@TheYard legal
How TheYard collects, uses, discloses, retains, and deletes account, content, usage, and safety data.
Last updated October 6, 2026
This policy applies to TheYard websites and mobile apps. The TheYard service operator is responsible for the processing described here and can be reached at support@jointheyard.co or legal@jointheyard.co.
TheYard collects authentication information such as email address and verification state; profile information such as name, handle, avatar, school or program, interests, biography, optional city/state and website; and the policy version and age attestation accepted for the account.
TheYard stores content you choose to provide, including posts, comments, discussions, group content, photos, supported videos and document attachments, messages, follows, reactions, reports, blocks, support requests, and account settings. Follows and conversation membership form an account-linked social graph; this does not mean the app reads your device address book.
Where available in the iOS app, Creator Studio uses the camera and microphone only when you choose capture, and the system photo or file picker to receive the items you select. Declining a device permission does not block the rest of TheYard. Original-media editing, trimming and compression happen on the device; TheYard does not download third-party embedded videos for editing or offline use.
Unpublished Creator Studio and reply drafts are stored locally under an account-specific workspace. They are not posted or sent automatically. Signing out clears that account's local workspace; an expired session locks access until sign-in rather than intentionally deleting unfinished work. Protect shared devices with their screen lock. A local cleanup error may require unlocking the device and retrying cleanup.
The Share Extension places only the content you select in protected temporary storage shared with the main app, not account passwords or session tokens. Pending shares expire after 24 hours and require account, destination and audience review before import into a draft. Importing a draft is not publication. Account changes and explicit logout invalidate pending shared content.
Saved public event details may be cached locally for up to seven days and can become outdated while offline. Restricted event details and attendance records are not included in that offline cache. Optional calendar additions use Apple's calendar editor; the copy and any reminder you save are managed by your chosen calendar account. Later changes or cancellations in TheYard do not automatically update that calendar copy. TheYard does not import unrelated calendar entries.
TheYard processes session cookies, IP address, browser or device information, push-notification tokens when enabled, app interactions, viewed content, search and navigation activity, performance information, security events, and error or crash details.
First-party analytics stores interaction events, account identifiers when signed in, browser installation and session identifiers, and referring-page URLs with query strings and fragments removed. We use these records to understand feature use and audience activity. Our analytics sanitization removes search-query fields; this is not a promise that every service-provider log excludes request URLs.
TheYard does not sell personal information or use its account records, private messages or member posts for cross-app advertising. TheYard does not operate an advertising network. Embedded providers may use data they collect directly for advertising and measurement, as described below; these first-party commitments are not a claim that embedded media is tracking-free or always ad-free.
Information is used to create and secure accounts, maintain sessions, personalize feeds, deliver posts and messages, process uploads, operate groups and discussions, provide notifications, answer support requests, prevent abuse, investigate reports, and improve reliability.
Private messages and restricted content are not public, but they are stored by TheYard and are not end-to-end encrypted against TheYard.
Authorized personnel may access account information and user-submitted content, including communications, when reasonably necessary to operate and secure the service, provide support, investigate reports or suspected abuse, enforce platform rules, protect users and the public, or comply with legal obligations. Access is limited according to organizational responsibilities and applicable safeguards.
Supabase processes authentication, database, storage, row-level authorization, and email workflow data. Resend processes transactional authentication email, including the recipient, message and verification or recovery link. Vercel hosts and delivers the web application. Cloudflare Turnstile processes anti-abuse signals during signup. Apple and Google process social authentication when selected.
Embedded media services receive requests, network and browser information and playback activity when their players load. TheYard's YouTube player uses privacy-enhanced mode; YouTube says advertisements shown in that mode are non-personalized. Vimeo players load only after you request playback, without automatic playback. Vimeo's do-not-track player setting reduces player analytics and new nonessential cookies, but essential cookies and previously stored Vimeo cookies may still be transmitted. Provider practices can depend on your region, provider account and choices.
In the native iOS app, TikTok links open outside TheYard in TikTok or your browser only when you choose to open them. TheYard does not load TikTok players or other TikTok resources inside the iOS app. This behavior is the same for every tracking-permission status: TheYard does not request tracking permission for TikTok, and changing that permission does not enable inline playback. TheYard passes only the public TikTok destination URL, without adding TheYard account or device identifiers, session tokens, referrer parameters or analytics metadata. The rest of TheYard remains available without opening TikTok. The separate service has its own privacy practices and may receive network and device information, use cookies or associate activity with your provider account; opening it externally is not a promise of tracking-free browsing.
Public profiles and content can be viewed by others and may be indexed where the product marks them public. Private messages, restricted groups, reports, and account records are limited by authorization controls, except when disclosure is required for service operation, safety, or law.
Post images and group attachments use private storage with audience checks. Public posts may still be visible to guests. Authorized ordinary requests can receive short-lived access links that may remain usable by anyone who obtains them until expiry. Access controls cannot prevent authorized recipients from saving copies. Exceptional staff media review uses a separate checked request for the exact object.
TheYard may disclose information to service providers acting on its behalf, to protect users or the service, in response to lawful process, or as part of a properly notified business transfer. TheYard does not intentionally share account or user-content records for cross-app advertising; embedded media providers' separate practices are described above.
Account and content data is kept while the account is active and as needed to operate the service. Permanent deletion is available in Settings > Account security and at the public account-deletion page. The deletion flow removes account-owned storage and the authentication account; database deletion rules remove associated profile, authored content, relationships and device registrations. Group owners must first transfer ownership or delete their groups.
Protected reports, private-review and administrative evidence and grant records are not automatically erased with the account. They can retain account and content identifiers, timestamps and case context for safety, security, support and dispute handling. Some analytics and diagnostic rows remain with their profile reference removed. These retained records are not necessarily anonymous.
There is currently no automated expiry for protected review and audit records, and we do not promise a fixed deletion deadline for them. Access remains restricted. Service-provider logs, email delivery records and backups have separate retention and deletion processes. Contact us to request review of retained personal information; account deletion does not by itself establish deletion of every provider-held record or recipient copy.
TheYard uses HTTPS in transit, Supabase row-level security, protected administrative routes, contextual permissions, and access controls. No service can guarantee absolute security.
You can edit profile data, disable notifications, block members, report content, delete your account, or contact support@jointheyard.co for access, correction, or privacy questions.
TheYard accounts are intended for people age 16 or older. People under 16 may not create or use an account. Eligible members age 16 or 17 remain protected by our child-safety standards. Public performances involving schools do not change the account age requirement.
Report suspected child exploitation immediately through the in-app report tools and to support@jointheyard.co. TheYard preserves and reports confirmed illegal material as required by law.
Privacy and support questions: support@jointheyard.co. Legal notices: legal@jointheyard.co.
On the web and Android, TikTok players load only after you request playback, without automatic playback. These players are tracking-capable; an explicit playback request is not a guarantee against tracking. TikTok's service-wide privacy policy describes provider-assigned user and device identifiers, approximate location inferred from network information, cookies and viewing or interaction activity, with purposes including service operation, analytics, personalization, advertising and measurement. It does not establish the exact collection, retention or linking performed by this player. Loading its player is not a verified tracking-free mode. This does not mean TheYard supplies its account email, private messages, posts or push tokens to TikTok for advertising. Closing or leaving an active player stops it, but does not erase data already received by the provider. Following an external media link takes you to a separately operated service governed by its own privacy policy.
Where native notification registration is enabled and you choose notifications, TheYard associates a provider token and installation identifier with your account and records platform, app version and preferences. Apple Push Notification service and Firebase Cloud Messaging support delivery when enabled. Notification payloads can include message text if message previews are enabled. Delivery can be paused independently of registration; pausing delivery does not erase previously registered data.
