Privacy policy

Last updated 17 October 2026

Yoto Limiter is a small, independent service that sets daily play-time limits for Yoto players. It is run by one person, Gonçalo Gomes (“I”). This page explains what data it keeps, why, and what you can do about it.

What I collect

• Account: your email address, and either a salted hash of your password (Argon2id) or, if you sign in with Google, a link to your Google account. I also keep a hash of your recovery code. Passwords and recovery codes can't be read back.
• Yoto connection: a token that lets the server talk to your Yoto players, stored encrypted and used only to read your players and pause them.
• Players: their names, the limits and card rules you set, card titles looked up from Yoto, and daily play time per card for up to 90 days.
• Password reset links: when you ask for one, a hash of the link, kept until it is used or for an hour.
• API keys: if you make any, the name you gave each, its first few characters, what it may do, when you made it and when it was last used (to the minute), kept until you delete it. The key itself is kept only in a form nobody can read back.
• Notifications: if you turn them on for a device, the address its browser gives for notifications and the keys to encrypt them to it, kept until you turn them off, sign out on that device, or the browser drops them.
• Sessions: a random token, stored hashed, that keeps you signed in for up to 30 days. It lives in one cookie. If you open a link that asks for prices in a particular currency, a second cookie remembers which, and holds nothing else. There are no analytics, advertising or tracking cookies, and the site loads nothing from other companies.
• Network addresses: used in memory to slow down password guessing and sign-up floods, and not written to the database. My hosting provider may keep ordinary request logs.

Payments

If you buy Plus, the payment is taken by Stripe on its own page. This site never sees your card number. Stripe tells the server whether the payment succeeded, and the server keeps your Stripe customer ID, your plan, and whether it is a subscription, so that it can switch Plus on and off and open your billing page. Stripe collects and keeps the payment details under Stripe's privacy policy, and may email you receipts. Stripe also keeps its own records of payments as the law requires, so they are not removed when you delete your account here.

Sign in with Google

If you choose “Continue with Google”, Google tells the server two things: your email address (which must be verified by Google) and your Google account ID, a number that identifies your account to this app. The app asks Google for only the openid and email permissions.

• It does not see your Google password, and it cannot read your Gmail, contacts, Drive, calendar or any other Google data.
• The email is used to identify your account. The account ID is stored so that you can keep signing in even if your email changes.
• If you already have a Yoto Limiter account with the same email, Google is linked to it only after you enter that account's password.
• Nothing from Google is used for advertising, sold, or shared with anyone.
• To stop using Google sign-in, delete your account (below). You can also remove this app's access at your Google account's connections page.

How it is used

Only to run the service: to sign you in, to read your players' state from Yoto, to enforce the limits you set, and to show you usage. It is not used for anything else, and I don't sell it, rent it, or share it with advertisers or data brokers.

Emails

• What you ask for: a link to reset your password or to confirm your address. Receipts come from Stripe.
• About the service: I may email you about something that affects your account, such as a change to these pages or to the price you pay.
• News and offers, only if you say yes. When you sign up, or once after you sign in if you were never asked, you can choose to get an occasional email when prices drop or something new ships. It is off unless you turn it on. I keep your answer and when you gave it. You can change it in Settings at any time, and every such email has a link that stops them in one click.

Who else sees it

• People you share a player with can see its usage and card names. Owners of a player can see the email addresses of everyone it is shared with.
• Yoto receives the requests needed to read and pause your players, as you'd expect from connecting your Yoto account. Your Yoto password never reaches this site.
• Stripe handles payments, and receives your email address and what you buy.
• Google knows you signed in to this app when you use Google sign-in.
• Resend sends the service's emails, and receives your email address and the message. It keeps them under Resend's privacy policy.
• Your browser's notification service (Google for Chrome and most Android browsers, Apple, Mozilla or Microsoft) carries the notifications you turn on. They are encrypted so that it cannot read them; it sees only that one was sent to your device.
• Cloudflare stands in front of the site to protect it from attacks: what you send and receive passes through it on the way to the server, and it sees your network address. It tells the server which country a request comes from, which is used only to show prices in your currency and is not kept. Email you send to the support address also arrives through it. It handles this under Cloudflare's privacy policy.
• Hosting: the service runs on Fly.io in London, and your data is stored there.

Getting a copy of your data

In Settings, choose Download my data. You get one file (JSON, which other programs can read) with your account details (email, when you signed up, plan, how you sign in, your Stripe customer ID, your Yoto connections, the devices you get notifications on and your API keys, without the keys themselves), and every player you own or were invited to, with its limits and daily play time per card. It leaves out what is only kept in a form nobody can read back, such as your password, recovery code and Yoto token, and it does not include other people's email addresses on players you share. Payment records are held by Stripe. For anything else about your data, email me (below).

Keeping and deleting your data

• Removing a player (Settings, then Stop limiting this player) deletes its limits and history.
• Deleting your account (Settings, then Delete account) removes your email, your plan and Stripe customer ID, your Google link, your sessions, your Yoto connection and the players on it. Players others share are kept for them unless you choose to delete those too.
• Play history older than 90 days, expired sessions and expired password reset links are removed automatically.

Security

Passwords are hashed with Argon2id, Yoto tokens are encrypted in the database, sessions are stored hashed, and everything is served over HTTPS. No system is perfectly secure, but I keep the data small and the code simple. What the service can do with your Yoto account, how your account is protected and how to report a problem are on the security page.

Children

The service is for parents and caregivers, who make the account. It does not ask for anything about children beyond the name of the player you give it.

Changes and contact

If this policy changes, the date at the top changes too. For questions or requests about your data, email me at [email protected].