Privacy policy

1. Who we are

Yearbar is made and run by John Limos, an individual developer based in the Philippines. In this policy, “Yearbar”, “we” and “us” mean John Limos. We decide how your personal data is used, which makes us the “personal information controller” under the Philippine Data Privacy Act of 2012 and the “controller” under the EU and UK GDPR.

Our data protection contact is John Limos, at [email protected].

This policy covers the Yearbar app on the web (app.yearbar.app), the iPhone and Android apps when they launch, and this website (yearbar.app).

2. What we collect

If you use Yearbar without an account

Your goals, check-ins, notes, photos and settings are saved only on your device (in the app’s storage or your browser’s storage). They aren’t sent to us. If you clear your browser data or uninstall the app, they’re gone, so create an account if you want a backup.

If you create an account

• Account details: your email address and password. Passwords are stored by our sign-in provider in a scrambled (hashed) form. We can’t see them.
• Optional profile details: anything you choose to add in Profile, such as a name.
• What you put on your board: goals, targets, checklists, check-ins and setbacks, notes, key dates, milestones and the rewards you set, streaks, XP and your app settings (like theme and currency).
• Photos: on the free plan, photos stay on your device. With Pro or the free trial, photos you add are backed up to our cloud storage so they sync.

If you buy Pro

• On the web: Pro is sold by our reseller, Polar Software, Inc. (“Polar”), as the merchant of record. You enter your payment details on Polar’s checkout, which uses Stripe to process cards, and we never see or store your card number. Polar handles the payment, tax and receipt information it needs under its own privacy policy. We receive your email address, country, plan, its status and renewal or end date, and a Polar customer reference.
• On iPhone or Android: payments are handled by Apple or Google, and RevenueCat tells us whether your subscription is active. We receive your plan, its status and dates, and an anonymous purchase ID, not your payment details.

If you contact us or send feedback

• Your message, and your email if you include it or are signed in.
• If you tick “Include app details”: the app version, your device type and how many goals you have. Never your goal names, notes or photos.

If you join the waitlist

Your email address, so we can tell you when Yearbar launches.

How the app is used, and errors

To learn which features help and to fix bugs, the app sends us usage events and error reports through PostHog. A usage event records an action, like “check-in logged”, “goal created (money goal)” or “milestone reached”. An error report records what went wrong: the error message, where in our code it happened, and which screen you were on.

Both include basic device details (app version, device type, operating system or browser, screen size, language) and your approximate country. They’re linked to a random ID stored on your device, and to your Yearbar account ID if you’re signed in. They never include your goal names, amounts, notes, photos, key dates, rewards or email address, and we don’t record your screen.

You can turn this off any time in Profile → Account → “Share usage and error data”. In the EU and EEA, the UK and Switzerland, it stays off unless you choose to turn it on.

Technical data

Like any website, our hosting and database providers keep short-lived technical logs (such as IP address, browser type and the time of a request) to keep the service secure and working. On yearbar.app, Cloudflare Web Analytics counts page visits without cookies and without identifying you. The app uses your device’s storage to save your board, remember you’re signed in and remember your choices. We don’t use advertising cookies or cross-site tracking.

3. Why we use it

We use your data only to run Yearbar, and for these reasons:

We don’t sell or rent your personal data, use it for advertising, or use your notes and photos to train AI models.

4. Services that help run Yearbar

We use a small number of trusted providers. They process data only to provide their service to us, under their own privacy and data protection terms.

We may also share data if the law requires it (for example, a valid court order), or to protect the rights and safety of our users. If Yearbar is ever sold or transferred, your data would move with it under this policy, and we’d tell you first.

5. Where your data is stored

Your account details, synced board, cloud photos, feedback and waitlist sign-ups are stored with Supabase in Singapore (AWS region ap-southeast-1). Our providers may process data in other countries, including the United States. When data leaves the EU, UK or the Philippines, we rely on our providers’ legal safeguards, such as the European Commission’s Standard Contractual Clauses.

6. How long we keep it

• Your board and photos: for as long as you have an account. If you delete your account, we delete your photos, your board and your account right away. Copies in our provider’s backups disappear within about 30 days as backups roll over.
• Billing records: as long as tax and accounting law requires, even after you delete your account.
• Feedback and support emails: up to 2 years, then deleted.
• Waitlist emails: until launch plus 6 months, or until you unsubscribe, whichever comes first.
• Usage events and error reports: up to 1 year. If you delete your account, we also ask PostHog to delete the data linked to your account ID.
• Technical logs: kept by our providers for a short time, usually days or weeks.

7. Your rights and choices

Wherever you live, you can:

• See and correct your data. Almost everything is visible and editable in the app.
• Delete it. Profile → Account → Account settings → Delete my account removes your account and everything in it. “Clear your data” empties your board but keeps the account.
• Get a copy. Email us and we’ll send your data in a common file format.
• Object or withdraw consent, for example to stop launch emails, or to turn off usage and error data in Profile → Account.
• Complain. Please tell us first so we can fix it. You can also contact the National Privacy Commission of the Philippines, or your local data protection authority if you live in the EU or UK.

To use any of these rights, email [email protected] from the address on your account. We’ll reply within 30 days. These rights are free.

If you live in California or another US state with a privacy law: we don’t sell or share your personal information for advertising, and you have the same rights to know, correct and delete described above.

8. Age requirements

You must be at least 13 years old to use Yearbar. In countries where the law sets a higher age for using online services on your own, you must be at least that age. For example, it’s 16 in Germany, Ireland, the Netherlands and Poland, 15 in France, and 14 in Italy and Austria.

Yearbar isn’t made for children under 13, and we don’t knowingly collect their data. If you believe a child has created an account, email us and we’ll delete it.

9. Security

Data is encrypted in transit (HTTPS). Every account can reach only its own data, enforced by the database itself. Cloud photos are kept in private storage, and the links to view them expire after an hour. No system is perfectly secure, so please use a strong password that you don’t use elsewhere. If we ever have a data breach that puts you at risk, we’ll tell you and the authorities as the law requires.

10. Changes and contact

If we change this policy, we’ll update the date at the top. For important changes, we’ll also tell you in the app or by email before they take effect.

Questions or requests: [email protected]
John Limos, Philippines