Privacy policy

Last updated 21 September 2026

Yoto Limiter is a small, independent service that sets daily play-time limits for Yoto players. It is run by one person, Gonçalo Gomes (“I”). This page explains what data it keeps, why, and what you can do about it.

What I collect

• Account: your email address, and either a salted hash of your password (Argon2id) or, if you sign in with Google, a link to your Google account. I also keep a hash of your recovery code. Passwords and recovery codes can't be read back.
• Yoto connection: a token that lets the server talk to your Yoto players, stored encrypted and used only to read your players and pause them.
• Players: their names, the limits and card rules you set, card titles looked up from Yoto, and daily play time per card for up to 90 days.
• Sessions: a random token, stored hashed, that keeps you signed in for up to 30 days. It lives in one cookie. There are no analytics, advertising or tracking cookies, and the site loads nothing from other companies.
• Network addresses: used in memory to slow down password guessing and sign-up floods, and not written to the database. My hosting provider may keep ordinary request logs.

Payments

If you buy Plus, the payment is taken by Stripe on its own page. This site never sees your card number. Stripe tells the server whether the payment succeeded, and the server keeps your Stripe customer ID, your plan, and whether it is a subscription, so that it can switch Plus on and off and open your billing page. Stripe collects and keeps the payment details under its own privacy policy, and may email you receipts. Stripe also keeps its own records of payments as the law requires, so they are not removed when you delete your account here.

Sign in with Google

If you choose “Continue with Google”, Google tells the server two things: your email address (which must be verified by Google) and your Google account ID, a number that identifies your account to this app. The app asks Google for only the openid and email permissions.

• It does not see your Google password, and it cannot read your Gmail, contacts, Drive, calendar or any other Google data.
• The email is used to identify your account. The account ID is stored so that you can keep signing in even if your email changes.
• If you already have a Yoto Limiter account with the same email, Google is linked to it only after you enter that account's password.
• Nothing from Google is used for advertising, sold, or shared with anyone.
• To stop using Google sign-in, delete your account (below). You can also remove this app's access at your Google account's connections page.

How it is used

Only to run the service: to sign you in, to read your players' state from Yoto, to enforce the limits you set, and to show you usage. It is not used for anything else, and I don't sell it, rent it, or share it with advertisers or data brokers. This service sends no email; any receipt comes from Stripe.

Who else sees it

• People you share a player with can see its usage and card names. Owners of a player can see the email addresses of everyone it is shared with.
• Yoto receives the requests needed to read and pause your players, as you'd expect from connecting your Yoto account. Your Yoto password never reaches this site.
• Stripe handles payments, and receives your email address and what you buy.
• Google knows you signed in to this app when you use Google sign-in.
• Hosting: the service runs on Fly.io in London, and your data is stored there.

Keeping and deleting your data

• Removing a player (Settings, then Stop limiting this player) deletes its limits and history.
• Deleting your account (Settings, then Delete account) removes your email, your plan and Stripe customer ID, your Google link, your sessions, your Yoto connection and the players on it. Players others share are kept for them unless you choose to delete those too.
• Play history older than 90 days and expired sessions are removed automatically.

Security

Passwords are hashed with Argon2id, Yoto tokens are encrypted in the database, sessions are stored hashed, and everything is served over HTTPS. No system is perfectly secure, but I keep the data small and the code simple.

Children

The service is for parents and caregivers, who make the account. It does not ask for anything about children beyond the name of the player you give it.

Changes and contact

If this policy changes, the date at the top changes too. For questions or requests about your data, email me at gomesgoncalo [at] gmail.com.