. We may disclose information if we believe in good faith that the law, a court, or an authority requires it, or to protect someone from an imminent risk of serious harm. We limit what we disclose to what the request requires. A locked journal still cannot be decrypted by us.
  • A transfer of the service. If youish is transferred to a new operator, this notice continues to apply to your information. We will tell you if that happens.
  • With your direction. If you ask us to send something to someone else, we do that only for the thing you asked us to send.

We do not sell information to advertisers, data brokers, or other apps. Information that cannot reasonably identify you may be used to understand the service.

Why we are allowed to use it

If the GDPR, UK GDPR, or a similar law applies to you, we use your information on these grounds:

  • The use is needed to provide the service you asked for, such as keeping your account and returning your saved work
  • The use is needed to meet a legal duty
  • We have a legitimate interest in keeping the service secure and understanding technical failures, where that interest is not overridden by your rights
  • You have agreed, where agreement is required, including where you are under 18 and a parent or guardian agrees for you

Where data is kept

Account data is stored by our hosting and database providers. Those providers may be outside the country where you live. Encrypted journal text is stored as ciphertext. Sheets stay on your device. Drawings for sign generation are processed by Replicate. Visit data from the Google tag is processed by Google.

If you are in the EEA, the United Kingdom, or Switzerland, you can ask us at info@youish.app which safeguards apply when information leaves your country.

How long we keep it

The account, journal, letter maps, glyphs, fonts, practice progress, and last sign-in time stay until you delete the account. We do not keep them for a marketing list. Sheets stay on this device until you clear them or delete the account. Contact messages stay so we can read them and reply. You can ask us to delete a contact message.

Delete account removes your account and saved work from the account store. There is no recovery window after that. A backup held by a hosting provider may remain for a short time under that provider’s backup cycle, then drop out of it. We do not use a backup to restore an account you deleted, unless a legal duty requires us to keep a record. A locked journal is deleted as ciphertext. Deletion does not decrypt it.

Technical logs are kept only as long as the host needs them to run and protect the service, and then discarded.

Security

No online service is perfectly secure. We take reasonable care to protect information against unauthorised access, loss, and alteration. The journal lock is the stronger protection: after you set the journal password, the title and text are encrypted in your browser, and we do not hold the key. You are responsible for that password.

Your choices

While you are signed in, Delete account on this page removes the account data we store: email, letter maps, glyphs, fonts, practice progress, and the journal. It also clears the sheets saved on this device.

You can refuse cookies in your browser. You can ask us to delete a contact message. We do not send marketing email, so there is no marketing list to leave.

Your rights

Depending on where you live, you may have the right to access personal data we hold, correct it, delete it, restrict or object to some uses, and receive a portable copy of what we hold. You may also complain to a data-protection authority. In the EEA, a list of authorities is at https://edpb.europa.eu/about-edpb/board/members_en. In the United Kingdom, the authority is the ICO: https://ico.org.uk/global/contact-us/. In Switzerland, it is the FDPIC: https://www.edoeb.admin.ch/edoeb/en/home/the-fdpic/contact.html.

After the journal is locked, a copy we can give you of the title and text is still ciphertext. We cannot turn it back into writing.

In some US states, including California, Colorado, Connecticut, Utah, and Virginia, you may also ask for the categories of personal information we collect and the categories of third parties we share it with, and you may appeal a refusal. We do not sell or share personal information as those laws define those words. We do not knowingly sell or share the personal information of anyone under 16. We do not use sensitive personal information to infer characteristics about you.

The personal information we collect, depending on what you use, falls into these categories: identifiers such as name and email; information you create, such as a journal, glyphs, and letter maps; internet or device activity from the Google tag and host logs; and images you submit to generate signs. Sources are you, your browser, and those providers. We use and keep the information as this notice describes.

To use a right, email info@youish.app from the email on the account, or use the Contact page. We need to know the request is from the account holder before we disclose or delete anything. You may name someone to ask for you if you give us written permission. We will say yes or no in writing. If we say no, you can reply and ask for an appeal. Someone who did not handle the first request will review it. If the appeal is also refused, we will tell you, and in some US states you can take that refusal to the state attorney general.

We will not ask you for the journal password, and a privacy request cannot open a locked journal. We do not treat you differently for asking.

Age

youish is not directed at children. The age to create an account is the age where you live. We do not open an account for anyone under 13, in any country.

  • 13: Belgium, Estonia, Finland, Iceland, Latvia, Malta, Norway, Portugal, Sweden, the United Kingdom, and the United States.
  • 14: Austria, Bulgaria, Cyprus, Italy, Lithuania, and Spain.
  • 15: Czechia, Denmark, France, Greece, and Slovenia.
  • 16: Croatia, Germany, Hungary, Ireland, Liechtenstein, Luxembourg, the Netherlands, Poland, Romania, and Slovakia. For a country that is not listed, the minimum is 16, unless that country has set a different age by law.

If the law where you live requires an older age than the one listed, that older age applies. If you are under 18, a parent or legal guardian must agree to the terms and to this notice for you, including where the privacy age above is 13, 14, or 15. The UK Children’s Code and similar rules treat anyone under 18 as a child.

If we know that an account belongs to someone under the age for their country, or to someone under 18 whose parent or guardian has not agreed, we close the account and delete the personal data we hold for it. In the United States, COPPA applies under 13. California and some other states add limits on selling or sharing data about people aged 13 to 15 and, in some laws, under 16 or under 18. We do not sell or share that data.

Changes

We may update this notice. The date at the top will change. If a change is significant, we will also show a notice in the service when we reasonably can. Continuing to use youish after the update means the new notice applies. If you do not agree, stop using the service and delete your account.

Contact

Email info@youish.app, or use the Contact page.