Privacy

LAST UPDATED — AUGUST 2026

Minimally invasive by design. Scans are anonymous, brand data comes from the public record, uploaded files are read and not stored, and no analytics or tracking scripts run on this site.

What we collect

YKO collects as little data as possible to operate the platform:

  • Anonymous barcode scans from GreenSpecs — no account is required to scan a product.
  • Your email address only if you contact us or type it into a form yourself.
  • A note when a company record is opened or a trial is started — see “Product use” below.
  • No third-party analytics, no tracking pixels, no ad networks, no social SDKs. We run no third-party scripts of any kind.

How we use it

Scan data is aggregated to build and improve the YKO scoring dataset. Individual scan records are never sold, licensed, or shared with third parties for commercial purposes.

Email contacts are used exclusively for the conversation you initiated. We do not add you to marketing lists without explicit consent.

To read a product label, GreenSpecs sends the scan image and label text to a third-party vision provider (Google), which acts as a processor on our behalf. These requests carry no user, account, or device identifier, and this data is not permitted to train Google’s models.

Product use

We record when someone opens a company record on this site or starts a trial, so we know which companies are being looked at. This is first-party and deliberately thin.

What a record contains
  • Which page was opened — for example a company record, a requests page, or a report.
  • Which company the page is about.
  • Coarse location — city, region, and country resolved at the edge. The IP address itself is never stored.
  • The time.
  • An email address only when you typed one into a form yourself.

There is no cookie, no device fingerprint, no advertising identifier, and no session or visitor id. Nothing in this record can follow a person between visits, and nothing is shared with another site. We cannot tell that two visits came from the same person, and we do not try to.

Ordinary reading is not recorded. The home page, the regulation briefs, the methodology, and this policy carry no such record — only company records and trials do, because that is the part we need to run the business.

These records are used internally to see who is trying the product. They are never sold, licensed, or shared with third parties.

Files you upload

On the gap analysis page you can upload the form a customer sent you — a PDF, a spreadsheet, a portal export, or a photo of the page.

What happens to the file
  • It is read once, in memory, to pull the questions out of it. The file itself is never written to storage — not to a disk, not to a bucket, not to a backup.
  • The text pulled out of it is kept with your analysis, so you can come back to the result and are not re-uploading the same form next quarter. That text is capped and it is what the page showed you.
  • To read a PDF or a photo, the file is sent to Anthropic, which acts as a processor on our behalf and is not permitted to train on it. Text formats are read by us without leaving our infrastructure.
  • Nobody at YKO reads your file unless you ask us to — by leaving an email and ticking the follow-up box on the results.
  • No account, no login, and nothing about the upload is tied to an identity unless you type an email in yourself.

If you would rather nothing left your own machine, paste the questions instead. That path sends text only.

Supplier links and the evidence locker

When a company asks its suppliers for documents through YKO, each supplier gets a private link addressed to them. There is no account and no password.

What is held, and who can see it
  • The supplier’s business contact details, supplied by the company that asked for the document.
  • The document the supplier sends — a certificate, a bill, an audit report — with the date it arrived and who sent it.
  • The figures we read off that document, and which question each one answers.
  • Whether the link has been opened, and whether a reminder was sent. Not how long anyone spent on the page.

Documents in a company’s evidence locker belong to that company. They are visible to that company and to YKO staff working on their record. They are not sold, not licensed, not shared with another company, and not used to score anyone else.

A supplier who wants their document removed can ask us directly, at the address below, without going through the company that requested it.

Cookies

We use only Cloudflare’s required infrastructure cookies, necessary for security and basic platform operation. They do not track you across websites and are not used for advertising or analytics profiling.

We set no marketing cookies, no analytics cookies, and no persistent identifiers beyond what Cloudflare requires for edge caching and bot protection.

The YKO score dataset

When GreenSpecs scans a product, we record product-level information about the scan. None of it is tied to your identity, an account, or a device — scan records carry no user, session, or device identifier, so they cannot be linked back to you or joined into a profile.

Fields recorded per scan
  • Product identity — barcode and/or the brand and product name read from the label.
  • Timestamp — coarsened to the hour; no minute-level precision retained.
  • Coarse location — city, state, and country derived from your IP at the edge (not GPS); we keep the place names, not the IP.
  • The YKO score shown, and the AI-derived assessment — category, claims and certifications read from the label, rubric sub-scores, and the flags or tips generated.
  • Shelf context where available — retailer or store name and shelf price, used as aggregate market signal.

We do not record your identity, device fingerprints, advertising identifiers, precise (GPS) location, or any cross-site or cross-app identifier. The scan photo is processed to read the label and is not stored unless you explicitly choose to contribute it. This data exists only in aggregate — as product and market signal that powers the independent score — never as a record of who you are or what you personally scanned over time.

Brand data

All brand scoring data comes from publicly available sources: company sustainability reports, regulatory filings, third-party audits, and published certifications. Sources are cited in every score entry.

We do not obtain proprietary supply-chain data or non-public information from brands. If a brand believes published data is factually incorrect, they can contact us with supporting documentation.

Your rights

You have the right to request access to, correction of, or deletion of any personal data we hold about you. Because we do not collect personal data through normal platform use, this primarily applies to email correspondence.

To make a data request, email hello@yko.earth with the subject line “Data Request.” We respond within 30 days.

If you are in the European Economic Area, you have additional rights under GDPR. If you are in California, you have additional rights under CCPA. We honor these rights regardless of your location.

Contact

Questions about this policy or our data practices: hello@yko.earth

YKO is operated by the team behind GreenSpecs.app, based in California, USA.