Who is responsible for your data
Yealth is a pre-launch product operated by Marco Furio Ferrario (Italy), who is the data controller for the personal data described here.
Contact for anything in this notice, including requests to see or delete your data: [privacy@yealthismore.com — address to be confirmed]. Postal address: [to be completed].
What we collect
Only three things, and nothing else:
Your email address — because it is how you sign in. There is no password.
The habit data you type in yourself — habit names, how often you want to do them, the amount you choose to assign to each one, and which days you marked as done.
Usage analytics — which screens you open and for how long, which onboarding steps you finish or drop out of, when you create or complete a habit, and the platform you use (web, iOS, Android). Each event is tied to a random session identifier and, if you are signed in, to your email address.
What we do NOT collect
Yealth does not move real money. Nothing is ever transferred anywhere. The amounts you see are a personal ledger and a simulation.
We therefore never ask for and never store bank details, IBANs, card numbers or payment credentials. We do not collect your name unless you type it in, we do not collect your address or phone number, we do not use advertising trackers, and we do not sell or share your data with advertisers.
Why we use it, and on what legal basis
Under the GDPR:
Your email address and your habit data are processed to give you the account and the service you asked for — Article 6(1)(b), performance of a contract.
Your email address is also used to send you one recap email a week, summarising what you unlocked and naming the index fund the projection level you chose is modelled on. It is part of the product you signed up for — Article 6(1)(b) — and every one of those emails carries a one-click unsubscribe link that stops them without touching your account or your data.
Usage analytics are processed to find out what works and what does not in a product that is still being designed. If you signed in, this is based on the consent you gave when you ticked the privacy box — Article 6(1)(a), and you can withdraw it at any time by deleting your account. If you only opened the demo without signing in, the events carry no email address and are processed on our legitimate interest in making the demo work and measuring it in aggregate — Article 6(1)(f).
How long we keep it
Sign-in links: 15 minutes, then they stop working. Only a hash is stored, never the link itself.
Sign-in sessions: 90 days, or until you sign out.
Your account and habit data: until you delete your account, or 12 months after your last sign-in during this tester phase — whichever comes first.
Usage analytics: 14 months, then deleted.
Weekly recap: we store the date of the last one sent to you and, if you unsubscribe, the date you did — both disappear when you delete your account.
Who else can see it
Two service providers process data on our behalf, and nobody else:
Hosting: Hetzner Online GmbH (Germany, EU). The server and the database live there.
Email delivery: Resend (Plus Five Five, Inc., United States), used to send your sign-in link and the weekly recap. It receives your email address and the contents of those emails, and processes them under the EU Standard Contractual Clauses.
Your rights
You can ask us to show you the data we hold about you, correct it, or delete it. You can also object to the analytics processing, ask for your data in a portable form, or withdraw your consent.
The fastest route to deletion is in the app: Profile → "Delete my account and data". That immediately and permanently removes your user record and your analytics events from the database — there is no soft delete and no backup copy kept for this purpose.
If you think we have handled your data badly you can complain to the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).
Changes to this notice
This is version 1.1-2026-07-28. When we change it materially we bump the version, and the version you agreed to is recorded with your account.
Items in square brackets are placeholders still to be completed before public launch.