Privacy Policy

Last updated: 2026-08-30

1. Scope

This policy describes what information the Service collects, how it is used, and the third-party processors that handle it on our behalf.

2. What we collect

Account data: email address and authentication state, processed by our identity provider (Stack Auth).
Subscription data: billing identifiers and subscription status, processed by Stripe. The Service does not store payment-card data.
Wallet identifiers (optional): if you link a Solana wallet for PRO via staking, we store the public wallet address.
Discord link (optional): if you connect Discord to unlock PRO through a membership role, we store a one-way, salted hash (HMAC-SHA256) of your Discord user ID — never the ID itself, and never your username, display name, avatar, or email. The hash is computed with a secret held only on our servers and cannot be reversed back into your account. We also store the status of that link (active, pending, revoked) and the timestamps of the last checks.
Portfolio data (optional): if you use the portfolio, we store the entries you type — the asset or pool, quantity, price paid, fees, dates and any note you add — together with the positions and profit/loss figures derived from them. You enter this yourself: we do not read balances from your wallet to build it. It is readable only by your own account, is never sold or shared with third parties, is included in your data export, and is deleted with your account.
Usage data: pages viewed and high-level analytics, processed by Vercel Analytics.
Server logs and error reports: technical logs and exception reports, sensitive fields (emails, wallet addresses) are redacted before being sent to error-tracking providers.

3. What we do NOT collect

We do not collect KYC documents. We do not have access to your private keys, seed phrases, or wallet contents beyond the public address.

From Discord specifically, we never read or store message content, presence/online status, direct messages, voice activity, or any member list beyond the check described below. Our Discord app does not request the Message Content or Presence intents.

3.1 How the Discord check works

To keep PRO in sync with a paid membership, our bot periodically reads the member list of a fixed, explicitly configured list of servers and checks which members hold one of a fixed list of roles. Member IDs are hashed in memory during that read; only the hashes of linked users are ever written to our database. Members of those servers who have not connected their Discord to Yield Lab are never persisted in any form.

You can disconnect at any time from your account page, which revokes the access granted through Discord and deletes the link record. A minimal record of the link/unlink event is retained to enforce an anti-abuse cooldown, and it too contains only irreversible hashes.

4. Processors

Stack Auth — authentication
Stripe — payments
Vercel — hosting, analytics, logs
Neon — database
Discord — membership role verification (optional, only if you connect it)
Sentry — error tracking (with PII redaction)
Resend — transactional email

5. Cookies

We use first-party cookies for authentication session state and theme preference. We do not use cross-site tracking cookies.

6. Your rights

You can delete your account at any time from the account settings, which removes your account data — including your portfolio and its full transaction history — from our systems. Some data may be retained by upstream processors (Stripe, Stack Auth) per their own policies.

You can also download everything we hold about you as a JSON file from the account settings, at any time and without asking us first. The export and the deletion cover the same set of data.

If you connected Discord, disconnecting it from the account page deletes the stored link immediately; you do not need to contact us first.

Contact: for questions about this policy, or to request access to or deletion of your data, write to yieldlab4@gmail.com.

7. Data location

Data is processed primarily in AWS us-east-1 (USA) by Neon and Vercel.

8. Changes

Material changes to this policy will be reflected in the "Last updated" date above.

2. What we collect

Account data: email address and authentication state, processed by our identity provider (Stack Auth).

Subscription data: billing identifiers and subscription status, processed by Stripe. The Service does not store payment-card data.

Wallet identifiers (optional): if you link a Solana wallet for PRO via staking, we store the public wallet address.

Discord link (optional): if you connect Discord to unlock PRO through a membership role, we store a one-way, salted hash (HMAC-SHA256) of your Discord user ID — never the ID itself, and never your username, display name, avatar, or email. The hash is computed with a secret held only on our servers and cannot be reversed back into your account. We also store the status of that link (active, pending, revoked) and the timestamps of the last checks.

Portfolio data (optional): if you use the portfolio, we store the entries you type — the asset or pool, quantity, price paid, fees, dates and any note you add — together with the positions and profit/loss figures derived from them. You enter this yourself: we do not read balances from your wallet to build it. It is readable only by your own account, is never sold or shared with third parties, is included in your data export, and is deleted with your account.

Usage data: pages viewed and high-level analytics, processed by Vercel Analytics.

Server logs and error reports: technical logs and exception reports, sensitive fields (emails, wallet addresses) are redacted before being sent to error-tracking providers.