Security · Updated 14 October 2026
Your stories, under lock and key.
How YapApply keeps what you tell it safe, in plain words.
The questions people ask.
Straight answers. The privacy policy has every detail, and it's the one that counts.
1. Is my information encrypted?
Yes. Everything moving between your browser, YapApply and the companies we use travels encrypted over TLS (HTTPS). Your stories, uploads and documents are stored with Cloudflare and encrypted at rest with AES-256.
Typed drafts you haven't sent stay on your own device, protected by your device's own security. When you talk, each piece goes to be turned into text as soon as it's recorded, and waits on your device only if that can't happen yet (14 days at most).
2. Where is it stored?
Your database and files are stored by Cloudflare in North America, and they aren't kept in Canada. Anthropic, OpenAI, WorkOS, Resend and Google handle information in the United States. What that means for you.
3. How does sign-in keep my account safe?
You type your password on our page, and our server passes it straight to WorkOS, our sign-in service. We never store it, and WorkOS checks it against passwords known to have leaked. The cookie that keeps you signed in can't be read by scripts on the page and works only on our site. Each person can reach only their own records, and the app checks this on every request.
4. Who can open my records, and is that logged?
Your account is just for you. Today, Ken is the only person who can open your records, and only to fix problems and improve the writing. Every tool with access to YapApply uses two-factor sign-in. Our admin tools log each time someone opens your stories, documents, AI request records or flagged text, with who opened it and when. Your uploaded files can't be opened in them at all.
Because Ken builds YapApply, he can also reach the database directly through Cloudflare to build and fix it. Anyone else who gets access signs a confidentiality agreement and gets only the access their work needs.
5. Do Anthropic and OpenAI train on my information? When do they delete it?
We use both under their business terms, which say they don't train their models on what we send. Both delete it within 30 days. They can keep a request longer if the law requires it, or if their safety systems flag it as breaking their usage rules. Anthropic keeps flagged requests for up to 2 years. Read their own pages: Anthropic and OpenAI.
6. What's left after I hit Delete everything?
Your account, stories, uploads, jobs and documents go straight away. Within 30 days, our server logs, our backups and the AI companies' copies catch up, apart from the exceptions above. Your email address stays in our email provider's records, in our mailbox if you wrote to us, and on the early-access list until you ask us to remove it. Our admin log keeps a note that a record was opened (an account number and a time, none of your words), plus an anonymous note of how far you got in setup. See the day-by-day.
7. Has YapApply had an independent security audit?
Not yet. YapApply is new and run by one person. We'd like an external audit one day, though there's no date yet. The companies that store and process your information are independently audited, and you can read about their certifications on their own pages: Cloudflare, Anthropic, OpenAI, WorkOS and Resend. Their audits cover their own systems.
The YapApply app itself hasn't been audited, so we keep it small: we collect only what a resume needs, the app checks every request against the account that made it, and we delete records on a fixed schedule.
8. How do I report a security problem?
Email hello@yapapply.com. A real person reads every email.
See also our privacy policy and terms of use.
Found a problem, or still wondering?
Email us. A real person reads every email.