Privacy Notice

Information we collect

We collect the following categories of information:

• Account information — your name, email address, organization, and role, provided when an administrator invites you or when you set or reset a password.
• Content you submit — projects, contacts, schedules, checklists, notes, messages, and documents that you or your organization create or upload to your workspace.
• Connected-integration data — when you connect Microsoft 365 / SharePoint, the files and metadata you authorize us to access.
• Usage and log data — IP address, browser and device type, features and pages used, and timestamps, collected automatically for security, debugging, and reliability.
• Cookies and local storage — strictly necessary cookies and browser storage to keep you signed in and remember preferences such as your theme. If you add more than one account on the same device, each account’s sign-in state is kept in your browser’s local storage so you can switch between them without signing in again; it stays on that device until you remove the account or use “Log out of all accounts,” which is what you should do on a shared or public computer. To bring your workspace back the way you left it after a reload, we also keep a small amount of view state in your browser’s local storage: which panels and tabs you had open (including the project names shown on them), the chat you were last looking at, the mail folder and conversation you had open, the folder path you had navigated to in Files (including folder names), and the drawing sheet you were viewing. Where that state would put content back on screen without you clicking anything — the last chat and the open mail conversation — it stops being restored after one hour. If you use voice input, an in-progress transcript is held briefly so it can be recovered if the tab closes unexpectedly, and unsaved edits to a document are held the same way until the save completes. All of this stays on that device, and all of it is erased when you sign out, switch accounts, or lose access to the organization. We do not use advertising or cross-site tracking cookies.
• Mobile device token (push notifications) — if you install our mobile app and allow notifications, we store a push token that identifies your device so we can deliver them. The token identifies the device, not you personally, and registering it binds it to whoever most recently signed in on that device. You can revoke notifications at any time in your device settings. We remove the token when an administrator removes your access, and we attempt to remove it when you sign out.
• Voice input (dictation) — if you dictate instead of typing in our mobile app, your device’s own speech-recognition service, provided by its operating system (Apple on iOS, Google on Android), converts what you say into text. We receive only that text, which becomes part of the message you chose to send. We do not record or store the audio.

How we use information

• To provide, operate, secure, and maintain the Service, including authenticating you and isolating your data by organization.
• To run the AI analysis and data lookups you request across the deal lifecycle.
• To communicate with you about the Service, including support, security, and administrative messages.
• To monitor, troubleshoot, and improve performance and reliability.
• To comply with applicable law and enforce our terms.

We do not sell your personal information.

AI processing and third-party data sources

To deliver AI features, your prompts and the workspace content relevant to your request are transmitted to third-party AI providers (which may include Anthropic, OpenAI, Google, and xAI) solely to generate the responses you request.

For some requests, the AI assistant also runs a live web search on your behalf: a search query composed from your request and the related conversation context is sent to a web search engine through our AI provider, and the pages it returns are used to inform the response you receive.

To enrich analysis, the Service retrieves information from third-party data sources, including the U.S. Census Bureau, the Federal Reserve (FRED), HUD, FEMA, the Bureau of Labor Statistics, Zillow, Regrid, RentCast, Google Maps, Brave Search, and Perplexity.

Service providers

We rely on vendors to operate the Service, including Supabase (database hosting), Railway (application hosting), Resend (transactional email), Microsoft (optional SharePoint integration), Stripe (payment processing and subscription billing; card details are provided directly to Stripe and are never stored by us), and — if you use our mobile app with notifications enabled — Expo and Apple, who relay push notifications to your device. These providers process information on our behalf and are permitted to use it only to provide services to us.

Push notifications are worth calling out specifically, because their contents leave our systems. To reach your device, the notification’s title and a short summary (up to 100 and 240 characters) pass through Expo and then Apple’s Push Notification service. That summary is drawn from the item that triggered it, so it can contain the beginning of a message someone sent you, or the subject of an RFI, submittal, or task note. It may be displayed on your lock screen before you unlock your device. If you would rather this content did not leave our systems, decline or revoke notification permission — the app works without it.

If you choose to connect a third-party service to your workspace, the credentials you provide are used to reach that service on your behalf and the data you request flows between it and your workspace. Those services are chosen by you and act under their own terms.

How we disclose information

• Within your organization, according to the access and approval controls your administrators configure.
• To authorized YIMBY personnel who may access your records — including conversation content — across organizations as needed to operate, support, secure, and troubleshoot the Service. Such access is limited to staff acting in that capacity and is logged.
• To the AI providers and service providers described above.
• For legal and safety reasons — to comply with applicable law, legal process, or governmental request, and to enforce our terms or protect the rights, property, or safety of YIMBY, our users, or others.
• In a business transaction — in connection with a merger, acquisition, financing, or sale of assets, subject to this Notice.

Data retention and security

We retain information for as long as your account or organization remains active and as needed for the purposes described above, after which we delete or de-identify it within a commercially reasonable period, unless a longer period is required by law.

Records that document formal project communications — for example, who a construction instruction was served on and when — retain the recipient's name, organization, and email address after account deletion, as needed to establish or defend legal claims.

We use technical and organizational safeguards, including server-side tenant isolation between organizations and role-based access controls. These safeguards govern data flow between customer organizations; as described under “How we disclose information,” authorized YIMBY personnel may still access records across organizations to operate and support the Service, and such access is logged.

One category of content is stored so that it can be displayed without a sign-in: an image you upload as a project cover is served from an unlisted address that does not require authentication, so that it can appear in project views. Do not use an image containing confidential information as a project cover. The files, documents and images you otherwise upload are stored privately and require authentication to retrieve.

No method of transmission or storage is completely secure, we cannot guarantee absolute security, and you use the Service at your own risk. Except as required by law, YIMBY is not responsible for unauthorized access to or use of your information that occurs despite reasonable safeguards.

Your choices and rights

You can view and update much of your information directly in the Service. Depending on your location, you may have the right to access, correct, export, or delete your personal information, or to object to or restrict certain processing. Many requests are administered through your organization’s administrator and may be subject to verification and legal limits.

To exercise a right, contact your organization’s administrator or YIMBY at [email protected].

International data transfers

YIMBY operates in the United States, and the information we collect is processed and stored in the United States. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States.

Your responsibilities and our Terms

You are responsible for the Customer Content you submit, including ensuring that you have the rights and any required consents to provide it and that doing so complies with applicable law. Do not upload information you are not authorized to share.

Your use of the Service is also governed by our Terms of Use, including its disclaimers of warranties and limitations of liability, which apply to the practices described in this Notice.

Changes to this Notice

We may update this Privacy Notice from time to time. Material changes will be reflected by the “Effective” date above and, where appropriate, communicated through the Service.

Contact

Questions about this Notice or our privacy practices? Contact us at [email protected].