Yuva – shared lists for iPhone and Apple Watch · Last updated: October 2026
Özkan Yilmaz
Buckower Damm 159
12349 Berlin
Germany
Email: oezkan.yilmaz.app@gmail.com
Yuva has no server of its own. Your lists live on your devices and in your iCloud. Names, items, notes and links are end-to-end encrypted: only the devices of the people you share a list with can read them – neither Apple nor we can. Yuva has no ads, no tracking and no analytics.
Yuva stores your lists with Apple's iCloud (CloudKit) in your private iCloud area, or for shared lists in the owner's area. Contents are encrypted there. What stays unencrypted is technical information needed to sync: times, whether an item is done, order, colour and the iCloud identifier (no name) of whoever added or ticked off something. We have no access to your private iCloud area. Apple's terms and privacy policy apply to iCloud. Legal basis: Art. 6(1)(b) GDPR.
Members of a shared list see its contents, the name you entered and who added or ticked off what. You can remove members, block people or leave a list at any time. Whoever is removed or leaves loses access.
"Share nearby" uses Bluetooth and Wi-Fi directly between devices. While Yuva is open, other Yuva users nearby see your first name. Your iCloud identifier is exchanged only after you both agree; a code on both screens shows you are really connected to each other.
So that invitations, answers and news ("Anna ticked off milk") arrive as notifications, Yuva leaves small notes in the app's public iCloud area. Their content is end-to-end encrypted. Technical information remains visible: which iCloud identifier a note is for, which one wrote it, and when. These identifiers are only valid for Yuva and contain no name or email address. We can see this information in Apple's developer tools, not the content. The area cannot be searched by writer. Notes are deleted after 30 days. Your public key is also stored there, so others can encrypt invitations for you. Legal basis: Art. 6(1)(b) GDPR.
Notifications are delivered through the Apple Push Notification service and decrypted only on your device. Item reminders are scheduled locally on your device. Both only with your permission.
When you paste a link, your iPhone opens the page once to fetch its title. The page receives your IP address, as with any visit in a browser. Other devices load nothing from it until someone opens the link.
The widget and the Apple Watch show your lists. The data stays on your devices or travels over Apple's encrypted connection between your iPhone and your watch. If you use Siri or Shortcuts, Apple processes your voice input under its own terms.
Purchases and subscriptions are handled entirely by Apple (Apple Distribution International Ltd., Cork, Ireland, as an independent controller). We receive no payment data.
Yuva contains no analytics, tracking or advertising software. There is no profiling.
If you agreed to share analytics with developers, Apple gives us aggregated crash reports without reference to you. The app also keeps iOS crash and performance reports on your device; they leave it only if you send them yourself under "Diagnose teilen". In TestFlight we receive what you choose to send. Legal basis: Art. 6(1)(a) and (f) GDPR.
If you write to us by email, via "Hilfe & Kontakt" in the app or the contact form, we process your email address, your name (if given) and your message to reply. A report about a person ("Melden" in the app) also contains their Yuva identifier so we can find them – never the contents of your lists. Our mailbox is provided by Google (Gmail; Google Ireland Ltd. and Google LLC, USA) under the EU-US Data Privacy Framework. Contact-form messages are stored by our host Netlify (section 14), forwarded by email and checked for spam with Akismet (Automattic Inc., USA). We delete the data once the request is closed and no retention duty applies. Legal basis: Art. 6(1)(b) or (f) GDPR.
This website is hosted by Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA, as a processor (Art. 28 GDPR). Netlify processes technically necessary data (IP address, time, page, browser) for secure operation and deletes it after a short time. No cookies, no tracking, no content from other servers. Legal basis: Art. 6(1)(f) GDPR; transfer to the USA under the EU-US Data Privacy Framework or standard contractual clauses.
Lists stay until you delete them. Mailbox notes are deleted after 30 days. "Alle meine Daten löschen" (delete all my data) in the account screen removes your lists, your places in other people's lists, everything you wrote to the public area, and your keys. Signing out of iCloud deletes everything Yuva keeps on that device.
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21) and withdrawal of consent (Art. 7(3) GDPR). Most of them you exercise directly in the app; for anything else an email to oezkan.yilmaz.app@gmail.com is enough. No automated decision-making or profiling takes place. You may lodge a complaint with a data protection authority.
We update this policy when the app changes. The version published here applies.