Privacy Policy

yesand (listed as Yes, And NYC on Apple) helps you find improv classes, workshops, drop-ins, jams and shows in New York City. This policy covers the website, iOS and Android apps and their catalog service.

Browsing and saved events

You do not need an account to browse or save events. Your saved event IDs and a cached catalog stay in the app’s storage on your device. If you choose to create an account, Google Cloud Identity Platform (Firebase Authentication) manages Google, Apple and email/password sign-in, and the catalog service stores your user ID, email, display name and saved event IDs so saves can sync across devices. Search text is not stored in your account. Device saves move into an account only when you choose to import them. Removing the app removes this local app data; your device backup settings may preserve a copy.

Calendar and sharing

Adding an event opens an editable Google Calendar draft so you can review and save it. The app does not upload your calendar or reminders. Sharing uses the system share sheet and sends the event information only to the destination you select.

Links that survive installation

App versions with DeepLinkNow support use it to open the event you selected or the app’s browsing screen from a business card, including after installation. Shared links contain public event and meeting IDs. DeepLinkNow processes the link, click time, IP address, device/browser details and an app-scoped device identifier to match a click with an app open and count active devices. Android uses the Play install referrer. On iOS, the link page may copy the link and the app checks it once; you can decline the system paste request. Network matching is best effort. DeepLinkNow says matching fingerprints are removed within 30 days and identifying click details are stripped after 30 days. We do not send your account credentials or saved-event list in these links. See DeepLinkNow’s privacy policy.

Performance and error monitoring

We use Sentry to diagnose application errors and measure sampled public-screen load, navigation and catalog-request timings. Reports include technical platform, app release/update and sanitized diagnostic information. We do not attach account identity, search text, request credentials or bodies, and exclude Account/admin screens. Sentry session replay, screenshots and view-hierarchy capture are disabled. The service receives technical network metadata to accept telemetry. Sentry processes diagnostic data under its privacy policy. Availability depends on the app version and its monitoring configuration.

Network requests and diagnostics

The app connects to our Google Cloud catalog service and Expo’s update service. Network services receive technical request information such as IP address, user agent, request time and requested URL. Google Cloud retains operational request and error logs to operate, secure and troubleshoot the service. The currently configured Cloud Logging default retention is 30 days. Expo update requests also include an installation identifier, app/runtime/update versions and, after an update failure, bounded fatal-error diagnostics. These technical records can be associated with an installation and are used to deliver updates and diagnose failures, not advertising tracking. Expo processes update requests under its own privacy policy. Organizer-hosted event images may be downloaded from their original hosts.

Website interaction analytics

The website and supported iOS and Android app versions use Microsoft Clarity for session recordings and heatmaps to understand navigation and layout problems. Clarity receives technical browser and request information, including IP address and interaction timing. Public page text and images may appear in recordings. We do not supply account names, emails or user IDs. Web account and administrator pages do not initialize Clarity and entering Account stops an active web recording; mobile capture pauses on private screens, with Clarity’s built-in sensitive-input protection. Advertising and analytics cookies are denied. Do Not Track and Global Privacy Control disable collection. Mobile versions with Clarity require native0.2.7 build4 in production or build3 in Toli. See Microsoft’s privacy statement.

Booking and administrator access

Booking opens an organizer’s website. Registration, payments and any account you create there are handled by that organizer under its own policies. Verified administrators can open management tools from the Account screen. The service retains administrator identity and changes to manage the catalog; ordinary app users do not receive this access.

Your choices

We do not use advertising tracking, sell personal information, or request location, contacts, camera or microphone access. You can remove saved events in the app and decline to save a calendar event. Delete an optional account from the Account screen after a recent sign-in to remove its profile and synced saves. A minimal deleted user-ID marker prevents old tokens from restoring deleted data; operational logs follow their separate retention. Device-only saves remain until you remove them or clear app storage. You can also request account deletion through the public account deletion instructions. Contact us to ask about privacy or request deletion of support correspondence. Please do not send passwords, payment details or other sensitive information.

Contact and changes

Email toli@toli.me for privacy requests. We update the date on this page when the policy changes.

Provider policies: Google · Expo.

Website analytics

This public information site uses Microsoft Clarity for usage analytics and session replay. Public page text is visible in recordings; form fields retain Clarity protections. Do Not Track and Global Privacy Control disable capture. URLs containing a query or fragment are excluded.