YuvaDeutsch

Privacy Policy

Yuva · Last updated: October 2026

1. Controller

Özkan Yilmaz, Buckower Damm 159, 12349 Berlin, Germany
Email: oezkan.yilmaz.de@gmail.com

2. Overview

Yuva has no server of its own. Your lists live on your devices and in your iCloud. Names, items, notes and links are end-to-end encrypted: only the devices of the people you share a list with can read them – neither Apple nor we can. Yuva has no ads, no tracking and no analytics.

3. Data the app processes

  • Lists (name, symbol, colour, order) and items (title, quantity, note, link, reminder, repeat, done or not)
  • Who added or ticked off an item, and when
  • The name you enter in the app
  • Members of a shared list and their permissions

4. Storage in your iCloud

Yuva stores your lists with Apple's iCloud (CloudKit) in your private iCloud area, or for shared lists in the owner's area. Contents are encrypted there. What stays unencrypted is technical information needed to sync: times, whether an item is done, order, colour and the iCloud identifier (no name) of whoever added or ticked off something. We have no access to your private iCloud area. Apple's terms and privacy policy apply to iCloud. Legal basis: Art. 6(1)(b) GDPR.

5. Sharing lists

Members of a shared list see its contents, the name you entered and who added or ticked off what. You can remove members, block people or leave a list at any time. Whoever is removed or leaves loses access.

"Share nearby" uses Bluetooth and Wi-Fi directly between devices. While Yuva is open, other Yuva users nearby see your first name. Your iCloud identifier is exchanged only after you both agree; a code on both screens shows you are really connected to each other.

6. Invitations and news (mailbox)

So that invitations, answers and news ("Anna ticked off milk") arrive as notifications, Yuva leaves small notes in the app's public iCloud area. Their content is end-to-end encrypted. Technical information remains visible: which iCloud identifier a note is for, which one wrote it, and when. These identifiers are only valid for Yuva and contain no name or email address. We can see this information in Apple's developer tools, not the content. The area cannot be searched by writer. Notes are deleted after 30 days. Your public key is also stored there, so others can encrypt invitations for you. Legal basis: Art. 6(1)(b) GDPR.

7. Notifications

Notifications are delivered through the Apple Push Notification service and decrypted only on your device. Item reminders are scheduled locally on your device. Both only with your permission.

8. Links in items

When you paste a link, your iPhone opens the page once to fetch its title. The page receives your IP address, as with any visit in a browser. Other devices load nothing from it until someone opens the link.

9. Widget, Apple Watch, Siri and Shortcuts

The widget and the Apple Watch show your lists. The data stays on your devices or travels over Apple's encrypted connection between your iPhone and your watch. If you use Siri or Shortcuts, Apple processes your voice input under its own terms.

10. Yuva Plus (in-app purchases)

Purchases and subscriptions are handled entirely by Apple (Apple Distribution International Ltd., Cork, Ireland, as an independent controller). We receive no payment data.

11. No tracking, no analytics

Yuva contains no analytics, tracking or advertising software. There is no profiling.

12. Crash reports

If you agreed to share analytics with developers, Apple gives us aggregated crash reports without reference to you. The app also keeps iOS crash and performance reports on your device; they leave it only if you send them yourself under "Diagnose teilen". In TestFlight we receive what you choose to send. Legal basis: Art. 6(1)(a) and (f) GDPR.

13. Reports about people

A report about a person ("Melden" in the app) sends us an email with their Yuva identifier so we can find them – never the contents of your lists. Legal basis: Art. 6(1)(f) GDPR (protection against abuse).

14. Retention and deletion

Lists stay until you delete them. Mailbox notes are deleted after 30 days. "Alle meine Daten löschen" (delete all my data) in the account screen removes your lists, your places in other people's lists, everything you wrote to the public area, and your keys. Signing out of iCloud deletes everything Yuva keeps on that device.

15. Email contact

If you write to us, we use your email address, your name (if given) and your message only to reply and delete them once the request is closed and no retention duty applies. The mailbox is provided by Google (Gmail; Google Ireland Ltd., Dublin, and Google LLC, USA); data may also be processed in the USA, based on the EU-US Data Privacy Framework (Art. 45 GDPR). Legal basis: Art. 6(1)(b) or (f) GDPR.

16. Contact form (Tally)

The contact form on the contact page is provided by Tally (Tally BV, Brussels, Belgium). When you open the page, your browser loads the form from Tally, which processes technically necessary data (IP address, browser). What you enter (name, email, message) is stored by Tally in the EU and emailed to us; we only use it to reply and delete it afterwards. To prevent spam, Tally may use Google reCAPTCHA (Google Ireland Ltd., possible transfer to the USA, EU-US Data Privacy Framework). A data processing agreement is in place with Tally (Tally privacy policy). Legal basis: Art. 6(1)(b) and (f) GDPR. You can always email us instead.

17. This website

This website is hosted on Cloudflare Pages (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When you visit it, Cloudflare processes technically necessary data (IP address, time, page, browser details) as our processor (Art. 28 GDPR) to deliver the site and protect it against attacks. Cloudflare may transfer data to the USA and is certified under the EU-US Data Privacy Framework (Art. 45 GDPR; Cloudflare Privacy Policy). Fonts and images are served from this site itself. No cookies, no tracking, no analytics. Legal basis: Art. 6(1)(f) GDPR (secure, fast operation of the website).

18. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), and the right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR). An email to oezkan.yilmaz.de@gmail.com is enough. You can also complain to a data protection supervisory authority, e.g. the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin.

19. Changes

If the app changes (e.g. new services), we update this policy. The version published here applies.