# Yaffi Privacy Policy v1.0 ## Introduction Thank you for using **Yaffi** (the "Service"). Yaffi is an iOS app that works on top of Apple Reminders: it classifies new reminders, moves them to the right list, and enriches them with useful notes and links. This Privacy Policy explains what data Yaffi processes, what it deliberately does not collect, and your rights. The short version: **Yaffi has no accounts and stores none of your reminder content on its servers.** ## Data Controller and Contact The Service is operated by **Vitalii Rizo**, a private individual. For the purposes of data protection laws (such as the EU GDPR), Vitalii Rizo is the "Data Controller" of personal data processed through Yaffi. You can contact the Data Controller at: * Name: Vitalii Rizo * Address: Adlergestell 371, 12527 Berlin, Germany * Email: [support@vrizo.net](mailto:support@vrizo.net) ## What Yaffi Does Not Collect * **No account.** There is no sign-up, no email address, no password, and no user profile. * **No stored reminder content.** The text of your reminders is processed in memory to generate enrichment and is immediately forgotten. It is never written to a database, never used for training, and never shared for marketing. * **No contacts, no location history, no calendars.** Yaffi only reads the Reminders data you grant access to. Location is used only on your device (for optional "remind me when nearby" alerts resolved with Apple Maps) and is never sent to our servers. ## What Data Is Processed * **Reminder data, transiently:** When a new reminder is picked up, the app sends the reminder text, your list names, and your settings (country, language, detail level, custom instructions) to our backend so the AI can classify and enrich it. This data exists only for the duration of the request and is not retained afterwards. Reminder text can, depending on what you write, contain personal information — it is treated exactly the same way: processed and forgotten. * **Anonymous usage counters:** To enforce the monthly quota, the backend stores a counter keyed by an anonymous device identifier (a random ID generated on your device). This counter contains numbers only — never content. It cannot be linked to your name, email, or Apple ID by us. * **Technical logs:** Server logs contain only counts, timings, and error codes — never reminder text or list names. * **Derived search queries:** For "visit" and "watch" reminders, a short search query derived from the reminder (for example a place name or a film title) is sent to a web search service to find opening hours or streaming availability. The query is sent from our server, not from your device, and carries no identifier of you. * **On-device data:** The timeline, journal, list mappings, and the snapshot Yaffi uses to detect new reminders are stored only on your iPhone. Deleting the app deletes them. ## Analytics Yaffi uses **PostHog** (EU Cloud, hosted in the European Union) to understand which features are used and to catch errors. Analytics events contain feature names, categories, timings, and error codes — **never reminder text, list names, or any content you wrote**. Analytics data is keyed by an anonymous identifier, not by any account. ## Third-Party Processors * **Cloudflare (Cloudflare, Inc.):** Yaffi's backend runs on Cloudflare Workers, and AI classification/enrichment runs on Cloudflare Workers AI. Your reminder text is processed on Cloudflare's infrastructure in memory for the duration of each request. Cloudflare acts as a Data Processor; a standard Data Processing Addendum with Standard Contractual Clauses applies to any processing outside the EEA. * **Apple (Apple Inc.):** The app is distributed through the Apple App Store, and Yaffi Pro subscriptions are billed by Apple. We never see your payment details; Apple provides us only anonymous purchase receipts to verify the subscription. Apple processes your purchase under its own privacy policy. * **PostHog (PostHog, Inc., EU Cloud):** Product analytics without content, as described above, processed exclusively in the EU. * **Amazon:** "Buy" reminders may get an Amazon search link. The link may carry an affiliate tag; opening it is your action, in your browser, under Amazon's own privacy policy. We send nothing to Amazon. * **Web search:** Derived place/title queries (see above) are sent to a keyless web search endpoint to verify opening hours and streaming availability. No user identifier is included. ## Legal Bases for Processing (GDPR) * **Performance of a contract (Art. 6(1)(b) GDPR):** processing your reminder text transiently is necessary to deliver the enrichment you asked for by using the app. * **Legitimate interests (Art. 6(1)(f) GDPR):** anonymous quota counters, rate limiting, error logs, and content-free analytics keep the Service working, fair, and secure without identifying you. ## Data Retention * Reminder content: **not retained** (processed in memory, forgotten when the request completes). * Anonymous quota counters: kept per calendar month and expire automatically. * Technical logs: short-lived and content-free. * On-device data (timeline, journal, settings): stays on your device until you delete it or the app. ## Your Rights Under GDPR you have rights of access, rectification, erasure, restriction, objection, and portability. Because Yaffi keeps no content and no account, there is usually nothing server-side to access or delete beyond an anonymous counter — but if you have any request or question, contact [support@vrizo.net](mailto:support@vrizo.net) and we will respond within 30 days. You also have the right to lodge a complaint with a supervisory authority (for example, the Berlin Commissioner for Data Protection). ## Children's Privacy Yaffi is not directed at children under 16. We do not knowingly process personal data of anyone under 16; since we keep no accounts and no content, exposure is minimal by design. ## Changes to This Privacy Policy We may update this Privacy Policy from time to time. Updates are posted on this page with a new "last updated" date. Significant changes will be announced in the app. ## Contact Us Questions about this policy or your data: [support@vrizo.net](mailto:support@vrizo.net). ## Change log * **17 Jul 2026 (v1.0):** Initial version of the Privacy Policy.