Overview
YoteiLink is a shared calendar for families, couples, and small groups. We collect information to provide and secure the service, restore purchases, and improve the app. We distinguish optional app-interaction telemetry from records associated with a shared calendar.
Information We Collect
- Calendar and member data: display names, randomly assigned device and shared-calendar identifiers, membership, invitation information, event titles, notes, dates, and times. These identifiers let the service recognize members without an email/password account.
- Notifications: when remote notifications are enabled, an Apple Push Notification service token is stored with the device's shared-calendar membership or pending join request to deliver notifications.
- Imports: Apple Calendar details are copied into YoteiLink only after you select, review, and confirm them. A document selected for text recognition is processed on-device; its source image is not uploaded or retained unless you separately attach an image to an event.
- Photos: optional images you attach to events. Photos are stored privately and are available only to members of the same shared calendar.
- Purchase history: Apple-verified subscription identifiers, product, status, and expiration information used to provide and restore YoteiLink Pro access. Purchase status is also used to measure subscription conversion for shared calendars.
- Optional product analytics: a random app-installation identifier and a fixed, bounded set of interaction names and result or method values. Event titles, notes, photos, family identifiers, member identifiers, invite codes, App Store transaction identifiers, and other calendar content are never included.
- Shared-calendar activity records: the shared-calendar identifier, creation and joining milestones, first shared-event timing, daily counts of joins, join requests and event writes, plan-presentation counts, trial status, and paid-conversion timing. These records are stored separately from optional telemetry and are used for service operation and aggregate product analysis; the analysis does not use event titles, notes, or photos.
- Abuse-prevention security data: invitation and analytics endpoints receive a transport IP address and immediately convert it to a keyed, one-way HMAC. The raw IP is not written to YoteiLink application databases or application logs and cannot be recovered from the stored value.
How We Use Information
- Provide shared calendars, synchronize events across devices, manage membership and invitations, send requested notifications, and store private event photos.
- Verify subscription status, provide Pro features, restore purchases, and prevent one subscription from being attached to unrelated calendars.
- Measure a small set of app interactions and reliability outcomes when product analytics is enabled.
- Evaluate shared-calendar activation, feature and plan use, and trial-to-paid conversion using the shared-calendar activity and purchase records described above.
- Rate-limit invitation and analytics endpoints, prevent abuse, and keep the service available.
Linkage, Tracking, and Advertising
- Calendar, member, photo, notification, purchase, and shared-calendar activity records are associated with a device or shared calendar. Shared-calendar identifiers, activity records, and purchase status are also used for aggregate product analysis. YoteiLink does not require an email address or password to start.
- Optional app-interaction telemetry is not linked to a person, shared calendar, member, purchase, invitation, event, note, or photo. It is not joined to shared-calendar activity or purchase records. Security HMAC rows are not joined to telemetry or app content.
- YoteiLink does not track you across apps or websites, serve third-party advertising, sell personal information, or use collected information for advertising or marketing profiles.
Retention and Deletion
- Calendar data and photos are kept while needed to provide the shared calendar and are removed through the app's event, photo, member, and calendar-management flows, subject to limited backup, security, and legal retention where required.
- Apple-verified purchase records are kept as needed to verify subscription status, restore access, prevent duplicate binding, resolve purchase issues, and meet legal obligations.
- Shared-calendar activity and experiment records are retained while their shared calendar exists and are deleted when that calendar is deleted, subject to limited backup and legal retention. Leaving a calendar does not delete records for its remaining members. These records do not use the optional telemetry's 90-day retention period.
- Raw optional app-interaction telemetry is kept for no more than 90 days. Turning off product analytics stops this telemetry and requests deletion of its random installation identifier and events. It does not stop or delete calendar, notification, purchase, shared-calendar activity, or experiment records.
- Analytics-endpoint HMAC rate-limit rows expire after 2 hours. Invitation-endpoint HMAC rate-limit rows expire 8 days after their last update, slightly longer than the maximum 7-day abuse block. These unlinked security records cannot be matched to an analytics installation, so the in-app analytics opt-out does not delete them early; their fixed expiry still applies.
Sharing and Service Providers
We do not sell personal information. Shared calendar data is available only to approved members of that calendar, and invitations reveal only the information needed to request access. We use infrastructure providers, including hosting, database, storage, delivery, and App Store services, only to operate YoteiLink. These providers process information under their own security and privacy commitments.
Your Choices
- You can add, change, or delete events and photos in the app, leave a shared calendar, and manage eligible shared-calendar data from YoteiLink settings.
- Optional product analytics is enabled by default and can be turned off in Settings. YoteiLink will stop that app-interaction telemetry and attempt to delete its installation identifier and raw events; the app reports if server deletion could not be confirmed so you can retry. This setting does not control the separate shared-calendar, notification, purchase, or activity records. Contact us for a data-deletion request.
Children
YoteiLink is intended for use by families and household groups. It is not designed to collect information directly from children without the involvement of a parent or guardian.
Changes and Contact
We may update this policy as YoteiLink evolves. We will update the revision date on this page when we make changes.
For privacy questions or a data-deletion request, contact us at contact@kuuloa.com.