Continue with DiscordEffective: October 1, 2024 · Last updated: November 1, 2026
Yack Order (The Optimistic Yack Order, TOYO, “we”) operates ui.yackorder.org and its associated Toyo API. This policy explains how we handle personal information when you browse, sign in, submit content, donate or use member features. External websites linked from this service have their own privacy policies.
For privacy questions or requests, email contact@yackorder.org.
Information we collect and why
- Accounts and identity links. We process your email address, display name, provider account identifier, linked identities, role, verification records and session information to sign you in, manage access and connect contributions to your member profile. Email sign-in uses a verification link or code. Yoto and Discord handle their own passwords; we do not ask you to enter those passwords on this website.
- Yoto sign-in. The authorization request includes profile, identity, family library read access and offline access. We receive identity information and authorization tokens. Where archive credential storage is configured, access and refresh tokens are stored encrypted to support authorized Yoto archive operations. You can revoke the connection through Yoto; contact us to request removal of locally stored credentials.
- Discord sign-in and linking. We receive your Discord identifier, username, display name and available email address, and check membership in the community server. The authorization request includes identity, email, server membership and permission to join a server. We use the linked identity for membership and access checks.
- Contributions and member activity. We keep submitted card identifiers, URLs, metadata, processing outcomes, timestamps and any email or Discord identifier supplied with a submission. We use these to maintain the catalog, attribute contributions, prevent duplicate credit, calculate points and determine archive eligibility. We also keep member warnings, access decisions and archive unlock or delivery records where those features are used.
- Donations. Ko-fi notifications and historical donation imports provide transaction identifiers, dates, amounts, currencies, donor emails and payment or subscription types. These records support points, reconciliation and duplicate prevention. A donation with an email address may automatically create a member profile before you sign in; it does not create a verified login or send an email. Webhook records exclude donor messages, postal addresses and payment credentials. Payment providers handle your payment details.
- Feedback and correspondence. We store the category and message you submit, any optional contact information, and review records to investigate issues and respond. Please avoid including sensitive information or information about children.
- Technical information. Cloudflare processes connection information such as IP addresses and request headers to deliver and protect the service. Application logs include request identifiers, methods, paths, response codes, timings and errors. We also maintain usage counters to manage service limits and abuse.
You can browse public catalog pages without an account. Optional contact fields can be left blank, but some member features require identity verification or linked records.
Public catalog and private records
The catalog is intended for public use. Card titles, published product information, artwork, track metadata and publicly shareable MYO or YS links may appear in the website, API and scrubbed exports, including the public GitHub library. Protected playlist links and submitter contact information are excluded from public exports under our scrubbing rules. Please submit only material you are entitled to share.
Original source JSON may contain personal information and is retained separately in private Cloudflare R2 storage for preservation, verification and recovery. Authorized administrators can access private member, donation, submission and source records as needed to operate the service. Public copies may be downloaded or preserved by others; removing our copy cannot guarantee removal of independent copies.
Cookies and browser storage
We use the toyo_session cookie to keep you signed in for up to 30 days. Temporary Yoto and Discord OAuth cookies protect sign-in and linking and expire after about 10 minutes. Email verification links or codes expire after about 15 minutes; expiration does not necessarily delete the stored verification record.
Local storage remembers dismissed announcements and, when an administrator uses the API tools, an API key. Local storage can remain until cleared or overwritten. Our application does not include advertising trackers or third-party behavioral analytics scripts. Infrastructure providers may process operational and security information.
You can block or clear cookies and local storage in your browser. Blocking essential cookies can prevent sign-in and member features. Logging out ends the current session; clearing browser data does not delete server records or revoke a provider connection.
Service providers and other disclosures
We use Cloudflare for hosting, security, databases and private object storage and verification email delivery; Yoto and Discord for the connections described above; and Ko-fi and its payment providers for donations. GitHub and Internet Archive may receive public catalog material or public source URLs for preservation. Where archive delivery is available, external file hosts such as Gofile process your connection and download request when you visit them. Private Google Drive storage may be used for operator-managed archive preservation; ordinary visitors are not asked to connect their personal Drive.
Each provider processes information needed for its role and may also process information under its own privacy policy. These services can operate in countries other than yours. Where applicable law requires safeguards for international transfers, those requirements apply to our use of providers. We may also disclose information when required by law or necessary to investigate abuse, protect people or secure the service.
We do not sell personal information or share it for cross-context behavioral advertising.
Retention and security
We retain account and linked member records while needed to operate accounts and membership features; transaction and points records to reconcile credits, prevent duplicate awards and meet applicable obligations; and submissions and original source records for catalog preservation and provenance. Feedback and technical records are retained as needed for support, security and operations. Most of these records do not currently have a fixed automatic deletion schedule.
Signed-in users can request personal information deletion. This replaces personal information fields for linked email, Discord and Yoto identities with “deleted”, removes stored sign-in credentials and ends active sessions. Public and scrubbed urls will remain in the system. Catalog content and anonymous contribution records are retained. Processing may continue in the background and retries automatically after failures. This does not delete accounts held directly with Yoto or Discord. You can also request deletion or de-identification using the contact below. We assess what can be removed and what must be retained for legal obligations, security, disputes or record integrity. Backups and third-party copies may persist beyond removal from active systems. We use access controls and technical protections, including encrypted storage for configured archive credentials, but no online service can guarantee complete security.
Your choices and privacy rights
You can review your profile and manage supported linked-email settings on the website. To request access to, a copy of, correction of or deletion of your personal information, email contact@yackorder.org. Include enough information to locate your records, such as your account email or linked provider identifier. Do not send passwords, payment credentials or access tokens. We may ask you to verify control of the relevant account.
Depending on where you live, you may also have rights to restrict or object to processing, obtain portable data, withdraw consent where processing relies on consent, or complain to your local data protection authority. Where a legal basis is required, we process information to provide requested account and member services, pursue legitimate interests in maintaining and securing the catalog, comply with legal obligations, or act on consent where required. Withdrawing consent does not affect earlier lawful processing. We respond to requests as required by applicable law.
Revoking Yoto or Discord access prevents future authorized access through that connection but does not itself delete existing site records. Contact us if you also want those records reviewed for deletion.
Children
This community service is intended for adults, including parents, caregivers and collectors. It is not intended for children under 13 to create accounts or submit personal information. Please do not submit children's personal information. If you believe a child has provided personal information, contact us so we can investigate and remove it as appropriate.
Changes and contact
We will update the date on this page when this policy changes. For material changes, we will provide additional notice where required. Privacy requests and questions can be sent to Yack Order at contact@yackorder.org.