YDLib / POLICIES · UPDATED 21 OCTOBER 2026
Privacy policy
YDLib is an invite-only research workspace operated by Youp Duvekot in the Netherlands. This notice describes the current prelaunch service. Contact the operator through the contact form for privacy requests.
What we process
We process your email, display name, profile preferences, invitation and access settings, personal notes and research, sharing recipients, course progress and files you choose to upload. Sign-in security records may include browser information, network/IP information, approximate country, timestamps and concurrent-session indicators. Authenticator secrets are encrypted; recovery and confirmation credentials are protected server-side. Never upload broker passwords or sensitive personal documents.
Why we use it
Account access, verification, personal storage and requested sharing support the service you request (performance of our agreement with you). Security monitoring and abuse prevention serve legitimate interests in protecting accounts and infrastructure. Waitlist confirmation and an invitation if accepted are sent with your consent, which you can withdraw. Newsletters, publication updates and onboarding/demo follow-ups require separate opt-in choices. Optional emails include an unsubscribe link; revocation and plan expiry also stop pending marketing messages. Login and essential security messages continue. Contact details are used to answer your request, including meeting applicable legal obligations. We do not sell personal data or use it to run advertising.
Who can see it
Your personal workspace is private to your account until you grant read access to named email addresses. Recipients must independently have approved access. They can retain material they have already seen or copied; revocation stops subsequent access. Shared-with-me items are separate from your work. Library channels are controlled by the operator. Public blog and course content is accessible without an account. Administrators and infrastructure providers may access data when necessary to operate, secure or support the service. Private does not mean end-to-end encrypted.
Providers and international processing
Cloudflare hosts the application, database and files. Optional AI processing sends selected source passages or prepared audio clips to Cloudflare-hosted models only when the owner requests processing. Draft outputs, supplied supporting passages, source revisions, input hashes and processing history are retained privately until deletion or an applicable erasure process. Browser PDF extraction and audio preparation happen locally; model inference is hosted, not local. Only submit material you are permitted to process. Resend delivers confirmation, invitation and opted-in update emails. Payment checkout is currently disconnected. If enabled later, Stripe will process billing information and invoices; YDLib will store customer/subscription references and verified entitlement dates, not card details. Optional notifications may be sent to the configured ntfy service. Market feeds receive server-side data requests rather than your account identity. Loading external videos or images may disclose your IP and browser information to the content provider. Providers may process information internationally under their applicable safeguards. Ask through Contact for processor and transfer information relevant to your account.
Retention
Unconfirmed waitlist links expire after 24 hours; expired pending requests are removed on subsequent waitlist activity. Unaccepted confirmed requests are removed after 12 months on subsequent activity. Accepted invitation records support active access administration until account closure or an erasure request. Contact requests older than 180 days are removed on subsequent contact activity. Personal work and account settings remain until deleted or account closure is processed. Notes moved to Trash remain recoverable and count toward the notebook storage limit. Billing event receipts, one-demo-per-email markers and consent records support fraud prevention and unsubscribe enforcement. Authentication challenges and sessions have expiry times; expiry does not imply immediate physical deletion of every security log or backup. Security records are retained for incident investigation and reviewed when an erasure or closure request is processed. Ask for a precise retention assessment where needed.
Your rights and choices
You may request access, correction, erasure, restriction, portability where applicable, or object to processing based on legitimate interests. You may withdraw consent without affecting prior lawful processing. Use Contact → Privacy; we may request proportionate identity verification. We aim to respond within one month, subject to lawful extensions. You can also complain to the Dutch Autoriteit Persoonsgegevens at autoriteitpersoonsgegevens.nl.
Changes and contact
Use the contact form for privacy, account closure, security or copyright concerns. This notice will be updated when the service or processing changes. Commercial registration, full legal contact details, processor arrangements and final retention schedules must be finalized before paid availability. No checkout is currently offered.