← Yinoko

Privacy

Privacy notice · Last updated: 28 October 2026

This privacy notice explains how personal data are processed in connection with the website yinoko.com (the “Website”) and the Yinoko mobile application (the “App”), in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”).

1. Controller

The controller within the meaning of Article 4(7) GDPR is Yinoko (“Yinoko”, “we”, “us”). Questions concerning this notice or the processing of your personal data may be sent to privacy@yinoko.com.

2. Personal data we process

2.1 Website. When you visit the Website, the data technically required to deliver it are processed, such as your IP address, browser type and the page requested. The Website does not use cookies. It measures its use with Cloudflare Web Analytics, which records the page visited, the referring page, the browser and device type, the country and how quickly the page loaded. It stores nothing on your device and does not identify or follow individual visitors; we see only totals.

2.2 App. When you use the App, we process the following categories of personal data, to the extent you provide them or they arise from your use of the App:

  1. Account data: an account identifier, your email address if you provide one, and authentication data.
  2. Profile data: such as your name, date of birth, sex, body weight, fitness level, preferences and profile photo.
  3. Training data: such as your programs, scheduled and completed training sessions, performance, ratings of your sessions, and the gyms and equipment you use.
  4. Content: messages you send to the AI coach and to other users, photos you submit, and content the AI coach generates about you, including notes it records to tailor its coaching.
  5. Location data: the position of your device, only when you use a location-based function and only with your permission. Location data are not stored, other than transiently in server logs (see section 7).
  6. Technical and usage data: such as IP address, device tokens for notifications, server logs, and records required to operate the App, such as AI usage limits.

We do not collect advertising identifiers.

2.3 Beta waitlist. When you join the beta waitlist on the Website, we process your email address, the language of the page, your answers to the questions on the form (what you want from the App, where you train, the type of phone you use, and any text you choose to write), and the times at which you signed up and confirmed your address.

2.4 Data concerning health. Some of these data, such as heart rate, body weight, or information about injuries or other health conditions that you share, may constitute data concerning health within the meaning of Article 9(1) GDPR.

2.5 Provision of data. The provision of personal data is neither a statutory nor a contractual requirement. Without certain data, certain functions of the App are not available.

3. Purposes and legal bases

  1. Providing the App and its functions: Article 6(1)(b) GDPR (performance of a contract).
  2. Providing AI-based functions: Article 6(1)(a) GDPR (consent), which the App requests before these functions are first used.
  3. Processing data concerning health: Article 9(2)(a) GDPR (explicit consent).
  4. Inviting you to the beta and learning what you want from the App, based on your waitlist signup: Article 6(1)(a) GDPR (consent), which you give by confirming your email address.
  5. Ensuring the security of the App and the Website, preventing abuse, and moderating content shared between users: Article 6(1)(f) GDPR (legitimate interest in operating a secure service and protecting its users).
  6. Measuring how the Website is used, in totals only: Article 6(1)(f) GDPR (legitimate interest in learning how visitors find and use the Website).

We do not sell personal data and do not use them for advertising.

4. Automated decision-making

We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). AI-generated recommendations in the App can be accepted, modified or declined.

5. Recipients

5.1 Other users. When you use functions shared with other users, the users concerned receive the data you share there, such as your name, profile photo, messages and training progress, as shown in the App.

5.2 Processors. We engage processors within the meaning of Article 28 GDPR in the following categories: hosting and infrastructure providers, network security providers, website analytics providers, email delivery providers, AI service providers, and push notification services. They process personal data only on our instructions. A list of our processors is available on request.

5.3 Access within Yinoko. Persons acting under the authority of Yinoko have access to personal data to the extent necessary to operate and support the App, resolve technical problems and handle reports.

6. Transfers to third countries

Some of our processors are established in the United States. Transfers to these processors are based on the adequacy decision for the EU–US Data Privacy Framework (Article 45 GDPR) where the recipient is certified under it, and otherwise on standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR). You may obtain a copy of the applicable safeguards by contacting us.

7. Retention

We retain personal data for as long as you have an account. When you delete your account in the App, we erase your personal data, subject to the following:

  1. Messages you shared with other users are erased, and are shown to them as deleted.
  2. Content you delete while your account exists may be retained, accessible only to Yinoko, for the purpose of handling reports, until your account is deleted.
  3. Short-lived security data, such as verification codes, are erased within hours.
  4. A waitlist signup is erased within a week of the confirmation email if you do not confirm it; once confirmed, when you leave the waitlist, and at the latest six months after the App’s public launch.
  5. Server logs are retained by our hosting providers for a limited period for security purposes.
  6. Erased data may persist in backups until these are overwritten in the regular backup cycle, and in caches on other users’ devices until these expire.
  7. AI service providers may retain request data for a limited period in accordance with their terms, for the purpose of preventing abuse.

8. Your rights

Subject to the conditions of the GDPR, you have the right of access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection to processing based on legitimate interest (Article 21). Where processing is based on consent, you may withdraw your consent at any time (Article 7(3) GDPR); withdrawal does not affect the lawfulness of processing carried out before it.

You can rectify your profile data and delete your account directly in the App, and leave the beta waitlist through the link in our emails. To exercise any other right, contact privacy@yinoko.com. We respond within one month of receipt of your request (Article 12(3) GDPR), free of charge.

You have the right to lodge a complaint with a supervisory authority (Article 77 GDPR), in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. In Belgium, this is the Data Protection Authority.

9. Security

We implement appropriate technical and organisational measures to protect personal data (Article 32 GDPR), including encryption of data in transit and restricted access to personal data.

10. Children

The App is not intended for persons under the age of 16. We do not knowingly process personal data of persons under 16. If we become aware that we have done so, we erase those data.

11. Changes to this notice

We amend this notice when our processing changes and update the date above. If a change materially affects personal data you have already provided, we inform you in the App or by email.