Last updated: March 14, 2026
YBook ("we", "us", "our") operates a multi-tenant appointment booking platform. This Privacy Policy explains how we collect, use, and protect your information when you use our service at ybook.app (the "Platform").
When you sign in via WorkOS (Google or Microsoft OAuth), we receive your name and email address. You may optionally provide a phone number in your account settings.
When you book an appointment, we collect the date, time, services selected, and any responses to custom booking form fields set by the business. Guest bookings collect your name, email, and phone number.
Business owners may create customer records that include visit history, tags, and notes. This data is managed by the individual business and visible only to that business's team.
If you leave a review after an appointment, we store your star rating and comment. Reviews may be displayed publicly on the business's landing page, depending on the business owner's settings.
If a business uses inventory tracking, checkout/return records, item condition, and any damage notes are stored in connection with your appointment.
We collect IP addresses and user agent strings for security purposes. This information is stored in audit logs to detect and prevent unauthorized access.
We use a single cookie called session_token to keep you signed in. It is an httpOnly, SameSite=lax cookie with a 30-day expiry. We do not use tracking cookies, advertising cookies, or any third-party analytics cookies.
When you book with a business on YBook, the business owner and their team can see your name, phone number, email, booking history, reviews, and any tags or notes they have added to your customer record. They cannot see your bookings with other businesses.
We use the following third-party services to operate the Platform:
We do not sell, rent, or trade your personal information to third parties for marketing purposes. We may disclose information if required by law or to protect the safety and security of our users and the Platform.
We use a single, essential cookie:
| Cookie | Type | Duration | Purpose |
|---|---|---|---|
session_token | Essential | 30 days | Authentication (httpOnly, SameSite=lax) |
We do not use any tracking, advertising, or analytics cookies.
We take reasonable measures to protect your information, including:
We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date at the top of this page. Your continued use of the Platform after changes are posted constitutes your acceptance of the updated policy.
If you have questions about this Privacy Policy or want to exercise your data rights, contact us at [email protected].
See also our Terms & Conditions.