Privacy Policy
This policy explains how Yormio handles information when you use the mobile app, its AI features, cloud services, subscriptions, checklist sharing, support forms and this website.
1. Who is responsible for your data
For Yormio-controlled processing, the data controller is Bedir Gocmez (referred to as “Yormio”, “we”, “us” or “our” in this policy). You can contact us at bgswedenappdev@gmail.com.
2. Yormio is local-first
Manual reminders and checklists are designed to work locally. Before cloud/account features are used, product content is stored in the app’s local database on your device. Local data can include reminder and checklist titles, descriptions, checklist items, dates and times, time zones, recurrence information for reminders, completion status, notification preferences and related technical identifiers.
If you link or create an account and cloud sync is active, confirmed Yormio content may also be synchronized to Yormio’s Supabase backend so it can be recovered or synchronized across supported devices.
3. Information we process
| Category | Examples | Why it is used |
|---|---|---|
| Account information | Yormio user ID, email where provided by the sign-in method, display name, linked sign-in provider, profile preferences and time zone. | Authentication, account linking, recovery, cloud sync, entitlement identity and support. |
| Reminder and checklist content | Titles, descriptions, checklist labels, quantities/units, schedules, time zones, reminder recurrence, status and one-off checklist alert metadata. | Provide the core reminder/list service and, for linked accounts, synchronize confirmed content. |
| AI capture input | Short microphone recordings, text you enter or paste, device time zone, locale and current time context. | Transcribe and structure your input into reviewable reminder/list candidates. |
| AI usage and service metadata | Pseudonymous user ID, request ID, allowance class, usage count, model ID, prompt/schema version, request outcome and limited non-content diagnostics. | Quota enforcement, idempotency, reliability, abuse prevention and debugging. |
| Subscription information | Yormio user ID used as the RevenueCat App User ID, entitlement status, product ID, store, expiration state and related subscription event metadata. | Purchase, restore, entitlement verification, refunds/grace-state handling and subscription support. |
| Checklist sharing | An immutable snapshot of the shared checklist, optional one-off schedule metadata, sender display name, token hash and expiry. | Create a secure share link and let a recipient preview/import an independent copy. |
| Device/technical data | Local sync device identifier, mutation/revision IDs, notification planning state, app/platform information and security/rate-limit signals. | Offline synchronization, conflict handling, notification reliability, security and abuse prevention. |
| Support and deletion requests | Email address, optional account/user ID, platform, message and request details you submit on this site. | Respond to support requests and verify/process privacy or deletion requests. |
4. Voice, text and AI processing
Google Gemini is the third-party AI service used by Yormio to convert user-submitted content into structured reminders and lists. Only when you intentionally use an AI feature and valid AI data-sharing consent exists, Yormio sends the necessary input through Yormio’s backend (a Supabase Edge Function) to Google Gemini, which returns a structured reminder/list result. For voice capture, you first record audio locally on your device; the submitted recording is then sent as request-scoped data for processing. For text input, the text you intentionally enter or paste and submit follows the same backend route.
Before Yormio sends a voice recording or submitted text to Google Gemini for AI processing, Yormio asks for explicit permission when valid consent does not already exist, including before the first transfer. The consent screen identifies the type of data being sent (your audio recording or entered/pasted text), Google Gemini as the recipient, and the purpose: converting that content into reminders and lists. You can choose “Don’t Send” or “Allow & Send”.
If you choose “Don’t Send”, the content is not sent to Google Gemini and no AI processing request containing that content is made. For voice input, the recording is not transmitted to Yormio’s AI backend and the temporary recording is deleted through the app’s normal cleanup flow. For text input, the text remains available for you to edit in the app.
If you choose “Allow & Send”, your explicit consent is stored locally on your device before transmission. Yormio does not ask again for each AI request while valid consent exists. A previous generic disclosure acknowledgement does not count as this explicit AI data-sharing consent. You can withdraw consent as described in section 12.
Microphone permission and AI data-sharing permission are separate. Yormio requests the operating system’s microphone permission only when you intentionally try to use voice capture, without a custom pre-permission prompt. Microphone access allows Yormio to record voice input on your device; it does not by itself authorize sending that recording to Google Gemini. Transmission requires the separate explicit AI data-sharing consent described above.
Yormio does not intentionally persist raw audio in Supabase Storage or application logs. The app removes the temporary local recording after processing, cancellation or discard. Yormio’s current application design does not save a raw transcript by default. The structured result you confirm, such as a reminder or checklist, is stored as product data.
Google processes the content sent to Google Gemini as a service provider under the applicable service terms and privacy/data-processing arrangements. Provider-side handling is also subject to those arrangements and may differ from Yormio’s own application-level retention.
5. Accounts and sign-in providers
Yormio can create a Supabase anonymous identity when a guest first uses AI. You may later link or create a permanent account using supported authentication methods such as Apple, Google or email, where available. Apple or Google may provide Yormio with account identifiers and profile information permitted by your authorization, such as an email address, name or profile image.
Authentication session credentials are stored using secure device storage where supported. Yormio does not ask you to send account passwords through support or deletion forms.
6. Cloud sync and notifications
For linked accounts, Supabase can store synchronized reminder/checklist records, checklist items, recurrence data for reminders, one-off checklist alert metadata, revisions, tombstones and synchronization identifiers. Notifications are scheduled locally on your device. Yormio does not promise that an operating system will deliver every notification at an exact time.
Home-screen widget snapshots are stored on-device for rendering supported widgets. They are not a separate cloud analytics feed.
7. Checklist sharing
If you choose to share a checklist, Yormio stores an immutable snapshot in Supabase. The stored snapshot can contain the checklist title, item labels, quantities/units, optional one-off schedule/time-zone/notification metadata, and a sender display name when available. The raw share token is not stored by Yormio’s database; a cryptographic hash is stored for lookup. Current share links expire after 7 days. Expired shares are removed as part of the share lifecycle.
A recipient who imports a shared checklist receives a new independent copy. Later edits to the sender’s checklist do not synchronize into the recipient’s imported copy.
8. Subscriptions and payments
Yormio uses RevenueCat to manage subscription entitlement state and Apple App Store and/or Google Play for store billing. Yormio does not receive your full payment-card details from the app stores. RevenueCat receives the Yormio permanent user identifier used for entitlement identity and subscription-related information such as product, store, status and expiration state.
Apple, Google and RevenueCat process information under their own applicable terms and privacy practices.
9. Service providers
Depending on the feature you use, Yormio currently relies on the following categories of providers:
- Supabase for authentication, database services, server functions and cloud synchronization.
- Google Gemini for AI processing of user-submitted audio recordings and user-submitted text, as applicable, to generate structured reminders and lists. This sharing occurs only when you intentionally invoke an AI feature and valid AI data-sharing consent exists.
- RevenueCat for subscription entitlement and purchase-state management.
- Apple and Google for supported sign-in and app-store subscription/payment services.
- Netlify for hosting this website and receiving support/account-deletion form submissions.
Yormio requires third-party service providers that process personal data on Yormio’s behalf to protect that data to the same or an equivalent level described in this Privacy Policy and required by applicable privacy obligations.
We do not sell personal data. The Yormio app and this legal website are not designed to use advertising trackers. No third-party analytics SDK is included in the audited mobile dependency set at the date of this policy.
10. Retention
- Local product data: remains on your device until you delete it, delete the local account data, uninstall the app, or the operating system removes app storage.
- Temporary voice recording: kept only as needed for the capture flow and removed from the app’s temporary storage after processing/cancellation/discard. The current server implementation does not persist raw audio to Supabase Storage.
- Raw transcript: not saved by Yormio by default; confirmed structured data is retained instead.
- Linked-account cloud data: retained while needed to provide the account and sync service, until deletion or another applicable retention rule.
- Checklist share snapshot: currently expires after 7 days.
- Quota, mutation and security records: may be retained for the period reasonably needed for service integrity, fraud/abuse prevention, idempotency, debugging and reconciliation.
- Support/deletion forms: retained only as reasonably needed to respond, verify the request, keep necessary request records and meet legal obligations.
Some information may remain for a limited period in backups or with independent service providers where deletion is not immediate or where retention is required for security, accounting, fraud prevention, dispute handling or law.
11. Legal bases and international processing
Where the GDPR or similar law applies, processing may rely on performance of the service you request, compliance with legal obligations, legitimate interests such as service security and abuse prevention, and consent where consent is legally required. Service providers may process data in countries outside your country of residence. Where legally required, appropriate transfer mechanisms are used or required from service providers.
12. Your choices and rights
You can withdraw your permission for Google Gemini AI data sharing at any time in Yormio under Settings → Privacy & Security → AI data sharing. After permission is withdrawn, Yormio will not send new voice recordings or submitted text to Google Gemini unless you explicitly allow sharing again. Withdrawing this consent does not itself revoke your device’s microphone permission, delete your account or reminders/lists, or change your Premium subscription.
Depending on applicable law, you may have rights to access, correct, delete, restrict or object to processing of personal data, and to receive portable data. You may also withdraw consent where processing is based on consent. To exercise a privacy right, contact bgswedenappdev@gmail.com or use the account deletion page.
You may also have the right to complain to the competent data-protection authority in your country.
13. Account deletion
Yormio provides an in-app account deletion flow and an external deletion-request page. Account deletion is intended to remove the Yormio account and Yormio-controlled account data that is not required to be retained. Store subscription records and billing are controlled separately by Apple or Google.
14. Security
Yormio uses access controls, row-level security, server-side ownership checks, secure device storage for authentication sessions where supported, encrypted HTTPS transport, bounded request sizes and other safeguards appropriate to the service. No internet service can guarantee absolute security.
15. Children
Yormio is a general productivity utility and is not designed as a service directed specifically to children. If local law requires parental or guardian authorization for a user to provide personal data, that authorization should be obtained before account or AI features are used.
16. Changes to this policy
We may update this policy when Yormio changes, when providers change, or when legal requirements change. The current version will be published at this URL with an updated effective date. Material changes will be communicated where required.
17. Contact
Bedir Gocmez
Email: bgswedenappdev@gmail.com
Support: https://yormio-privacy-terms-page.netlify.app/support/