Yattare - The Independent SaaS Directory

Privacy Policy

Last updated: October 4, 2026

Yattare is a directory of SaaS tools paired with tech stacks that people choose to publish. Most of what you see on the site is public by design. This policy explains the rest: what we store about you, why, where it lives, and how to get it deleted.

Who is responsible

Yattare is run by a single operator, who acts as the data controller for everything described here. For any privacy question or request, email privacy@yattare.com.

What we collect

  • Account data. Your email address and, if you provide it, your name. Passwords are handled by Supabase Auth and stored only as a hash; we never see or store the plaintext.
  • Profile fields. Handle, avatar, headline, bio, role, and optional company name and website. Profiles are private by default. If you set yours to public, only handle, name, avatar, headline, bio, and role become visible; your email and plan never do.
  • Published stacks. Stacks you create, the tools in them, and any notes you add. Stacks are private by default; public and unlisted stacks are visible to others, which is their point.
  • Login history. When you sign in we record the time, IP address, user agent, device type, browser, approximate location derived from the IP, and whether the attempt succeeded.
  • Security logs. Password changes are logged with time, IP address, and user agent.
  • Usage events. When you sign up, sign in or out, change your password, create, edit, publish or delete a stack, add or remove a tool, submit a tool, or export or delete your account, we record the action and its time. Stacks and directory tools are recorded by their internal id, not by names you type. A tool you submit for listing is recorded with its name and category, since the listing is meant to be public. For a new account we also record where you came from: the referring site and any campaign (utm) tags on your first page.
  • Analytics. Vercel Web Analytics counts page views without cookies. PostHog records the pages you view (including search terms in the page address), which elements you click (without their text), and, for signed-in users, screen recordings of sessions with all text and every input masked. Visitors in the EU, EEA, UK, and Switzerland get PostHog only after they accept it; everyone else can turn it off on the cookie page.
  • Beta and integration signups. If you leave your email to hear about the beta or request an integration, we store that email for that purpose only.

Why we collect it

We process account data, profiles, and stacks because they are the service you signed up for; the legal basis is performance of our contract with you. We keep login history and security logs to detect account takeovers and abuse; the legal basis is our legitimate interest in keeping accounts secure. We record usage events and run Vercel Web Analytics to understand which parts of the product people use and how they find it, on the basis of our legitimate interest in improving the service. PostHog runs on the basis of your consent where the law requires it, and on legitimate interest elsewhere. Beta and integration emails are processed on the basis of your request to be contacted. We do not use your data for advertising, and we do not build profiles of you for any purpose beyond running the service.

Where your data lives

Yattare uses these providers as processors on our behalf: Supabase hosts the database and authentication, Vercel hosts the application and provides Web Analytics, and PostHog (United States) provides product analytics and session recordings. They process data only on our instructions.

How long we keep it

  • Login history is deleted automatically after 90 days.
  • Usage events are deleted automatically after 400 days. If you delete your account, your past events are kept without your account id.
  • PostHog keeps analytics events and session recordings for the retention period of our PostHog plan, then deletes them.
  • Account data, profiles, and stacks are kept while your account exists and are removed when you delete it.
  • Beta and integration signup emails are kept until we have contacted you for the purpose you signed up for, or until you ask us to remove them.

No sale or sharing of personal information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act. Yattare is a small pre-revenue project and does not meet the CCPA's business thresholds, but we hold to this standard regardless. The only parties that touch your data are the providers named above.

Your rights

You can ask us to access, correct, export, or delete your personal data, and you can object to processing based on legitimate interest. Deletion and export are available directly from your account settings, which is the fastest route. For anything else, or if you signed up for the beta without an account, email privacy@yattare.com and we will respond within one month. The export includes your usage events. Deleting your account removes your profile, stacks, and security logs. If you are in a jurisdiction with a data protection authority, you also have the right to lodge a complaint with it.

Cookies

Yattare sets only the cookies needed to keep you signed in. Analytics uses no cookies, and there are no advertising cookies. The details, including the browser storage analytics uses and how to turn it off, are on the cookie page.

Changes to this policy

If this policy changes in a way that matters, we will update the date at the top and, for material changes, notify account holders by email before the change takes effect.