Privacy Policy

Last updated January 30, 2026

This Privacy Policy explains how personal data is processed when using the Umami mobile application for iOS (“App”). It applies exclusively to the Umami App distributed via the Apple App Store and Apple TestFlight.

1. Controller (Verantwortlicher)

The controller within the meaning of the General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP) is:

Janis Wilkening
c/o F2BII E-Commerce#406
Hintergoldingerstrasse 30
8638 Goldingen
Switzerland

Email: help@getumami.app

We have not appointed a Data Protection Officer, as we are not legally required to do so.

2. Scope of This Privacy Policy

This Privacy Policy applies to:

  • The Umami iOS App.
  • All processing activities related to the use of the App.

Data processing carried out independently by Apple or other third parties is performed under their own responsibility as independent data controllers.

3. App Store & Apple Processing

The Umami App is distributed via the Apple App Store and Apple TestFlight. When downloading, installing, or purchasing subscriptions, Apple processes personal data such as:

  • Apple ID
  • Email address
  • Device information
  • Purchase and billing data

Apple acts as an independent data controller for these processing activities. Umami has no influence over this processing. Further information can be found in Apple’s Privacy Policy: https://www.apple.com/legal/privacy/

4. Account Registration & Authentication

Use of the Umami App requires the creation of a user account.

Data processed:

  • Email address
  • Username

Authentication is performed using one-time passwords (OTP) sent via email or via Sign In with Apple (OAuth Flow). No passwords are stored by Umami.

Purpose:

  • Account access and authentication
  • Saving favorite food spots
  • Sharing lists and collaborating with other users
  • Synchronization across devices
  • Subscription management

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

5. Subscriptions & Payments

Subscriptions are managed via RevenueCat. All payments are processed exclusively by Apple.

Umami:

  • Does not process credit card or payment data.
  • Receives only subscription status information required to unlock features.

Service provider: RevenueCat, Inc. – subscription management & validation.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

6. Location Data (GPS)

The App may access your device’s location only with your explicit consent.

Types of access:

  • Foreground location: to display nearby saved food spots.
  • Background location: for geofencing and location-based notifications.

Purpose:

  • Show saved spots around you.
  • Notify you when you are near a saved or recommended location.

📍 Important: Location data is not stored historically and is processed only in real time. You can revoke location access at any time via your iOS system settings.

Legal basis: Art. 6(1)(a) GDPR (consent), § 25 TDDDG (access to device functions)

7. Push Notifications

The App uses push notifications to inform you about:

  • Activity in shared lists (e.g., “Sarah added a new spot”).
  • Location-based alerts (e.g., “You are near a saved bakery”).

For this purpose, an anonymous push token is generated by Apple and processed. Push notifications are not used for advertising and can be disabled at any time via iOS settings.

Legal basis: Art. 6(1)(a) GDPR (consent)

8. Photos & Media Access

The App may access photos or media files only when you actively choose to upload them, for example to add images to a visited food spot.

The App does not access photos in the background or scan/analyze your media library.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract), § 25 TDDDG

9. Automatically Collected Technical Data & Analytics

When using the App, the following technical data may be processed: Device model, iOS version, App version. This data is required to ensure functionality, maintain security, and improve stability.

We use PostHog for in-app analytics to understand how users interact with the App and to improve features and user experience. PostHog may collect:

  • User interactions and feature usage patterns.
  • App performance metrics and crash data.
  • Anonymized or pseudonymized event data.

You can opt out of analytics at any time through the App settings or by contacting us at help@getumami.app.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving the App and understanding user behavior)

10. Backend & Data Processors

We work with carefully selected processors. We have concluded Data Processing Agreements (DPA) with these providers to ensure your data is protected (Art. 28 GDPR).

Service providers:

  • Supabase: Backend infrastructure and database. Location: Frankfurt, Germany (EU).
  • RevenueCat, Inc.: Subscription validation and management. Location: USA. (Secured by SCCs and DPA).
  • Brevo: Transactional emails (OTP, account-related messages). Based in France.
  • PostHog: In-app analytics and product insights. Location: Frankfurt, Germany (EU). (Secured by DPA).

Note: Personal data is not sold and not used for advertising purposes.

11. Data Storage & Retention

Account data is stored for the duration of your account. You can delete your account directly in the App settings. Upon deletion, personal data is erased unless legal retention obligations apply.

12. No Advertising & Limited Tracking

Umami does not use advertising identifiers (IDFA), display third-party ads, or sell personal data. We do not track users across apps or websites.

However, we do use in-app analytics (PostHog) to understand how you use the App and improve our product. This analytics is used solely for product improvement and is not shared with advertisers or other third parties for marketing purposes.

13. Your Rights

Under the GDPR and the Swiss Federal Act on Data Protection (FADP), you have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing. You may also lodge a complaint with the FDPIC in Switzerland or your local supervisory authority.

To exercise your rights, contact us at: 📧 help@getumami.app

14. Children's Privacy

The App is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at help@getumami.app so we can delete it.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The current version is always available in the App. If changes materially affect your rights, we will notify you appropriately.

16. Language

This Privacy Policy is drafted in English. In the event of translations, the English version shall prevail.