Yatoon Salon Booking & Appointments

Run your salon’s bookings, schedules, payments, and customer relationships from WordPress.

Yatoon gives salons a polished booking experience for clients and a practical local booking toolkit for the team. Clients choose services, add-ons, professionals, dates, and times on mobile; staff manage the day from WordPress.

Try the live booking demo – no account or installation required.

Watch the complete mobile booking demo:

Built for nail salons, hair salons, barbershops, spas, beauty studios, and other appointment-based businesses. Yatoon has also been used for daily bookings at a real nail salon for more than a year.

Local-first workflow: Free keeps scheduling, availability, customer records, and bookings inside WordPress. External payment, calendar, messaging, and platform connections are Pro features.

What Free includes

• Local WordPress scheduling, availability checks, customer records, notifications, and booking management
• Mobile booking for services, options, professionals, dates, times, customer details, and confirmation
• Customer self-service for reviewing, rescheduling, cancelling, and rebooking appointments
• Staff calendar workflows with mobile rescheduling, temporary breaks, shared-resource checks, and capability-based Yatoon roles
• Services, categories, images, variations, add-ons, pricing, staff qualifications, schedules, breaks, and closed dates
• Waitlist, service menu, customer portal, staff portal, booking blocks, Elementor, and shortcode integrations
• Customer-facing AI Chat when WordPress AI Client and a provider are connected and Chat is enabled by an administrator

Third-party integrations are optional and require their own accounts, credentials, supported regions, and provider terms. Local mode continues to work inside WordPress when an external provider is unavailable.

What customers experience

• A mobile booking flow for services, variations, add-ons, professionals, date, time, customer details, and confirmation
• Several services or guests in one booking journey, with separate staff choices and reference photos where enabled
• Clear service durations, prices, appointment summaries, directions, and calendar actions
• Secure self-service for viewing, rescheduling, cancelling, rebooking, and eligible service changes
• A branded service menu, discovery storefront, portfolio, favorites, quick rebooking, and lightweight installable customer app

What your team manages

• Services, categories, images, variations, add-ons, pricing, staff qualifications, and schedules
• Business hours, staff schedules, breaks, time off, closed dates, and availability rules
• Appointment calendar, client records, notes, reports, notifications, and waitlist
• Mobile-friendly rescheduling, temporary break controls, shared-resource checks, and role-specific staff workspaces
• Move in from Fresha, Square, Booksy or Vagaro in about 10 minutes: customers, appointment history, package visits and gift card balances import from CSV with a preview and one-click undo. Yatoon takes no commission on bookings.
• Trackable Book links for Google, Instagram, Facebook and TikTok, a link-in-bio page, QR codes, and a report of where bookings come from

Before a booking or sensitive change is saved, Yatoon rechecks staff qualification, schedules, breaks, closed dates, existing appointments, shared resources, and relevant external availability. If a time is taken during checkout, the customer keeps their details and gets a clear recovery path.

Add it to any WordPress page

Use the native block, Elementor widget, or one of these shortcodes:

• [yatoon_booking] – complete booking form
• [yatoon_service_menu] – visual service menu with Book buttons
• [yatoon_customer_portal] – customer self-service portal
• [yatoon_staff_portal] – mobile staff schedule portal
• [yatoon_discovery] – discovery storefront and booking entry points
• [yatoon_link_in_bio] – mobile link-in-bio page with a Book button and popular services

External Services and Privacy

Google Maps – www.google.com/maps. The confirmation page displays a lazy-loaded map when a business address is configured. The preview sends the public business address and normal browser connection information to Google; it does not include customer names, email, appointment details, or manage tokens. Clicking the map opens Google Maps directions to that address. See Google Privacy and Google Terms.

Free Local mode performs booking and availability inside WordPress and does not require Square, Vagaro, Stripe, PayPal, Twilio, Google Calendar, Microsoft Outlook, or Meta WhatsApp.

Optional external services are described below. They are used only by their configured features; third-party sign-in additionally requires the user to choose the relevant sign-in button. Local booking does not require third-party sign-in.

Google sign-in – accounts.google.com, oauth2.googleapis.com, openidconnect.googleapis.com. Available in Free and Pro, disabled by default. After an administrator configures and enables it, a customer or eligible staff member can choose Google sign-in. The browser sends the configured OAuth client ID, callback URL, requested identity scopes, and random state/nonce to Google. The server exchanges the authorization code using the configured client credentials and requests the approved identity profile. Google returns an account identifier, verified email, and name/profile image URL when available; Yatoon uses this identity to link the local account. Appointment details are not sent for sign-in. See Google Privacy and Google Terms.

Sign in with Apple – appleid.apple.com. Available in Free and Pro for customers, disabled by default. After an administrator configures and enables it, a customer can choose Apple sign-in. The browser sends the Services ID, callback URL, requested name/email scopes, and random state/nonce. The server exchanges the authorization code with a signed client credential and fetches Apple’s public verification keys. Apple returns an account identifier and, when approved and available, name/email; the email can be an Apple private relay address. Yatoon links this identity to the local account. Appointment details are not sent for sign-in. See Apple Privacy and Apple Developer Terms.

Facebook sign-in – www.facebook.com, graph.facebook.com. Available in Free and Pro for customers, disabled by default. After an administrator configures and enables it, a customer can choose Facebook sign-in. The browser sends the configured App ID, callback URL, requested public-profile/email scopes, and random state. The server exchanges the authorization code using the configured app credentials, then requests the approved profile with the access token. Meta returns the account identifier, name, and email when available; Yatoon links this identity to the local account. Appointment details are not sent for sign-in. See Meta Privacy and Meta Platform Terms.

Fonts. Yatoon does not download fonts from any remote host, and does not bundle font files either. Choosing a font family under Brand & Colors only adds that family name to the CSS font stack; otherwise the system font is used.

Yatoon push relay (Cloudflare Worker) – https://yatoon-api.yatoon.workers.dev. Optional and disabled by default. When explicitly enabled, Yatoon sends a signed, pseudonymous browser push subscription endpoint and a generic event type to this Cloudflare Worker. Customer names, contact details, services, appointment times, and notes are never sent. See Yatoon and the Cloudflare Privacy Policy.

Freemius – https://api.freemius.com. Used for optional account connection, licensing, plugin updates, and upgrade screens. It is contacted only when an administrator opts in or uses one of those features. See Freemius Privacy Policy and Freemius Terms.

Provider integrations. Each service below is contacted only when an administrator has configured its credentials and switched the corresponding feature on, and only while performing the action that needs it. Provider credentials are stored encrypted in WordPress; Yatoon diagnostics must not include them.

Free package providers. Free can use the following optional services when the site owner enables them:

• Google Maps – www.google.com/maps (confirmation-page directions map)
• OpenAI – api.openai.com (optional AI assistant). Privacy – Terms
• Anthropic – api.anthropic.com (optional AI assistant). Privacy – Terms
• Google Gemini – generativelanguage.googleapis.com (optional AI assistant). Privacy – Terms
• Cloudflare Turnstile – challenges.cloudflare.com (optional booking-form bot check). Privacy – Terms

Before any customer text can reach an AI provider, an administrator must enable the relevant AI feature, and Yatoon requires explicit one-time customer consent and screens the message for sensitive data. Customer-facing AI is off by default on new installations, and connecting a provider alone does not publish it.

Verification cookie. When booking verification is on and a customer enters a correct code, they can tick “Remember this browser”. Only then does Yatoon set a signed, HTTP-only cookie (yatoon_verified_contacts) holding a one-way hash of the verified phone or email, so the same browser is not asked again. It contains no readable personal data, lasts 30 to 365 days (90 by default), and can be turned off in Settings > Booking Verification. Suggested policy text is added to the WordPress Privacy Policy Guide.

Site owners are responsible for obtaining required consent, publishing an accurate privacy notice, configuring retention, and complying with the rules of their region and chosen providers.