Privacy Policy

This policy explains how Yourni handles your personal data under the EU General Data Protection Regulation (GDPR). For a plainer summary, see the About Yourni article.

1. Who is responsible

The controller of your personal data is Monika Protivová, Filipova 2019/12, 148 00 Prague, Czech Republic. Contact for any data-protection questions: monika.protivova@gmail.com.

2. What data we process, and why

Yourni is designed to store your data locally on your device. The app keeps what you choose to enter:

• Mood and affect check-ins, sleep and wellbeing notes
• Check-ins about how you've been feeling — health data
• Journal entries and your conversations with the assistant
• Notes the assistant creates so it can pick up where you left off, and your app settings
• A rolling seven-day technical record of the requests sent to the AI provider and the replies received — kept on the device like everything else, never uploaded anywhere, used to show costs and diagnose problems, and deleted along with the rest of your data

The purpose is solely to provide the app's wellbeing-tracking and companion features to you. Some of this is health data — a special category under Article 9 GDPR. Where processing occurs, we rely on your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR), which you give by choosing to enter this information and which you can withdraw at any time by deleting the data or the app.

Because the data is held on your device, the controller does not receive or hold a copy of your entries, except as described in the next section.

3. AI processing and recipients

To provide the assistant, the content of your conversation — together with context such as recent messages, the assistant's notes about you, and relevant journal entries — is transmitted to an AI provider that generates the response.

Yourni operates no server: the request goes directly from your phone to the provider, and no copy reaches us in transit. Which account that processing happens under depends on the key the app is using, and it changes who is responsible for it.

With a key someone gave you: if the key you entered was issued from someone else's provider account rather than your own, the processing happens under their account. The provider then acts as a processor on that account holder's instructions under a data processing agreement, and the account holder is responsible for it. What they can see on that account is usage and cost, not the content of your conversations.

Either way, the key is stored in your device's keychain and used only for requests your phone makes directly to the provider — it is never transmitted to us. The provider retains request and response data for a limited period under that account's retention settings, and does not use it to train its models without the account holder's permission.

This may involve processing outside the EU/EEA (for example in the United States). Such transfers are governed by the providers' safeguards (such as EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework).

• OpenAI privacy policy
• Anthropic privacy policy

4. Diagnostics you choose to send

If you use "report a problem", a diagnostics report is prepared for you to send by email. It is created only at your request, you can review it before sending, and it is never transmitted automatically.

5. Retention

Your data stays on your device until you delete it — by clearing your profile in the app or by removing the app. The controller holds no server copy and therefore applies no separate retention period.

6. Your rights

Under the GDPR you have the rights of access, rectification, erasure, restriction of processing, data portability, and objection, as well as the right to withdraw consent at any time. Because your data is stored locally, you can exercise access and erasure directly: view your entries in the app, and delete your profile or the app to erase them. For any other request, contact monika.protivova@gmail.com.

You also have the right to lodge a complaint with the Czech supervisory authority, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz).

7. Children

Yourni is not intended for children under 16. If you believe a child has used the app, please delete the data on the device.

8. Security

Your data is stored in the app's private storage on your device and is protected by your device's own security (passcode, biometrics, disk encryption). Keep your device secure to keep your data secure.

9. Changes

We may update this policy. Material changes will be reflected here with a new "last updated" date.