Privacy

The operator

Yaboku is independently owned and operated by an individual. Privacy and deletion requests: admin@yaboku.com. Employer and provider policies still apply to connected work accounts.

Account access

You choose Google or Microsoft sign-in. The provider authenticates you and grants tokens for the permissions you approve, including ongoing access where supported. Your provider password need not be sent to Yaboku.

Raven’s permissions differ between Apple’s combined mail/calendar connection and Android’s Gmail-only adapter. Tide’s standalone consent is for calendars and identity; accounts shared from Raven can retain broader grants.

Data on your device

Raven: account details, preferences, mailboxes, message headers/bodies, participants, invitations, drafts, queued actions, and attachment metadata/files. Granted contacts/people access supports suggestions.

Tide: accounts, calendars, visibility, event titles/descriptions, times, locations, guests, recurrence, reminders, cached events, and pending changes.

Apple uses SQLite/files and Keychain tokens. Raven, its extensions, and Tide share an App Group and Keychain access group for account sharing; they are not fully isolated. Public and development installations are configured separately.

Android keeps app-local data. Raven uses Google authorization services. Tide uses Google authorization or Microsoft’s SDK token cache, with credential references in a Keystore-encrypted journal. Android’s system calendar store and account sync are separate.

Credential protection does not mean every cached file is separately encrypted by the app. This is not end-to-end encrypted mail/calendar. Device protection, backups, and exports have separate limits.

Data leaving your device

Clients call Google/Microsoft identity and mail/calendar APIs directly. Sending mail transmits content and attachments; event changes transmit details and may notify participants. Providers process and retain this information under their policies. Android device calendars follow the device’s account-sync settings.

Apple Raven can load remote message images when allowed, revealing network details and an opening to third parties. Android blocks remote images/active content. Links, exports, shares, and cross-app handoffs disclose selected data to their recipients.

Optional Apple Raven push-relay code sends a device ID, push token, platform/environment, account IDs/addresses, and Microsoft subscription IDs to the configured relay, involving provider watches and Apple push. Public remote push is currently disabled. An enabled pilot relay needs operational review and disclosure before use; no public relay deployment is claimed.

AI triage, summaries, and suggested replies are unaccepted/planned workflows. No automatic external inference fallback was identified in the reviewed Raven/Tide paths.

Diagnostics and support

Apple sync logs can include addresses, paths, timestamps, calendar/folder names, message IDs, queued-action details, provider errors, and invitation titles. OAuth error filtering exists, but logs are not guaranteed free of private data. No automatic third-party analytics/crash upload was identified in the reviewed app paths. OS/provider diagnostics are separate.

Support email and attachments go to the email service and operator for troubleshooting. Send only necessary information and redact logs; never send passwords, tokens, or mailbox exports.

Retention and deletion

Local records have no universal automatic expiry. Raven’s sync window is not a deletion schedule; Apple logs have size-based cleanup, not a day-based promise. Provider copies, support messages, exports, and backups have separate lifecycles.

Apple Raven removes account database records and attempts token deletion; files/logs can remain. Android Raven revokes Google access before removing cached mail, drafts, queues, and attachment directories; a failed revoke can preserve local data. Apple Tide disconnect retains events and queued changes.

Revocation does not erase caches. Local removal does not delete provider mail/calendars. Shared Apple storage and Android system calendars need separate consideration. See removal instructions; contact the operator about support copies. No fixed support-retention or response period is promised here.

This website

This static site has no sign-in, forms, analytics scripts, tracking pixels, site-set cookies, or external font requests. It does not receive app mailbox/calendar records or OAuth tokens.

The intended host, GitHub Pages, logs visitors’ IP addresses for security, including signed-out visitors. See GitHub Pages data collection and GitHub’s Privacy Statement for its processing and retention.

Every HTML page requests no indexing, following, archiving, or image indexing. This is not authentication or a guarantee against every crawler or public copying. Policies remain accessible to users and provider reviewers.

Review these disclosures again when build permissions or services change.