Privacy Policy

The controller under the EU General Data Protection Regulation (GDPR) is Cengiz Gürtusgil, Angelika Machinek Straße 20, 60486 Frankfurt, Germany, email hi@cengizg.com. Personal data is any information that identifies you, such as your name, your email address or your IP address.

yukiwriter.com is a static website served by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. To deliver a page, your browser sends the usual request data: your IP address, the page asked for, date and time, the referring page, and your browser and operating system. Cloudflare uses this data to deliver the site and to protect it against attacks, and may keep it in its logs for a short time. We do not use it to identify you.

The legal basis is our legitimate interest in a site that is fast, available and secure (Art. 6(1)(f) GDPR). We have a data processing agreement with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework, which the European Commission has found to ensure an adequate level of protection.

From the same request data, Cloudflare compiles traffic statistics for us, such as page views, countries and error rates. We see only these totals, never individual visitors. If a page fails to load, your browser may send a short error report (Network Error Logging) to Cloudflare so that faults in the network can be found.

The website sets no cookies and loads no analytics or tracking scripts, pixels, advertising or social media plugins. Fonts and images are served from yukiwriter.com itself, so no other party learns that you visited. The connection is encrypted with TLS (https).

The download and the app's updates come from releases.yukiwriter.com, a file store run by Cloudflare. An installed copy asks this host for the latest version shortly after it opens and then once an hour. The request carries only what every web request carries, such as your IP address. It contains no account, license, device ID or anything you wrote. The legal basis is our legitimate interest in keeping installed copies secure and up to date (Art. 6(1)(f) GDPR).

“Buy” sends you to a checkout page of Stripe. Yuki Writer is sold through Stripe Managed Payments: the purchase is “sold through Link”, Stripe's checkout service, which is the seller of record. Stripe takes the payment, collects and pays VAT and sales tax, sends receipts and invoices, and handles refunds and disputes; in the EU, payments are processed by Stripe Technology Europe, Limited, Dublin, Ireland. Stripe and Link process your payment data (such as name, email, billing address and payment details) under their own privacy policies at stripe.com/privacy and link.com/privacy. You can manage your order and ask Link to delete your purchase data at link.com. We never see your card details. Stripe is certified under the EU-US Data Privacy Framework.

When your payment succeeds, Stripe tells our license server (api.yukiwriter.com, a Cloudflare Worker) about it. The server reads the checkout session back from Stripe, creates your license key and stores your email address, the key, the Stripe checkout session ID and the time of purchase in a database kept in the EU. Your email address is part of the key, so the key shows whose license it is. We keep this record so we can send you your key again if you lose it.

The server then emails you the key from license@yukiwriter.com, sent through Cloudflare's email service. The page Stripe sends you to after paying shows the same key. To stop abuse of that page, the server counts requests per IP address for one minute; it does not store the address.

The legal basis is the performance of the purchase contract (Art. 6(1)(b) GDPR). The license server keeps technical logs of its requests and errors for seven days, to find and fix faults (Art. 6(1)(f) GDPR).

Yuki Writer has no account and sends no usage statistics or crash reports. Your documents, settings and license key stay on your Mac. The license is checked on the Mac, without asking our server.

“Fix it for me” has a model rewrite one sentence. Under Settings → Editing model you choose which one:

• Apple's on-device model (the default on a Mac with Apple Intelligence): the text never leaves your Mac.
• A downloaded model: the app downloads the model file once from Hugging Face, Inc., 20 Jay St., Brooklyn, NY 11201, USA. Hugging Face receives the usual request data, such as your IP address, under its privacy policy. After that, the model runs on your Mac and the text never leaves it.
• OpenAI, with your own API key: when you click “Fix it for me”, the app sends the sentence, its paragraph, the issue found and any suggestions you turned down directly to OpenAI. This happens under your own account and contract with OpenAI and its privacy policy, not through us; we never receive the text or your key. The app asks OpenAI not to store the request for later retrieval. Your key is kept in the macOS Keychain.

If you email us, for example at support@yukiwriter.com, we process your address and message to answer you. Mail to support@yukiwriter.com is forwarded by Cloudflare to a mailbox hosted by Google; Google LLC is certified under the EU-US Data Privacy Framework. The legal basis is our legitimate interest in answering you, or the contract if your message is about a purchase (Art. 6(1)(f) and (b) GDPR). We delete the correspondence once the matter is settled, unless the law requires us to keep it.

We send no newsletters or advertising emails.

We keep personal data only as long as the purpose needs it. The license record stays for as long as the license can be used, so a lost key can be sent again; you can ask us to delete it at any time, and the key keeps working. Where tax or commercial law requires us to keep records, we keep them for the period it sets and then delete them. Stripe keeps payment records under its own obligations as seller.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to withdraw a consent with effect for the future (Art. 7(3)). To use them, write to the address in section 1.

Right to object (Art. 21 GDPR): where we process your data on the basis of our legitimate interests, you may object at any time on grounds relating to your particular situation. We then stop, unless we can show compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims.

You may also complain to a data protection supervisory authority (Art. 77 GDPR), for example the one where you live or the one responsible for us: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.