Privacy Policy

As of: 22 August 2026 · Courtesy translation — the German version is legally binding.

1. Controller

2. What data we process

On registration and use

• E-mail address — for sign-in and the confirmation mail.
• Password — exclusively as an Argon2id hash. The plain-text password is never stored and is not known to us.
• Session identifier — a random value in an HttpOnly cookie so you stay signed in. It contains no personal data and can be revoked server-side at any time.
• Watchlist — the app identifiers you have saved.
• Time and IP address of registration attempts — temporary, to limit abusive mass registrations.

During analysis

We analyse publicly accessible review texts from Google Play and the Apple App Store, together with the display names, star ratings and dates published there. We collect no data from developer accounts and no personal data of the end users of the analysed apps beyond what the stores themselves display publicly.

3. Legal bases

• Art. 6(1)(b) GDPR (performance of contract) — account, sign-in, watchlist, analyses.
• Art. 6(1)(f) GDPR (legitimate interest) — limiting abusive registrations and operating the platform.

4. Cookies, advertising and consent

For operation we set one technically required cookie: the session identifier after login. It needs no consent. There is no analytics of our own and no embedding of external fonts.

Google AdSense (public pages only). On the homepage, in the blog and on the information pages we show ads via Google AdSense (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). No ads are served in the signed-in area or on the pricing page. Google and its partners may use cookies and similar technologies to personalise and measure ads; data may be transferred to the USA in the process. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which we obtain through Google's consent management — with an equally prominent “Reject” button. Without consent, no personalised ads are loaded. You can withdraw your consent at any time via the “Privacy settings” link at the bottom of the page. More information: policies.google.com/technologies/partner-sites.

5. Hosting

The application runs on a server of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, in a data centre in Germany. A data-processing agreement under Art. 28 GDPR is in place with IONOS. The connection is TLS-encrypted throughout.

6. E-mail delivery and contact form

Confirmation and system messages are sent via the IONOS mail server. Your e-mail address and the message content are processed in the course of this. If you use the question form on the contact page, the details you provide (e-mail address, optional name, your question) are forwarded to our inbox solely to answer you and are not stored on the server (Art. 6(1)(b) and (f) GDPR).

7. Recipients and third-country transfers

Your data is not sold and not shared for advertising purposes. We do not transfer it to third countries. When fetching reviews, our server calls the public interfaces of Google and Apple; the server's address is transmitted, not yours.

When you book a subscription, payment is processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland. Stripe processes the data required for payment (such as e-mail address and payment method); complete payment details never reach our server. We store only the subscription status.

Optional AI assessment (only after activation). All YelmeAtlas metrics and findings are produced rule-based, without a language model. In addition you can enable a second opinion in the settings, labelled “AI assessment”. Only then does our server transmit review texts from the public app stores, topic labels and counted metrics to Anthropic Ireland, Ltd., Dublin, Ireland (processing in the USA under the EU Standard Contractual Clauses). Your account, payment and tenant data are never transmitted. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the same switch. Without activation, no transfer takes place.

8. Retention

• Account data: until the account is deleted. You can delete your account yourself at any time (Settings → Delete account); this removes the account, sessions, watchlist and feedback. Billing records remain with Stripe under statutory retention duties (Art. 17(3)(b) GDPR).
• Sessions: until sign-out, at the latest after 14 days.
• Confirmation links: until used, then deleted immediately.
• Registration-attempt logs: short-term, for abuse prevention.

9. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). An informal e-mail to info@yelme.de suffices.

You also have the right to lodge a complaint with a supervisory authority; for us this is the Hessian Commissioner for Data Protection and Freedom of Information.

10. Changes

We update this policy when the processing changes. The version published here with the date stated above is authoritative.

11. Visitors from outside the EEA

Processing takes place exclusively in Germany under the GDPR. We do not sell personal data and do not share it for advertising. The rights listed in section 9 are granted to all users regardless of their state of residence.