Privacy notice
This notice explains how Yamine Ltd handles personal data in the Yamine app and service, including the choices you make about location, sharing, imports and feedback.
Who is responsible
Yamine Ltd is the controller of your personal data. It is registered in England and Wales, company number 17383120, with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. Contact privacy@yamine.app about privacy or your data rights.
Your account and records
We use your verified email address to sign you in and send verification or recovery codes. If you choose Google or Apple sign-in, we receive authentication information and keep the link to your Yamine account. This sign-in choice does not give Yamine access to your mailbox. Passwords are stored as cryptographic hashes, not as the password you type.
We keep the profile, places, lists, plans, trips, journal entries, photos, videos, documents and expense information you choose to add, with their dates, locations and organisation. These records and account preferences let you return to them across devices. Content shared by another person is available only within the access they give you.
Location and maps
You choose whether to grant device location access and the precision your device allows. Location features use the position your device provides to find nearby places, calculate distances and place you on the map. Map and place services receive the position or search needed for the feature. Location search and reading links can include that position so the same place can be reopened. Choosing a place by name works without granting device location.
Precise coordinates can be retained when you attach a location to a personal photo or record, or deliberately use a live companion-sharing session. Companion location is available to the recipients and for the duration you choose; you can stop it. Maps loaded from a provider also disclose your IP address and the viewed map area to that provider.
Your optional preferences
Appearance and language choices are stored with your account. A passport country you choose is stored with your account so that country guides open on its entry information; you can change or clear it in Settings or on any guide. Turning on halal-aware guidance stores that preference with your explicit consent. The choice can indicate religious practice, so we use it only for the guidance you request. Turning it off removes the saved preference. Food needs you save (such as vegetarian, halal, kosher or an allergy) are stored with your account with your explicit consent, because they can indicate religious practice or a health condition; they are used only to find and show relevant food information, are never shown to people on your trips, and clearing one removes it. None of these choices is used to infer your identity or for advertising.
Files and travel mail
When you import a travel email file, paste booking text or choose a document, we read the supplied content to prepare items for your review. Email text and readable booking text are parsed within Yamine. A selected scanned booking page or receipt can be sent through OpenRouter to a model provider, including Google, to read its visible information. The app keeps your review choices and any original you choose to retain.
Where a connected mailbox or forwarding option is offered and you choose it, Yamine uses only the permission and messages explained at that connection. Mailbox credentials and imported message copies are held in an encrypted store for that account. Disconnecting removes the connection and its message store; originals already saved in your personal records remain until you remove them. The availability of a connection is shown in the app; sign-in with Google or Apple is separate.
When you use your private forwarding address, Cloudflare receives the complete email and its delivery addresses and passes it to Yamine. An encrypted temporary copy is made for delivery, including for the first attempt. If the app is temporarily unavailable, we retry delivery for up to nine hours from receipt. Delivery attempts then stop and the temporary email is erased at the next cleanup. Provider cleanup can take longer when that cleanup is unavailable. You choose what to keep from the email in your private review; forwarding does not add a booking to a trip automatically.
If delivery cannot be confirmed in that window, we erase the temporary email and try to place a warning in your private inbox so you can check your sent mail and forward the missing email again. The warning does not contain the missing email or restore it. A small encrypted delivery record contains the opaque forwarding address, delivery identifier, email fingerprint and timing, rather than its words or attachments. That record and an undelivered warning are retained for up to seven days after the delivery window is closed, subject to the cleanup delays described below. A warning already delivered to your inbox remains until you mark it as checked, replace the address, disconnect or your mailbox is removed through account deletion. An email already received, or deliberately removed from this inbox, does not generate this warning just because its delivery acknowledgement was lost. After you mark a warning as checked, an encrypted fingerprint and expiry remain in your account so a retry cannot show it again. They stop being used when the seven-day retry window ends and are removed when you next open the inbox list or its warning state is updated, or when you replace the address or disconnect. They contain no email words or attachments.
AI-assisted features
Public guide and Orient context, place searches and the questions or source media you submit can be sent to model and search providers to supply the feature you ask for. OpenRouter routes model requests to providers such as Google and Anthropic. Private records are not added to public guide or Orient context.
Ask sends your question, any selected public passage and recent turns in the active conversation; a question about using Yamine sends your question and Yamine’s own help notes, nothing from your page or account. Yamine does not save the Ask conversation to your account or reuse it in public readings. For Ask, uploaded images and clips, and scanned booking or receipt reading, Yamine requests zero-data-retention routing and refuses model endpoints that permit data collection. A request fails if an eligible endpoint cannot serve it. These routing settings do not establish that the router account’s optional logging of requests and replies is off, or that security, billing and optional search-tool records have no retention. Media acquired from public source links follows the provider policies described in About AI. See About AI for what is sent and how to check an answer.
Feedback, support and crash reports
Feedback sends your words and only the diagnostic details you leave selected. Screenshots are optional and are the images you choose; Yamine does not record your screen. We resize those images and remove their hidden metadata. The development team and the AI tools it uses to build Yamine may review your report. The estate record receives an opaque report reference, your words, selected details and screenshots, rather than your account identity or email. Your words or images can still identify you if you include personal information.
The team’s private copy is held on the Nimbus server operated for Yamine. Reports are retained for up to two years, or removed earlier when you remove the report or your account is permanently deleted. Removing a report takes it out of the app immediately and is reflected in the team’s record at its next refresh. A limited activity record may retain the opaque reference and processing state, without the removed words or images. Contact us separately if you need help with a data-rights request.
From the first app versions built with crash reporting, the installed Android and iOS apps report crashes to Google's Firebase Crashlytics; versions published before that send no crash reports. When such an app stops unexpectedly, the next start sends the technical trace of the crash, including the crash message the app's runtime wrote, the app version, the device model, operating system and state at that moment, and Firebase's installation identifiers for the app on that device. To count how many installations a crash affects and to measure crash-free use, the crash reporting software also records, by default, when the app is started and brought to the foreground, together with the app version and device and operating-system details, under the same installation identifiers. Yamine adds no account identity, email address, content, custom key, log or activity record to any of this, and uses no Google Analytics, advertising or performance component. Firebase keeps crash data and these identifiers for 90 days before removing them. Deleting the app removes its installation identifiers from the device; a fresh install creates new ones.
Service providers and international processing
Railway hosts the app, account databases and encrypted travel-mail store in its United States region. Cloudflare R2 holds media originals with Eastern Europe placement; that placement is not an EU-only jurisdiction restriction. The same private R2 bucket also holds frequent encrypted recovery copies of the account databases, the identity store and the encrypted travel-mail store, sealed with a key held only by the app service. Scaleway delivers account emails from its France region. Google and Apple handle their respective sign-in options, and Google's Firebase Crashlytics receives the crash reports of installed app versions built with crash reporting, which Google may process at its facilities worldwide. Mapping and place providers include Google Maps outside mainland China and AMap where the China path uses it; map, open-data and public-source services supply the visible places and context. OpenRouter and its model or search providers process the requests described above.
These providers may process data outside the United Kingdom, including in the European Union, the United States and China. Applicable provider data-processing terms and transfer safeguards depend on the service and destination. You can contact privacy@yamine.app for details of the providers and safeguards applicable to your data. We do not sell personal data or use third-party advertising or tracking analytics in the app.
Cloudflare also receives forwarded travel emails, including their contents, attachments and delivery addresses, and runs their delivery to the app. The temporary relay copies are encrypted in a separate private R2 bucket restricted to the European Union. Cloudflare's email and Worker processing can occur in other locations; this storage restriction does not make all mail processing EU-only. The app's delivered email copies remain in the encrypted account store on Railway in the United States. These encryption keys are held by the services running the delivery and app; this is not a claim that those services cannot process the email contents.
Why we may process your data
We rely on performance of our contract with you for account access, your records and the features you request (UK GDPR Article 6(1)(b)); legitimate interests in running, securing and improving the service for operational records and support (Article 6(1)(f)); and consent for optional uses where the app asks for it (Article 6(1)(a)). Where a preference may reveal religious practice, explicit consent is the condition under Article 9(2)(a). We may also retain or disclose information where a legal obligation requires it (Article 6(1)(c)).
Our AI features provide suggestions and readings. They do not make decisions with legal or similarly significant effects about you. Account and requested feature data are necessary for those features to work; optional location, sharing, imports and feedback can be declined. Withdrawing consent does not undo lawful processing before withdrawal.
Storage, retention and account deletion
Account records and retained originals stay while your account exists, subject to the item’s removal controls. Removing an item takes it out of the relevant view; limited history can remain where needed for shared relationships, corrections or deletion work. Necessary session and journey cookies keep sign-in and returns working; the main session lasts up to 30 days. A small cookie records which page styles your browser has loaded to help pages load faster. It contains style identifiers, not your account details or saved content, and lasts a week. A deletion-status receipt lasts up to 60 days so you can check the result after the grace period. Codes and recovery tickets expire within minutes. Device storage also remembers presentation state and unfinished work; account-scoped feedback drafts are cleared on sign-out. We use no advertising cookies.
Confirming account deletion signs you out on every device and stops existing sharing and location sessions. We retain the account and its data for 30 days; normal sign-in before the displayed deadline cancels deletion. Previous sessions and sharing stay stopped. After the deadline, permanent removal begins for the account, its personal rows, provider links, mail connection and stored originals. If an external store is unavailable, cleanup is retried and the deletion-status page stays pending until that work completes. Routine volume backups are scheduled daily with six-day retention and weekly with 27-day retention. Restricted older manual recovery snapshots also remain. Separately, encrypted recovery copies protect the account databases and private mail stores. When a new copy is published, older copies are removed using a seven-day age limit and a limit on the number kept; the newest copy is retained until replaced. Failed cleanup is retried. Recent content may not yet be in a recovery copy. Confirmed deletions and access changes are recorded separately so recovery can preserve them. Backups and recovery copies can contain earlier copies after deletion; restored data must have deletion and access revocation reapplied, or a newer recovery copy installed, before being served. Limited security, deletion and integrity records can retain a pseudonymous account reference after the email address and profile are erased; they are not your restored account or a usable copy of your private library. Copies lawfully kept by recipients and records needed to meet legal obligations may remain. We do not promise that every operational or provider record disappears instantly.
Replacing your forwarding address or stopping forwarding revokes the old address in the app. A temporary email still waiting for that address is erased when the relay next reaches the app and sees that revocation, or when its delivery window closes. It cannot recreate the connection or enter your new address. Revocation cannot erase an offline provider copy instantly. Our active cleanup erases expired copies; separate provider lifecycle rules are a fallback if that cleanup fails. Cloudflare normally processes an expired R2 lifecycle deletion within a further day, but does not promise an exact instant. Small encrypted delivery records and warnings have their own expiry described above. Restricted operational logs record delivery status without the email's contents or forwarding address.
During the existing 30-day account-deletion grace period, the mail connection is retained along with the account. A forwarded email may still reach its encrypted mailbox while normal account access is blocked. Signing in before the deletion deadline can cancel deletion and restore that account's access. Permanent removal disconnects the mailbox and revokes its forwarding address; remaining relay copies are then handled by the revocation and expiry process above. This does not give another account access to the mailbox.
Your rights and how to contact us
You can change your profile, download your account data and request account deletion in Settings > Account. Remove individual records and manage sharing from their record and sharing controls. The archive includes personal records and original files held by the app; it lists any originals that could not be retrieved. You can also request access, correction, erasure, restriction, portability, or object to processing by emailing privacy@yamine.app. We may need to verify your identity and protect other people’s rights before answering.
You may complain to the Information Commissioner’s Office at ico.org.uk, or your local supervisory authority. Yamine is not directed at children. If you believe we hold a child’s data without appropriate permission, contact us. We update this notice when our handling of data changes and display the current version and date here.