1. Scope
The protection of your personal data is important to us. This privacy policy informs you, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), which personal data we process when you use the Yaca app for iOS, watchOS and Android (the “App”), the website yaca.pro (the “Website”) and the feedback board offered in the App (together, the “Services”), for which purposes and on which legal basis we process it, and which rights you have.
2. Controller
The controller within the meaning of Art. 4(7) GDPR is:
Kanbon GmbH
Gerbergasse 14, 9500 Villach, Austria
Email: hello@kanbon.io
For data protection enquiries and to exercise your rights, please contact us at the email address above. Further details are available in the imprint.
3. Using the App on your device
3.1 The App can be used without a user account. The content you enter, in particular homes, rooms, tasks, schedules, notes, completed tasks, statistics and settings, is stored exclusively on your device and is not transmitted to us, unless you share a home with other people (section 4).
3.2 Widgets, the Apple Watch and system features of your device, such as Live Activities and Siri, access this content on the device itself.
3.3 You can create a backup file in the App and decide where it is stored. Depending on your settings, your operating system’s device backup (iCloud or Google) may include App data. Apple or Google, respectively, is responsible for these backups under its own terms.
3.4 The App requests permissions only when you use the relevant feature: notifications for reminders scheduled on your device, and access to the camera and photos to design and save share cards. Photos are processed exclusively on your device.
3.5 To ask for a rating, the App uses the feature Apple or Google provides for this purpose.
4. Yaca Household (shared homes)
4.1 Purpose. Yaca Household lets you manage a home together with other people. So that all members and all signed-in devices see the same state, we store and synchronise shared homes on servers in the European Union.
4.2 Data processed. We process the following categories of personal data:
- Yaca ID: a pseudonymous identifier with access credentials, created when you first share or join a home. No name, email address or phone number is required. The credentials are stored on your device and may be part of your operating system’s device backup, so that you can continue to use the Yaca ID on a new or restored device.
- Content of shared homes: the names of the home, its rooms and tasks, schedules, notes, assignments and rotation orders, pauses, cleaning supplies, and completed tasks with the member and time.
- Member data: display name and colour, role in the home, the times of joining and leaving, and the accepted version of the terms of use. Each member chooses their own display name; it need not be their real name.
- Change history: which member made which change and when, including the previous and the new value.
- Device data: platform, app version, device name, and the times of sign-in and last use of each device signed in to a Yaca ID.
- Invitations: the invite link or invite code, the name of the home and the display name of the person inviting.
- Push identifiers: an identifier of your device issued by the Apple Push Notification service or Firebase Cloud Messaging (Google), through which we notify members’ devices of changes in the home, for example to keep widgets up to date. These notifications contain no content of the home.
- Connection data: technical connection data, in particular the IP address, which we process briefly to ensure the security of the Services and to prevent abuse.
4.3 Installation via invite links. If the App is installed on an Android device via an invite link, Google Play passes the invite code to the App (Google Play Install Referrer).
4.4 Visibility within the home. Members of a shared home see its content to the extent of their role, as well as the display names, colours and roles of the other members. Owners and co-owners can view the change history. A member’s Yaca ID is not visible to other members.
4.5 Legal bases. We process this data to perform the contract for the use of Yaca Household (Art. 6(1)(b) GDPR). Processing connection data to prevent abuse, creating backups, keeping the change history and retaining former members’ completed tasks are based on our legitimate interest, and that of the other members, in a secure service and a complete shared history (Art. 6(1)(f) GDPR). Storing access credentials and push identifiers on your device is strictly necessary to provide the service you have expressly requested (Art. 5(3) of Directive 2002/58/EC).
5. Purchases (Yaca Plus and Yaca Household)
5.1 Purchases are processed through Apple’s App Store or Google Play. Apple or Google, respectively, processes your account and payment data as an independent controller under its own privacy policy. We do not receive payment data.
5.2 To validate and manage purchases and subscriptions and to unlock purchased features, we use the RevenueCat service. This involves processing a pseudonymous app user ID, purchase and transaction data, device type, operating system and country. When Yaca Household is purchased, and for owners of a shared home, the Yaca ID is also processed in order to assign the subscription to it.
5.3 The legal basis is performance of the contract (Art. 6(1)(b) GDPR).
6. Usage analytics (Amplitude)
6.1 To analyse use of the App and improve it, we use the analytics service Amplitude to process information about how the App is used, in particular screens viewed and features used, together with app version, device model, operating system, language setting and a pseudonymous device identifier. Content of your homes, such as names of rooms, tasks or people, is not collected. No usage analytics take place on devices with the “Kid” role.
6.2 The legal basis is our legitimate interest in analysing and improving our offering (Art. 6(1)(f) GDPR).
6.3 The data is stored in the European Union and deleted after 24 months at the latest.
7. Error monitoring (Sentry)
7.1 To detect and fix errors and crashes, we use the Sentry service. When an error occurs, technical information is processed, in particular a description of the error, app version, device model, operating system, language setting, device state and the steps in the App immediately before the error, such as screens viewed. Content of your homes is not collected. Errors on our servers are also reported to Sentry.
7.2 The legal basis is our legitimate interest in error-free and stable operation of the Services (Art. 6(1)(f) GDPR).
7.3 The data is stored in the European Union and deleted after 90 days.
8. Feedback board
8.1 On the feedback board you can submit suggestions and bug reports, comment on them and vote. To do so, you create a profile with a display name and, optionally, an email address. We process your profile, your posts, comments and votes, and technical details attached to new posts (app version, operating system, device type, screen size, language setting and time zone) so that we can reproduce reported errors. Posts are transferred to our project management software for handling.
8.2 If you provide an email address, we notify you by email about replies and status changes on your posts. Every email contains an unsubscribe link.
8.3 The legal basis for the feedback board is our legitimate interest in collecting and answering feedback (Art. 6(1)(f) GDPR). The legal basis for email notifications is your consent (Art. 6(1)(a) GDPR). You may withdraw your consent at any time with effect for the future, in particular via the link in every email. Withdrawal does not affect the lawfulness of processing carried out before it.
9. Contact and reports
9.1 If you contact us by email or report another member in a shared home, we process the information you provide in order to handle your enquiry or report and, where necessary, to take measures under our terms of use.
9.2 The legal bases are performance of the contract for contract-related enquiries (Art. 6(1)(b) GDPR), our legal obligations, in particular under Regulation (EU) 2022/2065 on digital services (Art. 6(1)(c) GDPR), and our legitimate interest, and that of the members, in a safe service (Art. 6(1)(f) GDPR).
10. Website
10.1 The Website provides invite links, device pairing, deletion of the Yaca ID and legal information. The Website uses no cookies and loads no third-party scripts.
10.2 Hosting. When you visit the Website, our hosting provider Railway processes technical access data, in particular IP address, time of access and the address requested. The legal basis is our legitimate interest in secure and stable operation of the Website (Art. 6(1)(f) GDPR).
10.3 Audience measurement. For statistical analysis of page views, we transmit a random identifier per visit, the page viewed, language setting, device type and country to Amplitude. No information is stored on your device for this purpose. The legal basis is our legitimate interest in analysing use of the Website (Art. 6(1)(f) GDPR).
11. Recipients
11.1 We transfer personal data only where this is necessary for the purposes stated. The following service providers process data on our behalf and solely on our instructions (Art. 28 GDPR):
- Railway Corporation, San Francisco, USA: Hosting of the servers for Yaca Household, the Website and the feedback board; storage location: EU (Netherlands), access logs in the USA
- RevenueCat, Inc., San Francisco, USA: Management of purchases and subscriptions; storage location: USA
- Amplitude, Inc., San Francisco, USA: Usage analytics; storage location: EU
- Functional Software, Inc. (Sentry), San Francisco, USA: Error monitoring; storage location: EU (Germany)
- Linear Orbit, Inc., San Francisco, USA: Handling of feedback; storage location: USA
- Plus Five Five, Inc. (Resend), San Francisco, USA: Sending feedback board emails; storage location: USA
11.2 Apple (Apple Distribution International Ltd., Ireland, and Apple Inc., USA) and Google (Google Ireland Limited, Ireland, and Google LLC, USA) receive data in connection with distribution of the App, purchases, push notifications and, in Google’s case, invite links. Apple and Google are each independently responsible for distribution of the App and for purchases.
11.3 Beyond this, we disclose personal data only where we are legally obliged to do so.
12. Transfers to third countries
Where personal data is transferred to the USA, this is based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified under it, and otherwise on the Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR). You may request a copy of these safeguards.
13. Retention
We store personal data only for as long as necessary for the respective purposes. The following periods apply:
| Data | Retention period |
|---|---|
| Content of shared homes | for as long as the home exists |
| Deleted rooms and tasks in shared homes | 30 days, during which they can be restored |
| Change history | 90 days |
| Invitations | 7 days after use, withdrawal or expiry |
| Unused Yaca ID | 12 months after last use, but not during an active Yaca Household subscription |
| Signed-out devices | 30 days |
| Homes deleted for all members | 7 days |
| Backups | at most 35 days |
| Connection data for abuse prevention | at most 24 hours |
| Website access logs | 90 days |
| Usage analytics | at most 24 months |
| Error monitoring | 90 days |
| Feedback board profile and posts | until you delete the profile or request deletion |
| Reports | until the case is closed, as a rule at most 12 months |
| Other enquiries | until they have been fully dealt with |
Statutory retention obligations remain unaffected.
14. Leaving and deletion
14.1 Leaving a home. If you leave a shared home, your display name and colour are removed. Your completed tasks remain in the home under the label “Former member” unless you choose to delete them when leaving; in that case, your entries in the change history are deleted as well. You can keep a copy of the home as your own.
14.2 Deleting your Yaca ID. You can delete your Yaca ID at any time in the App under Settings › Household, or at yaca.pro/delete using the deletion code shown in the App. The Yaca ID, its devices and push identifiers are deleted without undue delay. Homes you delete for all members are removed after 7 days; until then, the other members keep a read-only copy. Instead of deleting a shared home, you can hand it over to another member. A purchase remains linked to your Apple ID or Google account and can be restored.
14.3 Data on your device. You delete content stored only on your device in the App or by removing the App.
15. Your rights
15.1 Subject to the GDPR, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may withdraw consent at any time with effect for the future (Art. 7(3)). You can also export your homes as a file in the App at any time.
15.2 Right to object. Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). An informal objection to hello@kanbon.io is sufficient.
15.3 As the Services can be used without a user account, we need information that allows us to identify your data in order to handle your request, such as your deletion code or, for the feedback board, your email address (Art. 11 and Art. 12(6) GDPR).
15.4 Right to lodge a complaint. You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR). The supervisory authority competent for us is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, Austria, dsb@dsb.gv.at, www.dsb.gv.at.
16. Data security
We take appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access (Art. 32 GDPR).
17. Obligation to provide data
You are under no statutory or contractual obligation to provide us with personal data. The App can be used without Yaca Household and without a purchase. The data listed in sections 4 and 5 is required to use Yaca Household and to make purchases.
18. Automated decision-making
No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.
19. Children
Persons under the age of 16 may use the Services only with the consent of a holder of parental responsibility. In a shared home, a holder of parental responsibility can set up a device for a child with the “Kid” role and give consent for this (Art. 8 GDPR). Such a device shows the home’s tasks and offers no purchases.
20. Changes to this privacy policy
We update this privacy policy when the Services or the legal situation change. The version published on this page applies. If we intend to process personal data for a different purpose, we will inform you in advance (Art. 13(3) GDPR).