Personal data policy

1. General

1.1. This Policy describes personal-data processing in Yorix: the yorix-app.com website (Website), the iPhone and iPad app (App), support and related services. The controller is Individual Entrepreneur Yahor Bazyk (Georgia) (we); registration and contact details are in section 14. Georgian personal-data legislation and other mandatory rules applicable to the processing apply.

1.2. It explains what data we process, why and on what basis, who we share it with, how long we keep it and how you can exercise your rights. The policy is not consent and does not need to be “accepted”. Where processing relies on consent, we ask for it separately, when it is needed, and you can withdraw it.

1.3. The Service is for adults — parents and others caring for a child. Information about the child is entered by an adult; children do not use the Service and we do not collect data directly from children.

1.4. Terms have the meanings given by applicable data-protection law. Health information is special-category data. Accepting the terms of use does not by itself consent to every form of processing or transfer.

2. Where the diary is kept and what stays on the device

2.1. Diary records — the child’s name or nickname, date of birth or due date, sex, prematurity, health, feeding and sleep details from the profile; sleep, feeds, pumping, diapers, walks, baths, height, weight and head circumference; health information (temperature, symptoms, medicines, vaccinations, doctor visits, wellbeing and mood); program records (solids and reactions to foods, teeth, vaccinations, development); notes and photos; the adult’s name and role; the AI coach conversation history — are stored on your device and synced through your private iCloud database (Apple CloudKit). The Operator has no access to that database and cannot read it.

2.2. Sharing. You invite a second adult with an iCloud link. Anyone who has the link can join, so send it only to someone you trust. The participant sees the child’s profile and the diary and program records with notes; Coach conversations stay with you only. You can remove a participant at any time.

2.3. Sleep forecasts, the day plan and diary analytics are calculated on your device. Widgets and Live Activities show the child’s name and sleep state on the device screen, including the lock screen; that data stays on the device.

2.4. Location. For the weather forecast in the “Dressed for outside” program, the App, with your permission, takes a single location fix accurate to about 1 km; you can type a city instead. The forecast is requested from Apple WeatherKit on the device. If that is unavailable, the coordinates go to our server, which rounds them to about 1 km and requests the forecast from Apple. Coordinates are not stored; the device keeps the last forecast and the place name.

2.5. Apple Health and motion. When you log a walk, the App, with your permission, reads your own (the adult’s) steps, distance and active calories from Apple Health and the motion sensor — only for the length of that walk. This is shown on the device, is not stored or synced, is not sent to us or third parties, and is not used for advertising or analytics. The App writes nothing to Apple Health.

2.6. Reminders are local notifications on the device. To sync iCloud, the App receives service push notifications from Apple; the device token is not sent to us.

2.7. Diary information reaches the Operator only in the cases in section 3: when you use the AI coach, when you send a request or feedback from the App, and as analytics events without measured values or notes.

2.8. You can export the diary in the App: Settings → Export Data (CSV, PDF or JSON).

3. What we process, why, on what basis and for how long

3.1. Bank card details are entered only on the YooKassa payment page. We never receive or store them.

3.2. We do not sell personal data. The child’s health information is not used for advertising and is not shared with ad networks.

3.3. If you do not give consent where it is needed, only the feature concerned becomes unavailable: the diary, forecasts and buying a subscription work without the AI coach, analytics and ad attribution. The purchase terms are in the public offer.

4. Who we share data with

4.1. Data is shared with processors only as needed for the stated purpose under data-processing agreements; some recipients, such as payment institutions, determine processing independently for their own legal duties. A supplier’s status does not remove duties imposed on Yorix by law.

4.2. AI providers receive messages, information about the child and the diary summary without your e-mail, payment details or account identifier. Under their terms, data sent through the API is not used to train models: DeepInfra does not store requests, and OpenAI keeps them for up to 30 days for abuse monitoring.

4.3. Information required for tax and accounting is provided to competent Georgian authorities and other authorised recipients when required by applicable law. Historical transactions may be retained to meet previously incurred legal duties; this does not change the current controller details.

4.4. If the Service passes to another person (a sale or reorganisation), the data passes with it and only for the same purposes. We will announce this in advance on this page or in the App.

5. Cross-border transfers

5.1. The controller is registered in Georgia. Recipients and processing locations are listed in section 4; some providers are in the USA and other countries. Access from Georgia and hosting abroad may constitute international data transfers.

5.2. Risks. In countries without adequate protection there may be no personal data legislation or data protection authority, a narrower range of information may count as personal data, data subjects’ rights may be limited, and authorities may access the data.

5.3. International transfers require a valid basis under applicable law. Under Georgian law this may be an adequate level of protection or a statutory exception; contractual safeguards under Article 37(2)(b) require supervisory permission. Where consent is used, it must meet legal requirements and follow information about risks. A user contract or publication of this Policy does not replace a required basis, consent or permission.

5.4. We limit transferred data and use technical and organisational safeguards. Transfers subject to the GDPR or UK GDPR require the applicable international-transfer mechanism. You can request information about the mechanism and safeguards for a specific recipient through support.

6. Information about the child and health

6.1. Yorix is intended for adults. A child’s data is supplied by their legal representative or an authorised person with a lawful basis. Where consent is required, the appropriate person must provide it in the form required by law; the child’s interests take priority.

6.2. Health-data processing requires a special-category legal basis, including explicit consent where required. We apply minimisation, encryption in transit and access restrictions to persons who need access for an authorised purpose and are bound by confidentiality.

6.3. If you learn that a child has sent us their own data, write to us and we will delete it.

7. AI coach

7.1. When you ask a question, the App sends our server the message and the child’s profile details: name, age, sex, prematurity, health, feeding and sleep details. If “AI Personalization” is on in Settings → Privacy & AI, it adds the diary summary needed for the answer: today’s records and 7-day totals, height, weight and head circumference, symptoms of the last 14 days, temperatures, vaccinations, mood, pumping and program information. Medicine names and notes are not sent to the Coach. The server passes the data to the AI model provider (section 4) and uses the question text to search Yorix articles.

7.2. Answers are generated automatically. The Coach makes no decisions with legal effects for you.

7.3. Using the Coach is optional: the diary and forecasts work without it. Sending the data in 7.1 to our server and AI providers requires separate consent where and in the form required by law; sending a question does not replace that consent. Do not use the Coach if you do not want to transmit this data. “Clear AI Chat History” (7.4) deletes conversations already kept. Turning “AI Personalization” off stops sending diary records and profile details: only the child’s age adjusted for prematurity goes with a question.

7.4. “Clear AI Chat History” (Settings → Privacy & AI) deletes conversations on the device, in iCloud and on our server.

8. Cookies, browser storage and tracking

8.1. The Website uses no advertising or analytics cookies, pixels or counters.

8.2. The Website uses only technical means: the yorix-lang cookie with the chosen language and browser storage, where Firebase Authentication keeps sign-in data and the Website keeps the links and keys of gifts you bought, a gift code awaiting redemption and ticks in article checklists. The Website cannot work without them, so no consent is needed. You can delete them in your browser settings.

8.3. Tracking in the App. The App shows Apple’s system tracking prompt (App Tracking Transparency). Only if you allow it does the App send Meta install, launch, sign-up, trial and purchase events, pass the device advertising identifier to Meta and Google for advertising attribution, and send Google advertising signals (Google Ads). If you decline, the App works the same: Meta receives nothing, Google receives only usage analytics (Firebase Analytics) without the advertising identifier or advertising signals, and Apple SKAdNetwork reports only anonymous aggregate data to ad networks.

8.4. You can change your choice at any time in iOS Settings → Privacy & Security → Tracking.

9. Deleting data

9.1. In the App you can delete individual records; remove a child together with all their records and sharing; clear the AI chat history (clause 7.4); and delete the account (Settings → Account) — this deletes the sign-in account and all data on the device and in your private iCloud database, and ends sharing.

9.2. Data on our server and with the recipients in section 4 — requests, orders, subscription and credit accounting, analytics — is not tied to your iCloud database. To have it deleted too, write to us through the “Write to us” form, stating your account’s e-mail. We delete data within applicable mandatory deadlines (generally no later than 10 working days after the request or withdrawal of consent), except information we must keep by law (for example, payment records). Backups are cleared within 30 days.

9.3. You delete the data in your private iCloud database yourself — in the App or in iCloud settings (iOS Settings → your name → iCloud → Manage Storage → Yorix).

10. Your rights

10.1. Submit a request through the support form or the contact in section 14, describing the request and information needed to locate your data. Passport details and passport copies are not required by default. If there is reasonable doubt, we may seek proportionate identity verification. Any refusal or permitted extension is explained as required by law; your right to complain remains.

11. Security

11.1. We use measures proportionate to processing risks, including encryption in transit, request verification, access limits and retention limits. No system or internet transmission can guarantee absolute security. This does not exclude our legal data-protection and incident-response duties.

11.2. Incidents are assessed and recorded. Where Georgian law requires, the State Audit Office is notified within 72 hours after identification; affected individuals are notified in the circumstances and times required by law. Other applicable jurisdictions’ mandatory rules are also observed.

12. Users in other countries

EU, EEA and UK. The controller is the person named in section 14. Legal bases under the GDPR and UK GDPR: performance of a contract (Article 6(1)(b)) — sign-in, purchases, support, diagnostics, weather; legal obligation (Article 6(1)(c)) — income accounting; legitimate interests (Article 6(1)(f)) — security and defending legal claims; consent (Article 6(1)(a)) and explicit consent for health data (Article 9(2)(a)) — the AI coach, information about the child in requests, analytics, attribution. You have the right to access, rectify and erase your data, restrict processing, data portability (including through the diary export), object to processing based on legitimate interests, withdraw consent and complain to the supervisory authority where you live. We reply within one month, and notify the supervisory authority of a security breach within 72 hours where the GDPR requires it.

Russian Federation. The controller is registered in Georgia. Data of buyers and users from Russia is processed to perform the contract (Article 6(1)(5) of Federal Law No. 152-FZ of 27.07.2006 “On personal data”); the child’s health information and AI coach data only with your consent. The data is transferred to the controller in Georgia and to the recipients in section 4, including in the USA, which may not ensure adequate protection of data subjects’ rights; the risks of such transfers are set out in clause 5.2. We answer requests about your data within 10 working days.

United States. The child’s health information you enter is consumer health data under the laws of Washington, Nevada and Connecticut. We collect it from you for the features in section 3, share it only with the recipients in section 4, never sell it and never use it for advertising. You may learn what data we have and who received it, delete it and withdraw consent; if we decline a request, write to us with the subject “Appeal” and we will reply within 45 days. The Website does not track visitors across third-party sites, so Do Not Track signals do not change how it works.

13. Changes

13.1. A new edition is published on this page with its date. We announce material changes in advance on this page or in the App. For new purposes we ask for new consent.

14. Operator

Individual Entrepreneur Yahor Bazyk (Georgia)
Individual Entrepreneur registered in Georgia
Registration / tax number 304699431
Georgia, Tbilisi, Krtsanisi district, Fonichala settlement 3, building 5, auxiliary warehouse
Contact us through the support form; response time depends on the issue

For personal data questions use the “Write to us” form on the support page.