Privacy Policy
Last updated: March 2, 2026

Yocoolab is operated by Attune LLC ("we", "us", "our"). This policy describes how the Yocoolab Chrome extension and web platform collect, use, and protect your information.

1. What We Collect
   Account Information
   When you sign in with GitHub or Google, we receive your display name, email address, and avatar URL from the OAuth provider. We store these to identify you within comment threads.

Authentication Tokens
OAuth access tokens are encrypted at rest using AES-256-GCM. A short-lived JWT session token is stored in your browser's local storage to keep you signed in.

Comment & Thread Data
When you create a comment, we store the message text, a screenshot of the annotated area, the CSS selector and element tag of the target element, page URL, viewport dimensions, and git branch name. This data is necessary to pin comments to the correct location.

Click Position & Element Context
When you pin a comment, we record the click coordinates and surrounding DOM context (CSS selector path, element tag, computed styles) so the comment marker can be placed accurately on return visits.

Claude Code & MCP Integration
Yocoolab integrates with Claude Code via the Model Context Protocol (MCP). When you send a feedback thread "To Claude," the thread content — message text, screenshot, element context, and page URL — is shared with your local Claude Code session through a localhost bridge (127.0.0.1:9800). This data stays on your machine and is not routed through Yocoolab servers. The AI Companion chat panel also communicates through this local bridge for real-time conversation with Claude Code.

Extension Preferences
UI preferences — panel position, theme (light/dark), accent color, enabled/disabled state, and server mode — are stored locally via chrome.storage.local and are never sent to our servers.

1. How We Use Your Data
   Display your name and avatar on comments you author
   Pin comment markers to the correct page elements
   Deliver real-time notifications when teammates reply
   Associate threads with git repositories and branches
   Generate dashboard statistics (open/resolved counts, activity feeds)
   Send thread context to your local Claude Code session when you use "Send to Claude" or the AI Companion
2. Data We Do NOT Collect
   We do not track your browsing history or the pages you visit
   We do not log keystrokes, mouse movements, or form input
   We do not collect financial, health, or location data
   We do not inject ads or tracking pixels
3. Third-Party Services
   We use the following third-party services, each governed by their own privacy policies:

GitHub OAuth — for authentication
Google OAuth — for authentication
Railway / Replit — for backend hosting
PostgreSQL — for database storage
Anthropic Claude (via MCP) — for AI-assisted code fixes. Thread context is sent to your local Claude Code session over localhost; data sent to Anthropic's API is governed by Anthropic's Privacy Policy
We do not sell, rent, or share your personal data with third parties for advertising or marketing purposes.

1. Data Storage & Security
   All API traffic is encrypted via HTTPS (TLS 1.2+)
   OAuth tokens are encrypted at rest with AES-256-GCM
   Database access is restricted to authenticated backend services
   Role-based access control (admin/write/read) governs per-repository permissions
   API requests are rate-limited (100 requests per 15 minutes in production)
2. Data Retention
   Comment threads and messages are retained for as long as your account is active. You can delete individual threads from the extension UI. If you delete your account, all associated data is permanently removed within 30 days.
3. Your Rights
   You can:

Export your data by contacting us
Delete your threads and comments from the extension
Revoke OAuth access from your GitHub or Google account settings
Request full account deletion by emailing us
8. Children's Privacy
Yocoolab is not directed at children under 13. We do not knowingly collect information from children under 13.

1. Changes to This Policy
   We may update this policy from time to time. Material changes will be communicated via the extension or email. Continued use after changes constitutes acceptance.
2. Contact
   For privacy questions or data requests, contact us at support@yocoolab.com.