Privacy policy

Last updated 24 October 2026.

This policy explains what personal data Yack, a virtual office for teams, holds about you, why, and for how long. Yack is made by Thoughtbreak. Each Yack installation is run by an organisation, the operator: usually the employer or organisation that invited you, or Thoughtbreak for its own installations. The operator decides who may use the installation and is responsible for the personal data in it (the data controller). Questions about your data go to the operator's administrators, or, for an installation Thoughtbreak runs, to richard.evans@thoughtbreak.com.

What Yack holds

• Your account: your name, email address, the identifier of the Google or Microsoft account you sign in with, your teams and role, and an avatar if you add one.
• What you write and share: messages, todos, reactions, files you attach, and the rooms and teams they belong to.
• Meetings: who was in a room and when, and, when someone records a meeting, its audio and video, a transcript and an AI summary. Everyone in a recorded meeting is told it is being recorded.
• Availability: your out of office, booked in Yack or synced from your calendar (below), and team meetings you are invited to.
• Presence: whether you are connected, which room you are in, and whether your microphone or camera is on. This is shown to other people in the installation while it is happening; Yack does not keep a history of it beyond meeting attendance.
• Technical records: server logs of requests and errors, kept for 30 days by default, and your browser's notification subscription if you turn notifications on.

Yack uses one cookie, to keep you signed in. Your browser also stores a few preferences, such as light or dark mode, on your own device. There are no advertising or tracking cookies.

Google Calendar

If you choose to have your out of office come from Google Calendar, Yack asks your permission to read your calendar (calendar.events.readonly). It then reads only your primary calendar's out-of-office events, and from them only their start and end times, time zone and Google's identifier for each, never their titles, descriptions, attendees or any other event. Yack uses these times solely to show when you are out of office, to you and to the people in your installation. It does not use them for advertising, does not sell them, does not give them to anyone else, and does not send them to any AI service. Yack's permission is stored encrypted. Switching back to booking in Yack withdraws Yack's access and stops the sync; you can also withdraw it at any time in your Google Account's security settings.

Yack's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

AI

Where the operator enables it, Yack answers questions addressed to @Yack and summarises recorded meetings using OpenAI. Before anything is sent, people's names, contact details, addresses and identifiers are replaced with placeholders, which are put back only in Yack, so OpenAI does not receive them. OpenAI does not use what it receives through its API to train its models. Relevance matching (embeddings) is done on the installation's own servers unless the operator chooses otherwise. Calendar data is never sent.

Who else handles your data

Yack runs on servers the operator chooses; Thoughtbreak's own installations run on Amazon Web Services in London. Depending on how an installation is set up, these services handle data on the operator's behalf:

• Amazon Web Services: hosting, file storage, backups, email delivery and malware scanning of attached files.
• Google and Microsoft: signing in, and Google Calendar for those who choose it.
• OpenAI: AI answers and meeting summaries, pseudonymised as described above.
• Your browser's push service (from Google, Apple, Mozilla or Microsoft): delivering notifications you turn on.

Your data is not sold or used for advertising.

How long it is kept

By default, recordings' videos are deleted after 30 days (their transcripts remain), attached files after 30 days, and messages, transcripts, AI indexes, out of office, meetings and accounts disabled by an administrator after 7 years. Backups of the whole installation expire after 14 days by default. The operator can set shorter or longer periods.

Your rights

Under data protection law, including the UK and EU GDPR, you can ask the operator for a copy of your personal data, to correct it, to delete it, to restrict or object to its use, and to receive it in a portable form. Ask the operator's administrators, or Thoughtbreak for its own installations. If you are unhappy with the answer you can complain to your data protection authority; in the UK, the Information Commissioner's Office (ico.org.uk).

Security

Connections to Yack are encrypted, sign-in is through Google or Microsoft (Yack never sees your password), each room's audio and video admits only the people Yack has let in, attached files are scanned for malware, and the operator's data is backed up.

Changes

If this policy changes, the date at the top changes, and significant changes are mentioned in the Release notes.