Privacy policy

Controller under the GDPR (Art. 4(7)):

Provider

Colopoint GmbH

Address

Lindleystraße 12
60314 Frankfurt am Main
Germany

Email

hello@lynk.run

Further details are in the legal notice. For anything concerning data protection, an email to the address above is enough.

• The app works without an account and without signing in.
• We do not sell data, run no ad networks and embed no third-party trackers.
• We store your ratings on our server, under a random device key with no name and no email address attached.
• If you add a comment, that sentence is publicly visible on the product. The price you paid is not.
• A receipt photo never leaves your device.
• Everything held under your device key is deleted from inside the app — Settings → Delete my data.

Name, brand, quantity and product image come from Open Food Facts, an open food database. We run our own mirror of it on our server. Only when a scanned barcode is missing there do we query Open Food Facts directly — sending nothing but the barcode digits, no information about you or your device. Product data is not personal data.

4.1 Barcode scan and product lookup

When you scan, the barcode number is sent to our gateway (api.yammo.eu) and the product record is returned. The camera runs on the device; no image is transmitted. Legal basis: Art. 6(1)(b) GDPR (performing the function you asked for) and (f) (operating the app).

4.2 Your ratings

A rating consists of the answer “would buy again” (Yammo / Maybe / Nope), optionally a taste and a value-for-money answer, optional disappointment tags, the price paid, the store, an optional comment, and which route you gave it through (barcode, receipt or list). These are transmitted to our gateway and stored there — that is what the app is for: individual answers become the repurchase rate other people read at the shelf.

They are stored under a random device key the app generates on first launch. There is no account, no name and no email address attached to it. We genuinely need that key: without it you could no longer change or withdraw your own answer.

What is public and what is not. Publicly visible on a product is your comment together with your answer — that sentence is readable by anyone, and the app says so above the field before you type. Not public are the price you paid, the store and your device key: they feed only into averages from which no single answer can be recovered.

Prices are stored per reported purchase, with the date — otherwise a second purchase of the same product would overwrite the first and the average would be a number about no particular time. Only reports from the last 90 days feed the average shown; older ones remain in your data export (section 7) and no longer count.

Before a comment is stored we screen it automatically for abusive language and for addresses, links and phone numbers, and refuse it where necessary; only the text itself is screened, and refused text is not stored. If a published comment is reported, see section 4.7.

Legal basis: Art. 6(1)(b) GDPR (performing the function you asked for). You withdraw a single rating on the product itself; you delete all of it under Settings → “Delete my data” (section 7).

4.3 Receipt photo

For receipt capture the app opens your device camera. The photo is processed on the device and not transmitted to us; we store no receipts and no photos on our servers. Text recognition, too, happens entirely locally. The photo itself never leaves your device.

What does leave, and when. Two things, neither of them an image:

• To match the abbreviated article lines to products, we send the printed article text to our gateway and get product suggestions back. This happens right after the read, so the list can show product names at all.
• When you tap “Bewerten”, we send — for the lines you selected — the barcode, the price paid, the store and the receipt date. This is what a product’s average price is made of. Lines you switched off, and lines we could not match to a product, are not sent: their printed text stays on the device.

These price reports are stored under the same random device key as your ratings (section 4.2) and are deleted with them under Settings → “Meine Daten löschen”. What is visible on a product is always the average over several reports — never a single price and never who reported it. Legal basis: Art. 6(1)(b) GDPR.

Of the article texts in the first point we also keep a counter: per normalised text, how often it appeared and how often we could match it to a product. Nothing else — no receipt, no order, no price, no device id, so there is nothing from which a shopping basket could be reconstructed. Two people buying the same product increment the same counter. The sole purpose is finding gaps in the product catalogue: a text we can never match is a product we are missing. Because those counters belong to nobody, they are not covered by “Delete my data” either — for the same reason as the anonymous usage statistics in section 4.6. Legal basis: Art. 6(1)(f) GDPR (improving the catalogue).

4.4 Account and sign-in (optional)

If you sign in we store: an account id, your email address, a name (if the sign-in provider supplies one), the technical identifier of your Apple or Google account, your role (user/admin) and the creation timestamp. For email-code sign-in we additionally store the email address and the code as a hash; it expires after 15 minutes. Apple and Google sign-in tokens are verified cryptographically against those providers’ public keys. Legal basis: Art. 6(1)(b) GDPR.

4.5 Push notifications

If you allow notifications, the app registers a device identifier (push token) and platform (iOS/Android) with us; where an account exists, it is linked to it. Delivery runs through Google’s Firebase Cloud Messaging. Legal basis: your consent given through the system prompt, Art. 6(1)(a) GDPR — revocable by turning notifications off in your device settings.

4.6 Anonymous usage statistics

The app reports individual events — that the scanner was opened, what a barcode scan turned up, how many lines a receipt page held. Those events carry the app version and the platform only (e.g. “0.1.0, iOS”) and no identifier of any kind: no device id, no advertising id, nothing that could link them to you or to one another. “0.1.0, iOS” describes thousands of devices equally.

Earlier versions of the app stored a randomly generated device identifier for this purpose, so that installs and active devices could be counted. We no longer do this: Apple and Google report those figures to us anyway, without anything having to be stored on your device. The first launch of a new app version deletes any identifier left over from an earlier one.

Because these events carry no identifier they are not personal data — there is no attribute by which they could be attributed to you. For the same reason they are not covered by “Delete my data”: only what can be attributed can be deleted. Anonymity and erasability are two sides of one coin.

This is distinct from the device identifier your ratings and favourites are stored under (see section 4.2). That one we genuinely need — without it you could not change your own answer — and it is exactly what “Delete my data” removes.

4.7 Reports and blocks

If you report a comment we store the device key it was written under, the category you chose, the reported text itself and the case status. We copy the text deliberately: otherwise the case becomes impossible to judge the moment its author edits or deletes it. Blocks are stored as a pair of blocking and blocked device key. Where a report is upheld we remove the comment; the rating itself — the answer that feeds the rate — stays. Legal basis: Art. 6(1)(f) GDPR and our obligations under the app stores’ guidelines; a report is also our record of the case.

When we review a report we record who handled it and when. If it leads to a comment being removed, the rating itself stays — only the text goes; a moderation decision must not move a product’s score. In serious cases we bar a device id from commenting: rating still works, a comment is no longer published, and the app tells you so rather than quietly discarding the sentence. That bar survives “Delete my data” — otherwise erasing your own data would be the unban button.

4.8 Server logs

Our gateway logs requests technically (IP address, timestamp, path, status code). This is necessary for operating the service and for diagnosing faults. Legal basis: Art. 6(1)(f) GDPR.

4.9 Crash and error reports

App, server and this website can report crashes to Sentry where the service is enabled for the respective build. Transmitted are the error message, the technical stack trace, device type, operating-system and app version, and the connection’s IP address. The contents of your ratings are not included. Legal basis: Art. 6(1)(f) GDPR.

• Our own gateway (api.yammo.eu) — operated by us; account, moderation and statistics data live here.
• Resend — sending the sign-in email containing the one-time code (email address, code).
• Google (Firebase Cloud Messaging) — delivery of push notifications (push token, message content).
• Sentry — crash and error reports, where enabled.
• Apple / Google — only if you use “Continue with Apple/Google”; that sign-in happens under their own responsibility.
• Open Food Facts — product data source; no personal data is sent there.

Where these services process data outside the EU, we rely on the European Commission’s standard contractual clauses and/or the EU-US Data Privacy Framework.

One-time sign-in codes

15 minutes, then invalid

Account data

until you delete the account

Push tokens

until revoked, until sign-out, or until account deletion

Reports

until the case is closed; afterwards as a record of the case, without a reference to the reporting account

Blocks

until you lift them or delete the account

Usage statistics

no identifier at all — not attributable to you, and therefore not individually erasable

Ratings and favourites

until you withdraw them or use “Delete my data”

Server logs

short-term, for operations and fault analysis

The app carries a deletion function: Settings → Delete account. It does not merely sign you out: it permanently deletes your account and the data attached to it — the account record, push tokens and your blocks. Reports other people filed about you remain as case documentation, with the reporting account’s identifier removed. Deletion cannot be undone.

• Access to the data held about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR) — immediately available in the app, see above
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Write to hello@lynk.run. You may also lodge a complaint with a supervisory authority; ours is the Hessian Commissioner for Data Protection and Freedom of Information, Wiesbaden.

Yammo is not directed at children. You should be 16 or older to create an account — younger only with a parent’s consent.

When what the app processes changes, this page changes with it — before the new feature ships, not after. The version published here, with the date shown above, is the applicable one.