Privacy policy
Last updated: October 2026
We take the protection of your personal data seriously. This privacy policy explains which data the app Yin by You and this website process, and why. We process data in line with the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).
Controller
[Martin Umgeher]
[Musterstraße 1], [1010 Vienna], Austria
Email: info@semu.at
The app
Data on your device
Your flows, poses, photos and settings are stored on your device only. You need no account. We have no access to this data. If you use device backups (for example iCloud Backup), Apple stores this data as part of your backup.
Assistant
The assistant is optional. It uses an AI language model to suggest changes to your flow. Only when you send a request to the assistant, the app sends the following data to our server:
- your message to the assistant,
- the flow you are editing,
- the list of poses available in the app.
Our server (see Hosting) forwards the request to an AI language model of [AI provider name, address], and sends the answer back to the app. [AI provider] processes the request in [country / data center location] as our processor under a data processing agreement (Art. 28 GDPR). [AI provider: storage period of requests and answers; no use for model training; sub-processors; for transfers outside the EU: legal safeguard, e.g. EU adequacy decision or standard contractual clauses.] Legal basis: Art. 6(1)(b) GDPR (providing the feature you asked for).
To find errors and improve the assistant, the server stores each request for 30 days: your message, the earlier messages of the chat, the flow, the answer of the AI and technical data (time, app version, error codes). After 30 days, this data is deleted automatically. Please do not write personal information, such as health details, in your messages unless the assistant needs it. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a working and improving assistant).
For operation and security, the server also keeps short-lived technical logs (time, IP address, request status). These logs are deleted automatically after a short time.
Protection against misuse (App Attest)
To make sure that only the real app can use our server, the app uses Apple’s App Attest. On first use, the app creates a key on your device. Our server stores the public part of this key and an anonymous key ID. This data does not identify you. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in protecting the server against misuse).
Usage data
To improve the app, the app sends usage data to our own server, for example when you open the app, start, finish or edit a flow, or use the assistant. Each event contains the type of event, the time, technical details (app version, iOS version, device model, language) and, for flow events, the flow ID, number of steps and duration. To count events of the same installation, the app creates a random ID. This ID is not linked to your name, your Apple ID or your device ID. Usage data contains no names, no flow names and no texts. We do not store your IP address with it.
The data stays on our server (see Hosting) and is not shared with third parties. We use it only for our own statistics and keep it as long as we need it to improve the app.
You can turn this off at any time in the app under Settings → Privacy → “Share usage data”. The app then deletes the random ID and sends no more usage data. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in improving the app); you can object at any time by turning the setting off.
No tracking
The app contains no tracking across apps or websites, no advertising and no third-party analytics tools.
App Store
When you download the app, Apple processes data as described in Apple’s privacy policy. We receive no personal data from this process. If you agree to share crash reports with developers, Apple gives us anonymous crash reports.
This website
This website runs on our own server (see Hosting). It uses no cookies, no tracking and loads no content from third parties (no external fonts, scripts or embedded services). To deliver the pages, the server must process your IP address. We do not store access logs. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in providing the website).
Hosting
Our server for the app and this website runs at Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, in a data center in Nuremberg, Germany. All data on this server (see the sections above) is processed there. Hetzner processes this data only on our behalf, as our processor under a data processing agreement (Art. 28 GDPR). The data stays in the EU and is not transferred to countries outside the EU. Hetzner protects the data with technical and organisational measures, which TÜV Rheinland audits every year.
Email contact
When you write us an email, we use your email address and message only to answer you. We delete them when they are no longer needed, unless the law requires us to keep them. Legal basis: Art. 6(1)(f) GDPR.
Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection. To use these rights, write to info@semu.at.
You also have the right to file a complaint with a data protection authority. In Austria, this is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.