YELLOW

Yellow — Privacy Policy

Last updated: September 9, 2026

Yellow is provided by Aslanov Ventures LLC, operated by Farid Aslanov ("Yellow," "we," "us," or "the Company"). This policy explains the information Yellow handles, where it goes, and how you can control it. Contact faridaslanov@icloud.com with privacy questions.

Yellow is an adults-only (18+) personal daily-planning app. It has free features and an optional paid Yellow Premium subscription. Our Terms of Service explain subscriptions.

1. Our privacy principles

On-device first, with specific off-device features. Your personal records are stored on your iPhone. Eligible non-Health records may also sync through your private iCloud database. Using an AI feature, signing in, verifying a subscription, sharing optional analytics, or submitting feedback can involve the separate processing described below.

Separate choices. Accepting the general Terms and Privacy Policy does not by itself authorize AI sharing or product analytics. The current onboarding flow requires a separate AI-data-sharing acknowledgement; Section 2 explains what that acknowledgement does and when information is sent. Usage analytics is optional and defaults Off.

No advertising or sale. Yellow does not show advertising, sell, rent, or trade personal information, or use it for cross-company advertising tracking. It does not use Apple's advertising identifier or a third-party advertising or analytics SDK. Yellow operates its own optional usage analytics.

2. Information the app handles

a. Sign in with Apple and account information

You can use Yellow's local features without signing in. Sign-in is required for authenticated AI services and the app's purchase and restore flows.

Apple may provide a name and email address when you first sign in. Those profile fields are stored locally; they are not separately added to Yellow's authentication request. Apple's signed sign-in credential can contain account claims, including an email address. Yellow's backend processes that credential and a one-time authorization code to authenticate you and establish a session.

The backend stores coded account identifiers, session and security information, AI-consent records, usage allowances, and subscription records when applicable. These coded identifiers are pseudonymous, not anonymous. Yellow also keeps an encrypted Apple authorization credential so it can request revocation when you delete your account.

Yellow is designed for one person using a personal iPhone and private iCloud account. Signing in does not create separate local profiles or switch between isolated sets of local data. Ordinary sign-out removes the local sign-in and session state and clears the app's current AI and Premium access state, but preserves your personal content and eligible private-iCloud records. It does not delete a backend account, revoke Apple's authorization, or cancel a subscription.

b. Planning records and local-only Health storage

Schedules, Chat history, profile and assistant-memory information, reflections, reminders, spending entries, preferences, Wins and progress are stored on your device. Eligible non-Health records may sync through Apple's private CloudKit service when available and enabled. The Company does not receive a readable copy of that private database through Yellow's backend.

Weight entries, Health notes, and Health photos are stored separately on your device. Yellow excludes its Health store, associated database files, and Health-owned photos from its CloudKit synchronization and automatic device backup. Yellow does not provide an iCloud-synced or automatically backed-up copy of those Health records. Deleting the app or losing the device can therefore mean losing those records unless you have kept an export.

This local-only storage boundary is not a promise that information can never leave the device. You can deliberately attach a photo in Chat or export your data. Information copied into Chat or another non-Health feature follows that feature's storage and sharing rules, not the Health store's rules.

During onboarding, the age/Terms/Privacy acknowledgement and a separate acknowledgement of the OpenAI data-sharing disclosure both start unchecked. Both are required to complete the current onboarding flow. The AI acknowledgement records a versioned choice on your device. That step itself does not send onboarding answers or AI content to OpenAI and does not establish consent for a signed-in account.

After you sign in and deliberately request an AI feature, Yellow checks the provider and disclosure version with its backend. A matching accepted onboarding choice can then be applied to that signed-in account. The app and backend must validate current account-bound consent before forwarding AI content. Missing, outdated, declined, withdrawn, or unconfirmed consent blocks transmission.

A later AI-consent sheet includes Not now. Selecting it declines that request for consent and blocks the pending AI work; it is not a way to skip the required onboarding acknowledgement. You can turn off AI assistance or give consent again in Settings → Privacy, Legal & Data → Privacy & AI. Turning it off blocks new AI requests on this device, cancels pending requests where possible, and attempts to update the backend. The device stays blocked if it is offline. An offline change is not a promise of immediate synchronization to another device.

Depending on the feature and enabled context, an authorized AI request can include:

Not every request contains every category. AI features may also update Yellow's assistant memory using an existing profile, recent conversation and reflections under the same consent controls.

Yellow does not automatically add information from Health records or Health-derived Wins to AI requests. A Health photo you separately attach in Chat, or health information you type into Chat or your profile, can be processed as part of that request. Selected AI images are resized and re-encoded before upload. PDF attachments are not supported in this release.

AI consent is tied to the signed-in account and disclosure. Sign-out, an account change, or account deletion invalidates the applicable local consent. Withdrawal cannot recall content already processed by a provider. Manual Plan, Money, Health, Remind, Wins and history features remain usable without an AI request.

d. Optional usage analytics

Share Usage Analytics is an optional choice in onboarding and Settings. It defaults Off, is separate from AI permission, and is not required for either free or paid features. Yellow creates and sends usage events only after the required current legal acceptance and affirmative analytics consent. A saved preference alone does not authorize collection when the other consent and availability checks are not satisfied.

Analytics v2 is available only in the intended Development build using the exact staging HTTPS endpoint and Development distribution, the intended TestFlight build using the exact staging HTTPS endpoint and TestFlight distribution, and the intended App Store build using the exact production HTTPS endpoint and App Store distribution. In every admitted build, Yellow creates and sends events only after current legal acceptance, a durable affirmative Share Usage Analytics choice, and durable analytics consent.

When enabled, analytics records general feature/action types, event order, local date, local minute of day, and local second of minute, general outcomes or broad failure categories, app version/build, and distribution type. Examples include opening a surface, completing an action, or a purchase or restore outcome. Health and Money events describe the action, not the weight, amount, or other entered value.

A random persistent installation identifier, random session and event identifiers, and related consent/security records organize the history and prevent duplicate or unauthorized uploads. The installation identifier is not derived from your name, Apple account, advertising identifier, or hardware identifier. Yellow does not use it to link analytics across devices.

These records are pseudonymous, not anonymous. The protected developer dashboard can display and export one installation's sequence of actions under an alias, as well as combined statistics. Analytics is not limited to aggregate totals.

Analytics event records do not contain your name, email, Chat messages, AI replies, schedule or reminder text, amounts, merchants, spending categories, weight values, notes, photos, files, filenames, or raw error messages. Cloudflare processes and stores these records for Yellow. Connection/security metadata is separate, as explained in Section 3.

Turning analytics Off stops new events and clears unsent events. It does not delete history already received. To remove the installation's server-side history, use Delete Yellow Data while signed out or Delete Account and Data while signed in, under Settings → Account. Both actions also delete other Yellow data. There is no separate analytics-history deletion button.

The installation's sharing preference is excluded from Yellow's data export and device backup. Full deletion removes it. Section 5 explains analytics retention and security records that can remain.

e. Feedback, support, and content reports

In Settings → Send feedback, tapping Send submits the text you enter and up to three images you select to Yellow's Cloudflare backend. The feedback handler does not forward that submission to OpenAI.

Images are resized and re-encoded as JPEGs. Original filenames and source metadata are not sent. The request does not deliberately include a Yellow account identifier, Apple identifier, analytics identifier, or sender email address. Your text or the visible contents of an image can still identify you or another person. Please do not include passwords, sign-in credentials, Health photos, or other sensitive information.

Feedback records include generated submission and attachment identifiers, a submission time, and basic submission metadata. A protected developer reader provides access to the text and images. Yellow shows success after the backend confirms storage; a failed submission leaves the draft available to retry.

You may instead email faridaslanov@icloud.com. Long-pressing a Chat response can open a content-report email containing an excerpt of the selected response, which you review before sending. These emails expose the usual sender and email information and are handled by your mail provider and the recipient's mail service.

f. Subscription and purchase information

Apple processes subscription payments. Yellow does not receive your full payment-card or bank-account credentials through its purchase flow.

For purchase verification and Premium access, the app sends signed Apple transaction information to Yellow's backend. Yellow verifies it with Apple and handles the product identifier, original transaction identifier, purchase environment, subscription status, paid-through or applicable grace-period dates, verification times, and account-ownership information. These are account-related purchase records, not anonymous analytics.

Yellow uses them to grant and restore access, check ownership, prevent duplicate claims or fraud, and manage Free/Premium allowances. Signing out or allowing a subscription to expire does not by itself delete these backend records. Section 5 explains account deletion and retention.

g. Operational usage and security information

Separately from optional analytics, Yellow records limited account-related information needed to provide its online features: AI token totals, Free-plan usage counters, opaque operation identifiers, consent/security state, and purchase verification records. They are not a copy of your conversations or personal logs and are not used for advertising.

These records can be needed even when Share Usage Analytics is Off. For example, token totals support capacity and cost safeguards, and account usage counters enforce the Free plan's limits. Their retention periods differ; not all usage records expire after 48 hours.

h. Exports, photos, calendar access, and notifications

Settings → Privacy, Legal & Data → Privacy & AI → Download a copy of my data creates an export of the Yellow records this version can access, including local Health records and supported attachments. Yellow does not encrypt the export. Store and share it carefully. Copies you keep outside Yellow are not removed by an in-app deletion. Import is not offered in ordinary Settings.

Photos or calendar information you make available to a feature follow the relevant storage and AI-sharing rules above. A photo stored only in Health is treated differently from one you attach in Chat or submit as feedback.

Yellow's notification requests are scheduled locally on the device; Yellow does not operate a remote-push service for those reminders. Apple may separately provide developers with App Store measurements under Apple's own processes and user settings. Yellow's analytics toggle does not control Apple's services.

3. Service providers and AI processing

OpenAI is the AI provider configured for this release. Authorized AI content passes through Yellow's Cloudflare backend to OpenAI, which generates the response. Yellow's backend does not maintain its own database of AI conversation history; Chat history can still be stored on your device and in your private iCloud as described above.

OpenAI's published API policy says inputs and outputs are not used for model training unless the API account holder opts in to data sharing. Its default abuse-monitoring retention can include content for up to 30 days, with legal and safety exceptions. Yellow requests that responses not be saved as retrievable response history, but that is not zero retention: abuse monitoring, temporary prompt caching, and applicable image-safety review can still involve retention. See OpenAI's API data controls.

Cloudflare hosts the backend and processes authentication, authorized AI traffic, purchase verification, operational controls, feedback, and optional analytics. Its network and security services process connection information such as IP addresses and routing metadata. For feedback abuse prevention, Yellow's application code also uses a short-lived coded value derived from an IP address and time, retained for about two minutes. The IP address is not part of the feedback record or analytics event payload. This does not mean the network operator never processes or retains it.

Yellow's application diagnostics are designed to exclude raw conversations, AI answers, attachments and credentials. Cloudflare's own infrastructure processing and retention are separate from application event fields and database expiry periods. See Cloudflare's Privacy Policy.

Apple provides Sign in with Apple, private iCloud and App Store purchasing. Apple handles its own account, payment and platform records under Apple's Privacy Policy. Support email also involves the mail providers used to send and receive it.

Service providers handling user information for Yellow must provide the same or equivalent protection described in this policy and required by applicable law and App Store rules. Provider-controlled records are subject to their applicable terms and legal duties; Yellow's in-app deletion does not promise their instantaneous physical erasure. You can contact us about privacy requests involving information processed for Yellow.

4. How we use information

We use the information described here to provide and personalize the features you use; authenticate you and enforce consent; verify subscriptions and usage allowances; respond to feedback and reports; operate and secure the service; and understand feature use through optional analytics. We do not use it for advertising, cross-company tracking, or sale.

5. Retention and deletion

Your device and private iCloud

Your records remain until you delete them or the local app data is removed. Uninstalling is not backend-account deletion and does not necessarily remove eligible records already in private iCloud. Health records created in the current local-only store are not backed up or synced by Yellow. User-kept exports are separate copies.

Delete Yellow Data — while signed out

Under Settings → Account, this action deletes the current Yellow content and app-owned data it can access, including local Health records/photos, relevant settings, notifications, widget data, and installation analytics history when present. Clearing the currently connected private-iCloud scope can require continuing synchronization and recovery.

It does not delete a separately existing backend account, invalidate that account's sessions elsewhere, revoke Sign in with Apple authorization, or cancel Apple billing. To delete a Yellow account, sign in to that account and use the account-deletion action.

Delete Account and Data — while signed in

This action starts backend account deletion before completing the local wipe. It invalidates the account's Yellow sessions, removes account-scoped consent, usage, entitlement and transaction-ownership records, and requests revocation of Yellow's Sign in with Apple authorization. It also performs local data and installation analytics deletion and clears the currently connected private-iCloud scope through the deletion flow.

Apple authorization revocation is reported as complete only after Apple confirms it, or after you complete the requested Apple Settings step and Yellow can verify the revoked state. Network, Apple, or iCloud failures may leave deletion in a pending recovery state. Follow the app's instructions and keep Yellow installed while recovery is active. Yellow does not delete your Apple Account.

Yellow can act on the currently connected private-iCloud scope, not inspect all historical Apple/iCloud accounts you may have used. It cannot certify physical removal from Apple's internal systems.

Signing out, deleting the app, deleting Yellow data, or deleting your Yellow account does not cancel an Apple subscription. Cancel separately in Apple's subscription settings to stop future renewal.

Account, purchase, and operational retention

Account/session/consent and subscription-ownership records are kept as needed to operate those functions until the applicable expiry or account deletion. Subscription entitlement and transaction-ownership records have no automatic time-based deletion merely because paid access ends.

AI token totals for an account/day expire after about 48 hours. A separate global total is not linked to a particular account. Free-plan allowance records have a different purpose: lifetime Smart Schedule usage remains associated with the account until account deletion. Ordinary operation-idempotency records generally expire after about 48 hours, while committed Smart Schedule accounting markers remain until account deletion. Content-free usage-accounting recovery records can survive a signed-out local reset so that a reset does not reset an account allowance; account deletion removes that account's scope.

During account-deletion recovery, an encrypted, deletion-only Apple authorization credential and operation state may remain until the revocation matter is resolved or its bounded expiry is reached. A separate minimal pseudonymous account-deletion/security record expires after up to 32 days. For an interrupted Apple sign-in exchange, a separate random operation identifier and revision number may remain indefinitely in the account's pseudonymous backend record to safely handle late responses. These records do not contain your Chat, planning or Health content and are not used for analytics or profiling. The 32-day period is not a universal deadline for separate pending Apple-revocation recovery state.

Optional analytics retention

Yellow's automatic cleanup is configured to remove raw events after 180 days, installation-level daily summaries after 13 calendar months, and thresholded aggregate statistics after 24 calendar months. Each aggregate cell requires at least five contributing installations. The app's unsent queue is limited to 1,000 events and 14 days.

Turning sharing Off stops collection but leaves received history subject to those periods. Full in-app data/account deletion removes the installation's active server history and adjusts affected aggregates. Later opt-in uses a new unrelated installation identity.

After history deletion, content-free coded security markers may remain indefinitely to reject old credentials and prevent deleted registrations from being recreated. They contain no activity history, content, account identity or installation subject and are not used for metrics. They are different from the 32-day account-deletion record. Deletion recovery may also remove legacy analytics state without restarting collection.

Feedback, email, and downloaded copies

Feedback text and image records in Yellow's backend are set to expire after about 90 days. Because direct feedback is not linked to a Yellow account, the in-app data/account deletion controls cannot automatically find and remove an earlier submission. Contact us for a request about a submission that you can help us identify; do not send account passwords or sign-in credentials.

Backend expiry does not delete separate email messages or any copies a developer has downloaded. Likewise, deleting server analytics history does not by itself delete an exported CSV outside the backend.

Support emails, emailed content reports, and separately downloaded analytics or feedback copies do not have a fixed automatic-deletion schedule. These records may remain after a support issue or review ends. Their retention and use remain subject to the purposes described in this policy and applicable law; keeping a copy does not remove any right to request its deletion. Contact faridaslanov@icloud.com about information we can identify in these copies. In-app and backend deletion do not automatically erase these separate copies or records held independently by your mail provider.

Provider records and other limits

Withdrawing consent or deleting data cannot recall content already processed by OpenAI or immediately erase records controlled by Apple, Cloudflare, or mail providers. Their applicable retention, safety and legal requirements still apply. We do not promise deletion of copies you independently exported or shared. These limits do not remove any privacy rights you have under applicable law.

6. Your choices and rights

You can use local features without signing in; review and edit your records in the app; export them; and use the applicable deletion action under Settings → Account. Use Settings → Privacy, Legal & Data → Privacy & AI to manage AI assistance and the Share Usage Analytics choice in Settings to manage optional analytics. Declining analytics does not reduce functionality.

Turning off AI sharing affects new AI requests, not earlier processing. Turning off analytics stops new events, not received history. The full deletion controls remove more than analytics alone. Section 5 describes each action's scope.

Depending on the laws that apply to you, you may have rights to access, correct, delete or receive a copy of personal information and to withdraw consent. Contact faridaslanov@icloud.com to make a request or ask about a deletion limit. We may need enough information to locate the records and verify that the request is authorized. Do not send your passwords or Apple sign-in credentials.

7. Security

Yellow uses measures such as encrypted network connections, protected device storage, Keychain storage for credentials, and server-side AI credentials rather than embedding those credentials in the app. Access to the feedback reader and analytics dashboard is restricted. No system is perfectly secure. Unencrypted exports and information you deliberately share outside the app require care.

8. Children

Yellow is intended for adults aged 18 or older, not children. We do not knowingly collect information from people under 18. Contact us if you believe an underage person has provided information so that we can take appropriate action.

9. International users

Yellow is operated from the United States. Information processed through its online features may be handled in the United States and other countries where Apple, OpenAI, Cloudflare or the relevant mail providers operate. This statement is not a request to waive privacy rights or any legally required protection for international transfers.

10. Changes to this policy

We may update this policy and its last-updated date and provide notice in the app where appropriate. Yellow can require acceptance of an updated legal version. A policy update does not by itself grant AI or analytics consent; those separate controls continue to apply. Where the law requires additional notice or consent for a change, we will obtain it before relying on that change.

11. Contact

Aslanov Ventures LLC
Attn: Farid Aslanov
Email: faridaslanov@icloud.com