Privacy Policy · 23 August 2026
What crosses, and what doesn’t
Yen holds one thing: what the two of you put in it. Nothing here is sold, nothing is shared with anyone outside your room, and there is no advertising, no analytics SDK, and no tracking of any kind.
This policy describes how Yen handles your information. Questions, requests, and complaints all go to one address.
An address is published here before Yen ships
The crossings
Yen is built for exactly two people, so the interesting question is not what is “collected” but what reaches the other person, and when. Each of these ends in the mechanism that enforces it — not a promise about intentions, but where the rule actually lives.
Your room is only yours
Everything you keep in Yen — memories, capsules, jars, notes, answers — is readable by you and your partner and by no other account. That boundary is enforced on the server, not by the app.
Row-level security on every table
Where you are
Your position goes on your shared map at roughly hundred-metre accuracy, and only when it has meaningfully moved. Keeping the map live while Yen is closed is off until you turn it on, and you can turn it off at any time. While sharing is on, Yen may add a coarse walking, cycling, running or driving badge and an approximate speed.
Off by default · your partner only
Their weather
The sky beside your partner's name is read on your own phone from the location they are already sharing. No new information is sent anywhere, and a reading older than about twelve hours disappears rather than describe where they were.
Read on device · WeatherKit
What you're listening to
Listening activity is off until you allow it. When it is on, Yen reads the song in the Music app only while Yen is open, and shares one recent song. It never reads your listening history, and whether you are playing or paused never leaves your phone.
Off by default · one song, never history
What waits until it's opened
A capsule's other half is not sent to a phone before it is opened, the day's spark answer is not sent before you have written yours, and both sides of a game card arrive only when the round is done. In each case the server refuses to hand it over early — the app is not being polite about it.
The server is the gate, not the client
Opening a jar tells no one
Reaching into a jar is private. Yen keeps no record your partner can see of when you needed one, and a draw only ever returns something they wrote. Telling them you reached in is a separate, deliberate tap — and it names the jar, never the note.
No read state on the writing side
Where your words and photographs live
Photos, drawings, voice notes and text are stored on Yen's servers so both phones can reach them, in private buckets limited to your couple. They are not end-to-end encrypted today, which means Yen's infrastructure could technically access them; the recipient gates above still hold regardless.
Private buckets · not end-to-end encrypted
What the widgets can see
Home Screen and Lock Screen widgets read small snapshots Yen writes into its private container on your phone — the day count, note, mood, map, and any drawing attached to the note. The widgets have no account and no way to reach the server themselves.
On-device container · no session
Paying for it
Purchases are handled by Apple and RevenueCat. Yen stores no card details and never sees them. One membership covers your room, so Yen records only which couple is entitled and until when.
Apple · no payment details stored
Leaving
Signing out removes your phone's session and nothing else — the shared world stays for both of you. Leaving the room, in Settings, closes it for both of you; when the last of you leaves, the room and everything in it are deleted. Deleting your account, also in Settings, erases your account, your photos, and your words for good.
The last to leave takes the room
What Yen stores
Everything below exists so the app can work, is linked to your account, and is never used to track you across apps or websites.
Yen does not collect contacts, browsing history, search history, health data, financial information, or advertising identifiers. It has no SDK that reports your behaviour to anyone.
Location, specifically
Location is optional and off until you allow it. When it is on, your position is recorded at roughly hundred-metre accuracy, and only when it has meaningfully changed or gone stale. Yen keeps your most recent position, not a history of everywhere you have been — a new reading replaces the last one.
Keeping the map live while Yen is closed is a second, separate choice in Settings, and it can be withdrawn there at any time. Turning location off stops the writing immediately; your last position stops being shown to your partner once it goes stale.
What is not encrypted end-to-end
Your photographs, drawings, voice notes, and words are stored on Yen’s servers in private buckets scoped to your couple, so that both phones can reach them. They are not end-to-end encrypted today. That means Yen’s infrastructure could technically access them, and it would be dishonest to imply otherwise. Capsule encryption is planned to return; until it ships, this paragraph is the accurate description.
The recipient gates hold regardless: a capsule half is withheld from a phone until it is opened, and a spark answer until you have written yours. Those are enforced in the database, not by the app being well behaved.
Who else touches it
Yen uses a small number of processors. No one else receives your data, and none of them are permitted to use it for their own purposes.
- Supabase — supabase.com/privacy
- Apple — apple.com/legal/privacy
- RevenueCat — revenuecat.com/privacy
- Vercel — vercel.com/legal/privacy-policy
Why Yen is allowed to hold it
For people in the UK, EEA, and other places with comparable law, the legal bases are: performance of a contract for everything the app needs in order to function at all (your account, your room, your content, your membership), and consent for each optional crossing — location, background location, and listening activity — which you may withdraw in Settings at any time without losing the rest of the app.
How long
Your content stays until you or your partner remove it, or until the room ends. Leaving a room dissolves it for both of you. When the last member leaves, the room and everything inside it are deleted. Deleting your account erases your account, your photographs, and your words.
Deletion is real and immediate in the app’s own database. Encrypted infrastructure backups may retain a copy for a short period before they rotate out; nothing is restored from them except to recover from a failure.
Your rights
- Access and portability — ask for a copy of what Yen holds about you.
- Correction — your name, photograph, birthday, and mood are editable in the app.
- Erasure — Settings → Delete my account, or write to us.
- Withdrawing consent — turn off location or listening activity in Settings.
- Objection and restriction, and the right to complain to your local data protection authority.
Write to us from the email address on your account. Requests are answered within 30 days.
Where it lives
Yen’s database and files are hosted by Supabase, and pushes go through Apple. This means your information may be processed outside the country you live in, under the standard contractual protections those providers offer.
Children
Yen is not for children. You must be at least 13 to use it, and at least 16 in the EEA and UK. If you believe a child has an account, tell us and it will be removed.
Changes
If this policy changes materially, the date at the top changes with it and the app will say so. The in-app privacy notes, under Settings, describe the same behaviour in shorter form; this document is the binding text.