Privacy notice

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Managing director: Sepita Ansari Pir Seraei
Register court: Amtsgericht München, registration number: HRB 315154
Phone: +49 176 81136011
Email for privacy enquiries: datenschutz@yedeni.com

2. Data protection officer

We are not currently required to appoint a data protection officer: fewer than 20 people are permanently engaged in the automated processing of personal data (§ 38(1) BDSG) and our core activity does not require large-scale regular and systematic monitoring within the meaning of Art. 37(1) GDPR. We have nonetheless carried out a data protection impact assessment under Art. 35 GDPR because we process health data. Please direct questions to datenschutz@yedeni.com.

3. What data we process

3.1 Account and sign-in data

• Email address
• Password (stored only as a cryptographic hash; we cannot read it)
• Display name and username
• When signing in with Apple or Google: the identifier and email address provided (with Apple, optionally an anonymised relay address)
• Sign-in timestamps and failed sign-in attempts

3.2 Health data (special category)

• Sex, date of birth and age (for the birthday greeting we use only the day and month; that greeting is not a processing of health data)
• Height, body weight and weight history, body fat percentage
• Nutrition goals (lose, maintain, gain) and target weight
• Your optional answers to the question “Which of these apply to you?” in onboarding or in the one-time introduction after an update — what has got in the way of your goal so far and what you would like (counting annoys me, not knowing what to eat, too much effort, no progress, healthy recipes, no restriction). We use them to show and suggest to you first, in onboarding and in the app, what fits them, and never for advertising or marketing emails
• Allergies and food intolerances
• Diets and preferences (e.g. vegan, vegetarian, dislikes)
• Dietary rules you set yourself, as ingredient exclusions: no pork, no alcohol, no gelatine, no shellfish, no beef, no meat together with dairy (optional; see the note below this list)
• Activity level, self-recorded activities and workouts (type, duration, intensity, distance, energy expenditure, time)
• All logged meals with nutrition values, plus water, caffeine and supplement entries
• Whether you usually weigh pasta, rice and grains raw or cooked, derived from your answers to the coach's follow-up question. After two identical answers we stop asking and calculate with that state; you can switch it on any entry at any time
• Daily values (steps, active energy burned, body weight) and individual workouts imported from Apple Health or Health Connect once you allow the connection (see section 8)

3.3 Content you create

• Recipes with ingredients, steps, photos and videos
• For recipes submitted for review before publication (from accounts without the “verified” badge and after a recipe was not approved), and for recipes we take out of public view because of a breach, the state of the review: when it was submitted and decided, the outcome (in review, approved, changes requested, not approved), our team's reasons where a recipe is not approved, and the hints of the automatic pre-check (section 15)
• Messages from our team about your recipes — requests for changes and suggestions, including for published recipes — with their timestamps and your decision on a suggestion, and, until you decide, the copy of your recipe revised by our team, which is not public (community terms no. 5.2)
• Ratings (stars only) and collections. We do not store text or photos that an older app version sends along with a rating; photos it has already uploaded for one are deleted immediately
• Profile picture and profile text
• Shopping lists and weekly plans
• Messages to the AI coach, including voice recordings and photos of meals and labels
• Photos of cooked dishes that you save to a diary entry (visible outside the app only if you share them yourself)
• Reports you submit about other content or accounts
• Emails to us, for example to support, including attachments and the details your email client sends along (sender name, headers); if the email states your user ID, app version or operating system, we use them to match the request to your account

3.4 Usage data

• Recipes viewed and saved, likes, follow relationships, ratings you marked as helpful — on your own recipes this mark is your thanks for the rating
• Streaks — on how many days in a row you have logged something; achievements and levels from before we discontinued them, until they are deleted
• Feedback on suggestions (accepted, rejected, cooked)
• Invitation and referral codes
• Requests to rate the app in the App Store or on Google Play: when and on which occasion we asked you (for example at your third meal or when your streak reaches a new stage), and the last event that pauses the request for 72 hours (an entry corrected or deleted, negative feedback or a report, a failed payment)

3.5 Technical data

• IP address and timestamp in server logs
• Device type, operating system, app and runtime version, language setting, time zone (so that reminders and suggestions arrive at your local time)
• Push token, if you allow notifications
• Error and crash reports
• Device advertising ID, if you consent to personalised advertising
• An identifier of your device in the step in which your account receives the Pro days — stored only as a checksum (section 3.6)

3.6 Checksums for the Pro days

The gifted Pro days (§ 2(5) of the terms) exist once per person and device, not only once per account. To check this, in the step in which your account receives the Pro days — when you complete setting up the app or start the one-time introduction after an update — we process three pieces of information:

• an identifier of your device that the app transmits for this purpose: on an iPhone, a random identifier the app places in your device's keychain — it stays there even if you delete and reinstall the app, and disappears only when you reset the device —, on Android, the Android ID the system provides to the app on this device (it changes only when you reset the device to factory settings). On an iPhone the app creates the identifier only in that step; it reads and transmits it only then and uses it for nothing else
• your email address in a standardised form — in lower case, without any suffix after a “+” before the @ sign and, for Gmail, without dots, because all these spellings arrive in the same mailbox
• the identifier of your Apple or Google account, if you sign in with it — it stays the same even if you create a new account with us

For this check we store none of this information itself, only one checksum each: a hash value formed with a secret key (HMAC-SHA-256), together with the kind of information, the time and the link to your account. The information cannot be read from the checksum; it only lets us establish whether Pro days have already been granted for the same information. If so — for another account or a deleted one —, your account receives no Pro days; likewise if the app transmits no device identifier. We use the checksums themselves for nothing else: not for advertising, not for product analytics and not to recognise you across devices or services; with your consent to product analytics (section 11) we only count whether Pro days were granted or refused and for what reason. The legal basis is our legitimate interest in protecting the free offer against abuse — for example against someone obtaining Pro days again through further accounts or by deleting and re-creating their account (Art. 6(1)(f) GDPR). In our assessment your interests do not override it: we store only checksums, only for this purpose and only for 12 months, and the consequence concerns only an additional gift — your account, Yedeni Basic and all other services remain unaffected. We do not obtain separate consent for placing and reading the device identifier on your device, because it happens only in the step in which your account receives the Pro days and is strictly necessary for granting them under the conditions in § 2(5) of the terms (§ 25(2) no. 2 TDDDG). We delete the checksums 12 months after the grant. If you delete your account earlier, on deletion we only remove the link to your account; the checksums remain until the 12 months have passed (section 13).

Objection: you may object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR); write to datenschutz@yedeni.com. Without the check, however, we do not grant Pro days. After an objection we keep checksums already stored only where we can demonstrate compelling legitimate grounds that override your interests; we assess this case by case. If your account did not receive Pro days and you believe this is a mistake, write to us as well — a human on our team reviews the case (section 15).

4. Purposes and legal bases

5. Your consents and how to withdraw them

We obtain every consent separately and record which version of which document you accepted and when (Art. 7(1) GDPR). Your consents to information and promotional emails, notifications and product analytics are listed in the app under "Settings" > "Other" > "My consents", where each can be withdrawn individually; the consent to personalised advertising is withdrawn under "Settings" > "Other" > "Ad settings" (the entry appears once the consent form has been shown). The consent to processing your health data is likewise withdrawn under "My consents" — because the app cannot work without that data, your account is deleted in the process (see table) — or by writing to us (the contact details are in section 1).

The lawfulness of processing carried out before withdrawal remains unaffected.

6. Artificial intelligence

Yedeni's central features rely on large language models from OpenAI. Because health data leaves the EU in the process, we set out exactly what happens.

6.1 What is transmitted

• Your message to the coach verbatim, including voice recordings for transcription
• In the exercises in onboarding and in the one-time introduction after an update, the sentence you type or speak there — what you ate, what is in your fridge or which cuisines you like —, and for the fridge exercise also your diet, allergies and intolerances, dietary rules and dislikes, the meal and a calorie ceiling for the dish taken from your budget. As with a message to the coach, this serves only to produce the answer, and the sentence is likewise checked for impermissible content by OpenAI's moderation service. Neither the sentence nor the answer is stored — no conversation, no diary entry —, only how many exercises your account has used (at most 30) and, as for every AI request, a cost record without content (section 13). The exercises run only after you have consented to the processing of your health data
• Photos of meals, labels and foods that you take
• The slice of your profile needed for the answer: nutrition goals, remaining daily budget, allergies, preferences, the meals already logged today, your weight history and today's activity — steps, active energy burned, the daily expenditure derived from them and today's workouts with type, duration and energy; for workouts imported from Apple Health or Health Connect additionally the start time and the note that a device measured them (section 8). These details are part of the context of every coach request
• Recipe text when creating, importing and translating, and for the automatic pre-check of a recipe submitted for publication (title, description, ingredients, steps, nutrition per serving; section 15)
• For that pre-check also the cover image and the other photos of the recipe, sent to OpenAI's moderation service — not the video and no photos or videos of individual steps (section 15)

6.2 What is not transmitted

• Your email address, your name and your password
• Your account identifier — no user identifier of any kind is transmitted
• Payment and subscription data
• The name and identifier of the app that recorded a workout, and the name of your device
• Your full history; only the slice needed for the specific answer is sent

6.3 Transfer to the United States, training and retention

Our contracting party is OpenAI Ireland Ltd.; requests are processed by OpenAI OpCo, LLC in the United States. OpenAI is not certified under the EU-U.S. Data Privacy Framework, so there is no adequacy decision of the European Commission covering this recipient. The transfer therefore relies on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR), which form part of our data processing agreement with OpenAI, and additionally on your explicit consent (Art. 49(1)(a) GDPR), which you give together with your consent to the processing of your health data.

Data submitted through the API is contractually excluded from model training. OpenAI keeps requests and responses for up to 30 days for abuse monitoring, longer only where OpenAI is legally required to. So that recurring requests can be answered faster and at lower cost, OpenAI may also hold parts of a request as encrypted intermediate states for up to 24 hours in a cache (prompt cache); this cache is limited to our account and not shared with any other organisation.

6.4 Labelling and limits

The coach is an AI system based on a language model from OpenAI: you are writing with an AI, not with a human, and an answer can be wrong. AI estimates carry a label in the app. The recipe images in our catalogue are AI-generated illustrative images, not photos of the dish; the app does not label them as such individually. Nutrition values are matched against our food database wherever possible rather than invented by the model. Even so, estimates — particularly from photos — can deviate substantially from reality. Always verify figures that matter to your health.

6.5 Quality assurance of coach answers

An AI coach that miscalculates nutrition values, or silently fails to make an entry, is more dangerous than one that does not answer at all. So that such faults surface, we record a technical diagnostic trace for every coach turn.

• Always stored (30 days): the model used and its settings, which tools were available to the model and which it called, response time, token usage, the error code if a turn failed, and a purely arithmetic suspicion score. None of this contains conversation content or health values. Solely for test accounts of our own team — active administrator accounts we have explicitly enabled for this — we additionally store the context excerpt of the turn; user accounts are never affected.
• Only with your separate release: the excerpt of the conversation itself and the specific figures the audit flagged. Without that release we record only that an answer was conspicuous — not what it said.
• You grant the release case by case: if you report an answer using the thumbs function, we ask you explicitly whether we may also evaluate the wording of that one case. The box is not pre-ticked. A release covers the reported case only, not your history.
• Withdrawal: you can withdraw a release you have given at any time — in the app via the thumbs function on the same answer, or by writing to datenschutz@yedeni.com. A case not yet worked on is then deleted in full; one already worked on loses the wording and keeps only the lesson drawn from it.

Independently of this, we as the operator can view your coach conversation — see section 12.1. The diagnostic trace does not change that; it exists so that a fault surfaces without anyone having to read along.

7. Recipients of your data

We use the following services. With every processor we have concluded a data processing agreement under Art. 28 GDPR. The recipients marked as independent controllers in the "Role" column — Apple and Google for sign-in, purchases and advertising, Apple additionally for push delivery to iPhones — process in their own responsibility under their privacy notices; the basis is your use of the respective service or, for advertising, your consent (section 9). An always-current version of this list is available at Sub-processors.

For a refund by us (§ 6(4) of the terms) we pass name, IBAN, amount and payment reference to our bank, which carries out the transfer to your bank (Art. 6(1)(b) GDPR). Both banks process these details as independent controllers under their own privacy notices. Beyond this we disclose personal data only where legally required (for example to law-enforcement authorities on a court order) or where you have expressly consented. We do not sell personal data.

8. Apple Health and Health Connect

If you explicitly allow it, Yedeni reads values and workouts from Apple Health (iOS) or Health Connect (Android) in order to determine your actual energy expenditure more accurately and to show your workouts in the diary. Workouts that your watch or fitness app (such as Garmin Connect, WHOOP or Strava) stores there reach Yedeni only by this route; there is no direct connection to these providers.

• What is read: active energy burned, steps and body weight, on Android (Health Connect) additionally total calories burned, and — if you allow workouts to be read — your individual workouts: type, start and end, duration, active energy burned, on iOS the distance, and the technical identifier of the app that recorded the workout. Yedeni reads total calories burned solely to derive your active energy expenditure from it: some apps and devices (such as Samsung Health or Fitbit) store only total expenditure in Health Connect, not active energy burned. For workouts, Yedeni requests on Android only the permission for exercise sessions, not the one for distance; the energy of a workout there is the active energy burned within its time window or, where only total calories burned are available for that window, the active expenditure derived from them (see below).
• Not read or not transmitted: workout titles and notes, routes and location data (GPS). The source display name that Apple Health supplies — often the name of your device, such as "Anna's Apple Watch" — is not transmitted by Yedeni; we derive the app name shown (such as "Garmin Connect") ourselves from the technical identifier.
• Processing: steps, active energy and weight are aggregated into daily values on your device; only those daily values are transmitted to our backend. Where active energy burned is missing on Android, the app derives it on your device from total calories burned: the daily value only if total calories burned cover the day (for example with devices such as Fitbit that record all day), by subtracting the resting expenditure for the time covered, namely the higher of two values — the basal metabolic rate we calculate from your body data and send to the app for this purpose, and the resting expenditure the app estimates from your device's data; the energy of a workout without active energy burned, by subtracting the pro-rata basal metabolic rate from the total calories burned within its time window. Only the active expenditure calculated in this way, as a daily value or per workout, is transmitted to our backend, not total calories burned. Workouts are transmitted individually and stored with your account, together with the activities you log yourself: type, duration, energy, distance, start, the day the workout counts towards, the platform, the workout's identifier in Apple Health or Health Connect, the identifier of the recording app and the app name derived from it. If two apps record the same workout, Yedeni imports it once.
• Purpose: calculating your energy needs, displaying them in the diary and the coach's advice built on them; for total calories burned, solely deriving your active energy expenditure (daily value and workouts).
• Advertising: data from Apple Health and Health Connect is never used for advertising, marketing or advertising-related profiling, and is never transmitted to ad networks.
• Sharing with the AI services: your activity for the current day — steps, active energy burned, the daily expenditure derived from them and today's workouts (type, duration, energy, start and the note that a device measured them) — is part of the context the coach receives with every request. It is therefore transmitted to OpenAI in the United States with every coach request, together with your weight history (section 6) — without your account identifier, without the name or identifier of the recording app, under a data-processing agreement and contractually excluded from model training. The legal basis is your explicit consent under Art. 9(2)(a) GDPR. The transfer to the United States relies on standard contractual clauses (Art. 46(2)(c) GDPR) and additionally on your explicit consent (Art. 49(1)(a) GDPR); OpenAI is not certified under the EU-U.S. Data Privacy Framework, for the remaining risk see section 6.3. These data are not shared with any other third party.
• Withdrawal: you can disconnect at any time in the app under "Settings" > "Devices & Health" > "Connect health data", or revoke the permission in your device settings, where you can also do so individually, for example for workouts only. Yedeni will then import no further values. Values and workouts already imported are kept for the period stated in section 13; you can delete or hide them before that. Every sync reconciles the workouts of the last two days (30 days on the first connection) with Apple Health or Health Connect: a workout deleted there is removed by Yedeni as well. Apple Health reports a revoked read permission for workouts like an empty store — the imported workouts of those days are then also removed at the next sync; older ones remain stored.
• Hiding a workout: you cannot edit an imported workout, but you can hide it on the "Activity" screen. It then no longer counts; energy, distance, app name and app identifier are removed. What remains is a marker made of the workout's identifier in Apple Health or Health Connect, its type and its time window — solely so that the next sync does not import it again. On request we delete this marker as well (datenschutz@yedeni.com); if the workout is then still in Apple Health or Health Connect, a later sync may import it again.

Yedeni writes no data back to Apple Health or Health Connect. Should that option be offered in future, it will happen only at your separate instruction.

9. Advertising

In Yedeni Basic, our free tier, we show ads via Google AdMob. Google processes the data arising from this — device advertising ID, IP address, coarse location, ad interactions, consent status — as an independent controller under its own privacy notice (section 7). Before the first ad we ask you, through Google's consent form (User Messaging Platform under the IAB Europe Transparency and Consent Framework), whether and for what you consent; the form names the advertising partners that may receive data if you consent, and you can choose individually there. On iOS we additionally ask via the system "App Tracking Transparency" dialog before your device advertising ID is used.

• Consent: you see personalised ads (Art. 6(1)(a) GDPR, § 25(1) TDDDG).
• Device access only, no personalisation: if you consent to storing and accessing information on your device but not to personalisation, you see non-personalised ads.
• Decline: Google serves at most limited ads without access to your device and without the advertising ID (Art. 6(1)(f) GDPR) — usually none. Yedeni Basic remains fully usable.
• Your health and nutrition data is never analysed for advertising or transmitted to advertising partners; the advertising module has no access to it.
• Yedeni embeds no other advertising SDK; the partners listed in the form receive data only to the extent you consent to them there.
• With an active subscription you see no ads; the advertising module is not even loaded.
• You can change your choice at any time under "Settings" > "Other" > "Ad settings".

10. Email communication

We distinguish two kinds of email. They run over separate sender addresses so that one cannot affect the other.

10.1 System emails

Confirmations about your account and subscription (registration, start and end of a subscription), notices about payment problems, announcements of an automatic renewal, security notices, invoices and replies to your support requests. These are part of the contract (Art. 6(1)(b) GDPR); as long as the contract is running you cannot object to them. In addition there are notices under the Digital Services Act — for example our reasons when we do not admit a submitted recipe or remove content, and the confirmation of a report (Art. 6(1)(c) GDPR in conjunction with Art. 16 and 17 of Regulation (EU) 2022/2065). We do not analyse these emails per recipient: our email provider counts opens and clicks at most in aggregate, without reference to your address.

10.2 Information and marketing emails

News, tips and offers. Some of these emails are triggered by how you use the app — for example that you published a recipe, that an invitation was redeemed, or that you have not opened the app for a while. Values from your nutrition diary are not used for this. The legal basis is your consent (Art. 6(1)(a) GDPR together with § 7(2) no. 2 UWG). Every such email carries an unsubscribe link; one click is enough, no sign-in is needed, and it takes effect immediately. We also set the `List-Unsubscribe` headers so that your email client can show its own unsubscribe button.

10.2a Confirming your consent (double opt-in)

After you have given consent in the app, we send you a system email containing a confirmation link. Only once you click it do we send information and marketing emails; without confirmation you receive only the emails about your account. The link is valid for seven days. To evidence your consent (Art. 7(1) GDPR) we store the time of that click, your IP address, the identifier of your browser or email client, and a checksum of the link we sent. We process these details solely as evidence, never for advertising; the legal basis is Art. 6(1)(c) GDPR together with our accountability obligation under Art. 7(1) GDPR. The same applies when you change your selection via the preference centre in one of our emails or unsubscribe via the unsubscribe link.

10.3 Performance measurement

For information and marketing emails we count opens and link clicks only in aggregate, without reference to individual recipients. The email contains a small image for this; neither your address nor your IP address is stored with its retrieval. If you do not want this, turn off automatic image loading or unsubscribe.

10.4 No health data by marketing email

10.5 Suppression list

If your mailbox permanently reports an address as undeliverable, if you mark a message as spam, if you unsubscribe from information and marketing emails, or if you delete your account, we record that in a suppression list. Unsubscribing blocks only information and marketing emails; undeliverability, a spam report and deletion block every email we send through our sending provider. While your contact record exists, the list holds your address together with a cryptographic checksum (SHA-256). When your account or contact record is deleted we remove the address; only the checksum remains, from which the address cannot be read — it can only be used to check whether an address entered again is blocked. These entries survive a deletion, otherwise the next send would write to you again, which is exactly what you did not want. If you later give consent again, demonstrably, with the same address, we lift a block that was due to unsubscribing or deletion; blocks due to undeliverability or a spam report remain.

10.6 Sending and mailbox providers

Information and marketing emails, the system emails about subscriptions and support, and the double opt-in confirmation emails are sent through Brevo SAS (France), processed in France and Germany, so with no third-country transfer. Brevo holds no contact list from us; per message it receives only the single recipient and the finished text. We also receive emails to our support through Brevo: they first arrive in our mailbox at Google and are forwarded from there to Brevo's inbound service, which hands them, attachments included, to our ticket system.

Our mailboxes @yedeni.com — including the addresses for support and privacy requests — are hosted by Google Workspace (contracting party: Google Cloud EMEA Ltd., Ireland). We also send the account emails of the sign-in service through Google's mail server, for example to confirm your email address or to reset your password. Google may process this data in the United States as well; the basis is the adequacy decision on the EU-U.S. Data Privacy Framework, supplemented by standard contractual clauses. Details in the list of sub-processors.

10.7 Waiting list and forms on yedeni.com

On our website you can join the waiting list for the alpha. We then store your email address, the language you chose, the platform (iOS or Android, if you tell us), where the sign-up came from (for example “Instagram”) and the time. The purpose is to inform you by email about the alpha and the launch of Yedeni. The legal basis is your consent (Art. 6(1)(a) GDPR); it must be given by a person aged 16 or older.

If you sign up with your email address, we only write to you after you have clicked the link in the confirmation email (double opt-in, as in 10.2a). To evidence your consent under Art. 7(1) GDPR we store the time of that click, your IP address, the identifier of your browser and a checksum of the link we sent. Without the click you receive no further email; the link is valid for seven days. You can leave the list at any time via the link in every email — the withdrawal takes effect immediately. Sending runs through Brevo (section 10.6).

Signing up with Google or Apple. The “Continue with Google” and “Continue with Apple” buttons only load content from Google (Google Ireland Ltd., Google LLC) or Apple (Apple Distribution International Ltd., Apple Inc.) after your first tap; before that, neither provider receives any data from this website. From that tap on, the provider receives your IP address and browser data, and Google may read its own cookies to show you your account — this happens because you expressly requested this service (§ 25(2) no. 2 TDDDG). If you sign up, the provider sends us a signed confirmation containing your email address (with Apple, a relay address if you choose) and the information that it is verified; your name is not requested. Your sign-up is thereby confirmed: you receive no confirmation email, only a short acknowledgement. We also store a checksum of the identifier the provider uses for you, not the identifier itself. The legal basis is your consent (Art. 6(1)(a) GDPR). Google and Apple also process data in the USA. Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023); Apple bases the transfer to the USA on the European Commission's standard contractual clauses. The provider's own privacy notice applies to its processing.

The contact and feedback form transmits your name, email address, topic and message to us; we create a case in our customer-relations system from it and reply by email. The legal basis is answering your enquiry (Art. 6(1)(b) GDPR, otherwise our legitimate interest in communicating with you under Art. 6(1)(f) GDPR). A message via the form is not a consent to marketing.

For both forms: on our server we additionally record a pseudonymous usage event (sign-up, confirmation, message received — with language, platform and origin, but without your email address) with our analytics provider in the EU (section 11) to measure how our channels perform. To prevent abuse we limit the number of requests per address and per connection; for that we process the IP address briefly (section 3.5).

11. Product analytics

With your consent we record via PostHog (Frankfurt data centre) which features are used. Collected are a pseudonymous identifier, screens viewed, actions triggered and device and version details. The contents of your meals, health values and chat messages are not collected. Without consent the analytics module is not started. You can withdraw consent at any time in settings. When you withdraw, we also delete the analytics data already collected under your identifier at PostHog; at the latest this happens when your account is deleted.

12. Publicly visible content

Please note which details become visible to others once you use the community features:

12.1 Access by us as the operator

“Not public” does not mean “readable by no one”. We therefore state explicitly when we ourselves can look at your content — including your conversation with the coach.

• Who: only named members of our team holding administrative authorisation. There are three graduated roles. The lowest serves analysis and sees only aggregated or pseudonymised information: no email addresses, no full names (at most initials or a partly masked value), and your private content — diary, body data, coach conversation — not at all.
• Sign-in with two factors: access to the administration area requires a password and a second factor (a one-time code from an authenticator app) at every sign-in. A session ends after at most twelve hours of inactivity. Within a session we do not require a new sign-in for individual accesses; actions that delete data or cannot easily be undone must each be explicitly confirmed.
• Two paths, of different reach: only the support role or the top role can open a specific account, and under our binding internal rule only when there is a concrete reason — a support request, a report or a legal request. This rule is organisational, not technically enforced; whether it was followed can be checked against the log (below). Separately there is a review of conspicuous coach answers across several accounts (section 6.5). The list for it shows technical metrics only; text appears only when an individual case is opened.
• For what: handling your support request or report; investigating reported abuse; reviewing a recipe you submitted for publication (community terms no. 5.2); investigating a technical fault; quality review of conspicuous coach answers (section 6.5); a legal obligation.
• Not for: advertising, profiling for advertising purposes, disclosure to third parties, or training our own models.
• Traceability: opening your account, one of your conversations or your health data (body data, goals, diary and weight entries, allergies and diet) is logged individually each time — who, when, what, and from which IP address.
• Operations overview: a live overview in the administration area shows recent activity in the app with masked identity only (initials, partly masked email address). Viewing it is logged once per 15-minute viewing period, not on every automatic refresh.
• Password set by support: if our support team sets a new password for your account, we always notify you at the email address stored in the account — even if you have unsubscribed from marketing emails.
• Your right: under Art. 15 GDPR you may ask whether and for what purpose your data was accessed.

For evaluations that are not tied to an individual case we use the content-free diagnostic trace described in section 6.5. If you wish to object to such access, contact datenschutz@yedeni.com; we will then examine whether the purpose can be achieved without your content.

12.2 Your review on the App Store or Google Play

This section applies to everyone who has reviewed Yedeni on the App Store or on Google Play — whether or not you have a Yedeni account. We do not receive this data from you but from Apple or Google.

• Source and data: As the provider of the app, Apple and Google make the reviews of Yedeni available to us through their developer interfaces — the same details that are publicly visible in the store. We store the name under which your review appears (on Apple your nickname, on Google the name of your Google account), star rating, title and text, country and language where the store provides them, app version, the time of the review and of its last change, and our reply. For Google Play we also store the device model and Android version; we do not store any further device details Google provides.
• Purpose and legal basis: We reply to reviews and learn from praise and criticism — for example which bugs occur in which app version or on which device. The legal basis is our legitimate interest in answering feedback on our app and improving it (Art. 6(1)(f) GDPR). You published the review yourself, and both stores expressly provide for app providers to read and answer reviews. If you write something about your health in a review, we process it only as part of the text you have manifestly made public (Art. 9(2)(e) GDPR) and do not analyse it separately.
• What we do not do: We do not link your review to a Yedeni account, our replies never mention anything from an account, we do not use reviews for advertising, and we make no automated decisions based on them.
• Who sees the data: at Yedeni only a few named people with the highest administrative role. We send our reply to Apple or Google; they publish it next to your review, notify you of it and act as independent controllers under their own privacy notices. Google LLC is certified under the EU-U.S. Data Privacy Framework; Apple bases transfers to the United States on the European Commission's standard contractual clauses. The data is stored with our database and server providers (section 7).
• Retention: We delete our copy 24 months after the last change to your review in the store. If you delete your review on the App Store, we delete our copy at the next full synchronisation, within seven days at the latest. We do not reliably learn when a review is deleted on Google Play; write to us and we will delete it immediately.

Right to object: You can object at any time to our processing of your review (Art. 21 GDPR). Write to datenschutz@yedeni.com and state the store, country, approximate date and the name under which your review appears. We then delete our copy and keep only a hash of the store's identifier for your review so that it is not imported again. You change or delete the review itself in the store, with Apple or Google. Your other rights and your right to lodge a complaint are set out in section 14.

13. Retention

After you delete your account we irreversibly remove all personal data within 30 days, unless a statutory retention obligation applies — with the exceptions we name here and on the page linked below. We delete your recipes together with their images and videos along with the account. Only recipes you published that others have taken over — into a meal plan, a collection, their favourites or their diary, with a rating, as cooked or as a copy — and recipes a notice under the Digital Services Act concerns, as evidence for the procedure, are retained, without your name. If you want that content deleted as well, contact datenschutz@yedeni.com. If your account received Pro days, their checksums remain, without a link to your account, until 12 months after the grant (section 3.6). Which other remnants survive an account deletion is set out on the Delete your account page.

14. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR) at any time. Address requests to datenschutz@yedeni.com; we respond within one month.

• Access and portability: under "Profile" > "Settings" > "Export data" the app immediately gives you a complete, machine-readable copy in JSON format.
• Rectification: most details can be changed directly in the app.
• Erasure: under "Profile" > "Settings" > "Delete account" you delete your account and all data yourself — no support ticket required.
• Objection: you may object at any time to processing based on legitimate interests.

Right to lodge a complaint

Without prejudice to any other remedy, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is:

You may also contact the supervisory authority where you habitually reside.

15. Automated decisions and profiling

Yedeni derives personalised nutrition suggestions from your goals, history and preferences, and personalises the content feed. That constitutes profiling within the meaning of Art. 4(4) GDPR.

No decision based solely on automated processing that produces legal effects or similarly significantly affects you within the meaning of Art. 22(1) GDPR takes place: all suggestions are non-binding recommendations, you decide freely in every case, and no legal consequences arise. The suggestions are the core of the service and cannot be switched off; alongside the personalised “For you” feed, the non-personalised recipe search is available to you at any time.

In moderating user-generated content, two checks run automatically: usernames are checked against a list of impermissible terms when they are created, and a recipe reported by three different accounts is hidden provisionally until a human has reviewed it. When a recipe is submitted for review before publication (community terms no. 5.2), an AI model from OpenAI also reads the recipe text for possible breaches and implausible details, OpenAI's moderation service checks the cover image and the other photos of the recipe for sexual content, violence and self-harm (both without your identifier and without your name, section 6; the video and the media of individual steps are not sent), and a program checks whether details are missing. If you change the video, photos, title or description while the recipe is in review, the pre-check runs again. This pre-check decides nothing: only the person on our team who reviews the recipe sees its hints. Approving a submitted recipe, removing content or suspending an account is always decided by a human; we tell you the reasons, and you can have the decision reviewed (community terms nos. 5 and 6).

Whether your account receives Pro days is decided automatically by a program under the conditions in § 2(5) of the terms, including on the basis of the checksums from section 3.6: if Pro days have already been granted for your device, your email address or your Apple or Google account, you receive none. The decision concerns only an additional, free gift; your account, Yedeni Basic and your other rights under the contract remain unaffected. It is necessary for performing these conditions (Art. 22(2)(a) GDPR). You may request that a human on our team reviews it, express your point of view and contest the decision (Art. 22(3) GDPR) — write to datenschutz@yedeni.com.

16. Children and young people

Yedeni is intended for people aged 16 and over. We check the minimum age when recording your date of birth; younger people cannot use the app. If we learn that data of a younger person is being processed, we delete the account without delay. Parents and guardians may contact datenschutz@yedeni.com.

17. Data security

We apply technical and organisational measures under Art. 32 GDPR, in particular:

• Encrypted transmission exclusively over TLS 1.2 or higher
• Encryption at rest for the database and media content
• Passwords stored only as cryptographic hashes and unreadable to us
• Every access to your data is checked server-side against ownership; row-level security policies apply additionally at database level
• The coach's AI-driven data access runs exclusively through a read-only, tightly scoped database role
• Rate limiting, protection against automated attacks and logging of security-relevant events
• Separated access roles, two-factor sign-in for administrative access with time-limited sessions, and logging of administrative actions
• Encrypted daily backups stored in the EU

18. Whether provision is required

Registration requires an email address; without it no account can exist. Providing health data is voluntary but is a precondition for the core features (calorie budget, suggestions, coach) — without it we cannot perform the contract. Your account receives the Pro days (§ 2(5) of the terms) only if the app transmits an identifier of your device in doing so (section 3.6); without it everything else stays the same. For a refund by us (§ 6(4) of the terms) we need the name and IBAN of the account we are to pay into; without them we cannot make the transfer, but your claim to the refund remains. All other details are voluntary and omitting them has no disadvantages.

19. Cookies and comparable technologies

The mobile app uses no cookies. Stored on your device are: your sign-in token (in protected system storage), your settings (such as language and appearance), your consent decisions, an encrypted cache for offline use and interface states — for example which introductions you have already seen, or when an error last occurred or you last wrote to support, so that we do not ask you for a rating in the 72 hours after it. In the step in which your account receives the Pro days, the app on an iPhone also places a random device identifier in the keychain, which stays there even after the app is deleted, until you reset the device; on Android it reads the Android ID for this (section 3.6). Any access to these that is not strictly necessary to provide the service — in particular analytics and advertising — occurs only after your consent under § 25(1) TDDDG. On an iPhone the app creates the device identifier only in that step, and on both systems it reads it only then, because granting the Pro days requires it under § 2(5) of the terms (§ 25(2) no. 2 TDDDG).

The web pages at yedeni.com, including these legal texts, set no cookies, store nothing on your device, read nothing from it and load no third-party content when opened (for the “Continue with Google/Apple” buttons see 10.7). We measure reach exclusively on our server: each page request produces a count event with the page, language, campaign details from the address (such as `utm_source`), referring domain, country and a rough device type (phone, tablet, computer). We do not pass on your IP address or browser identifier for this; every count gets a new random identifier, so no one can be recognised. The recipient is our analytics provider in the EU (section 11). The legal basis is our legitimate interest in measuring the reach of our website (Art. 6(1)(f) GDPR); you can object at any time (section 14).

20. Changes to this notice

We adapt this notice when our processing or the legal situation changes. The notice in force is always available in the app and at the address above. It carries two dates: the last updated date is the date of the last change of substance. The version identifies the text your consents are tied to; it changes only when one of your consents would then cover more or something else — such as new data, a new purpose or a new recipient of data whose processing you consented to. In that case we ask for your consent again in the app before the changed processing begins. If only the last-updated date changes, we have added or corrected information; your consents continue to apply unchanged. If we intend to process your data for a purpose other than the one we collected it for, we inform you beforehand (Art. 13(3) GDPR).