# Yujin Forge -- Privacy Policy

Effective date: 2026-06-04 (draft pending Pablo's approval +
publication on https://yujin.app/privacy)

Yujin Forge is a development tool. This page describes what data
it sends to Yujin servers, what we keep, and what we don't.

## Quick summary

- **BYOK chat** (`yf chat` with your own Anthropic / OpenAI /
  Gemini API key): nothing leaves your machine except the call
  to the LLM provider you chose. Yujin servers are not in the
  loop.
- **Managed flows** (3 of them: `spec-extract`, `spec-plan`,
  `ai-decorate`): your payload travels to `prompts.yujin.app`
  so we can compose the prompt + call Claude on your behalf.
  Required for these features to work.
- **Everything else** (verb dispatch, file I/O, voice, MCP
  bridges, audit log, agent runtime): local to your machine.

If you only use BYOK, this policy effectively does not apply to
you. Read on if you use any of the 3 managed flows.

## 1. What we send (managed flows only)

When you invoke one of these 3 flows:

| Flow | Triggered by | Payload sent |
|---|---|---|
| spec-extract | `yf chat` extracting structure from a spec doc | The spec text you supply (markdown, plain text, or a transcript) |
| spec-plan | `yf chat` generating a plan from extracted spec | The extracted spec object |
| ai-decorate | `yf migrate --ai-decorate` | The source HTML / JS being decorated to NAC-3 |

Every request also carries:
- Your `license_key` (so we can verify you're entitled to the
  flow and meter token usage).
- A `request_id` (so you can quote it to support when something
  fails).
- Forge CLI version (so we know which client capabilities you
  have).

Nothing else. We do NOT collect:
- Your local filesystem path, project name, or hostname.
- Other API keys you have stored in the vault.
- The contents of files you didn't explicitly pass into the
  flow.
- Telemetry of your editor / OS / IDE.

## 2. Why we send it

`prompts.yujin.app` composes the full prompt (using
Yujin-proprietary prompt engineering) and forwards it to
Anthropic's Claude. The resulting structured output is returned
to your CLI. The composed prompt itself is what we keep
server-side; your payload is the variable input that completes
it.

This server-side composition is what makes the 3 managed flows
deliver measurably better output than a naive Claude call.

## 3. What we keep -- and what we don't

**We keep, indefinitely**, the following metadata per request:
- `request_id`
- ISO timestamp
- License key (foreign key into your subscription)
- Per-flow status code (success / quota / claude-error / etc)
- Token usage (input + output token counts)
- Cost in fractional cents

**We DO NOT keep**:
- Your spec text, HTML, JS, transcripts, or any other content
  you sent as the payload.
- The composed prompt that included your payload (it lives in
  memory only for the request lifetime, then is discarded).
- Claude's response to you (we forward it; we don't store it).

The "we keep nothing" rule is enforced by infrastructure: the
request handlers run on stateless compute with no attached
persistent storage. Structured logs go to a log aggregator
with payload fields explicitly stripped at emit time.

## 4. Where data is hosted

- `prompts.yujin.app` runs on infrastructure managed by Yujin.
  Specific region + cloud-provider details are documented
  internally and disclosed on request to license holders via
  contact@yujin.app.
- Claude API calls go to Anthropic; Anthropic's privacy policy
  applies to those request bodies once they leave our server.
  We send only the composed prompt + the necessary parameters;
  we do not opt your data into Anthropic's model training.
- Logs are aggregated within the same hosting environment.

## 5. Who at Yujin can access this data

Only Yujin staff on incident-response rotation can query the
logs. Every query is audited. There is no "ops dashboard with
everyone's traffic" -- direct log access requires 2FA +
audit trail.

## 6. Your rights

- **Right to deletion.** Email contact@yujin.app referencing
  your license key; we delete all log entries referencing that
  license within 30 days. This is free + does not affect your
  subscription.
- **Right to access.** Same email address; we export every log
  row referencing your license as a JSON file and email it to
  you within 30 days. Also free.
- **Right to opt out.** You can stop using the 3 managed flows
  at any time by setting `YF_USE_HITO4_FLOWS=0` in your shell.
  The BYOK chat keeps working; the 3 managed features become
  unavailable until you re-enable.

## 7. Cost transparency

Every managed-flow response includes a `billing` envelope:

```json
{
  "billing": {
    "this_call_cost_cents": 0.142,
    "cumulative_month_cents": 38.50
  }
}
```

The Forge panel renders this in the cost tab so you always
know what a call costs.

## 8. Adopters building products on Forge

If you publish a product that uses Forge as a tool, your
end-users' data does NOT pass through `prompts.yujin.app`
unless your product itself invokes the 3 managed flows on
their behalf. Forge as a development tool is one thing;
products built on Forge are a separate trust relationship
between you and your users.

## 9. Changes to this policy

Material changes (anything that broadens what we collect or
weakens what we delete) ship with at least 30 days notice via:
- A banner in `yf chat` panel.
- An email to the address on file with your license.
- A git commit to `docs/PRIVACY_POLICY.md` with a clear
  "BREAKING" tag in the message.

Cosmetic edits (typos, clarifications) ship silently with
their git commits.

## 10. Contact

All requests (privacy, security disclosure, billing,
everything else) go to:

- **contact@yujin.app**

For security vulnerabilities, please use the subject prefix
`[SECURITY]` so we can route quickly. See `docs/SECURITY.md`
for the full disclosure process.

---

This document is the source of truth. The hosted version at
https://yujin.app/privacy is a mirror of this markdown,
regenerated on every `docs/PRIVACY_POLICY.md` commit.
