Security and privacy
What protects sign-in, access and data in yaya.
Last updated
How sign-in is protected
- There are no passwords to leak or reuse. You sign in with Google or an emailed link and code.
- Email codes expire after 10 minutes and allow 5 tries.
- yaya can run a bot check before it sends a sign-in email.
- Sessions last 7 days. Scripts cannot read the session cookie, and it travels only over HTTPS.
- Changing your sign-in email ends all your sessions.
Your Google account or email inbox is what protects your yaya account, so secure it.
How access is controlled
Each workspace has three roles. Owners manage the team and can export or delete the site. Editors can edit and publish. Viewers can view.
Only owners can invite people. See Invite your team.
Changing your email and deleting your account both need a code sent to your inbox. If you own a workspace, an email change adds a 24-hour wait.
Who handles your data
Cloudflare runs hosting, the database and file storage. Google handles sign-in when you choose it. Stripe processes payments, and your card number stays with Stripe.
On yaya.page, Google Analytics and Microsoft Clarity measure how people use yaya. yaya does not use advertising cookies. The full list is in the privacy policy, and the rules of use are in the terms.
Export and delete
You can export a workspace and delete a site or your account yourself.
Report a problem
Email support@yaya.page if you see something that looks like a security issue or an account you did not create.
Was this guide helpful?
Still stuck? Email support@yaya.page.