Effective date: 25 September 2026
This Privacy Policy explains what information Serena collects, why, and how you can reach us about it.
The Serena application (the “App”), available on the Apple App Store and Google Play, is owned and operated by Jonas Hiltl (“we,” “us,” or “our”). This Privacy Policy applies to everyone who uses the App, on iOS and on Android.
Serena is built to need as little of your data as possible. There is no account and nothing to sign up for.
| Data type | Purpose | Where it is kept | Shared with third parties? |
|---|---|---|---|
| Urge logs (time, outcome, cause, spot), notes, check-ins, history | Progress analytics, streaks and personalised recommendations inside the App | On your device only (local sqlite database) | No |
| Onboarding answers | Personalise your experience | On your device only | No |
| Skin scans (photos) | Analyse skin condition and track healing progress | Transmitted securely for AI analysis; not stored afterwards; results sent back to your device | Google (AI analysis) via our backend, see section 5 |
| In-app settings (notification times, theme, AI-analysis consent) | Personalise your experience | On your device only | No |
| Usage analytics (which features you use, how far you get in onboarding, errors and crashes) | Understand how the App is used so we can improve it | PostHog, on servers in the European Union | PostHog, our analytics provider |
| Subscription status (whether premium is active) | Unlock premium features | RevenueCat, plus Apple or Google depending on your device | RevenueCat, Apple, Google |
| Crash reports (uncaught errors) | Diagnose and fix bugs | PostHog (EU); on iOS additionally Apple if you opted into “Share With App Developers” | PostHog; Apple (aggregated, never linked to your identity) |
| Support e-mails you send to us | Respond to enquiries | Our e-mail inbox | No—unless required for legal reasons |
The App does not ask you to create an account. It does not collect your name, e-mail address, advertising identifier (IDFA on iOS, ad ID on Android), or precise location. Usage analytics are linked to a random identifier generated on your device, not to you personally. We show no advertising and belong to no advertising network.
Urge logs you enter may reveal mental-health–related information (dermatillomania behaviour). Your entries, notes and history stay entirely on your device unless you export them. When you create an export file, it is saved locally and you choose how and with whom to share it (e.g. physician, therapist, cloud drive, e-mail).
The usage analytics described in section 1 include the fact that you logged an urge and the options you picked, but never your notes, your history or your skin-scan photos. If you would rather we did not collect analytics from you at all, e-mail contact@krimi.ai and we will exclude you.
We do not use your data for advertising or marketing, we do not sell it, and we do not build advertising profiles. Analytics are only ever read in aggregate.
This applies only to the iOS version. If you installed the App after tapping a Serena advert in the App Store, Apple gives us a token telling us which campaign led to the install, and we pass it to RevenueCat.
This tells us where an install came from. It does not identify you, it does not use Apple’s advertising identifier (IDFA), and it does not follow you across other apps or websites, which is why the App never asks for tracking permission. If you did not arrive from an advert, there is nothing to report and nothing is sent. The Android version does not collect advertising attribution and does not use the Android advertising ID.
Beyond these providers, acting only on our instructions, we disclose data only if you explicitly export and send it yourself, or if we are required to do so by law (rare, and only after verifying the request).
Where the GDPR or UK GDPR applies, we process the data described above under:
Local data lives until you remove it: you can erase everything at any time by deleting the App or using Settings → Erase All Data inside the App. That also stops any further analytics being collected; to have analytics we already collected deleted, e-mail us.
Purchase and subscription records are retained by RevenueCat and by Apple or Google under their own retention rules, including any period required for tax and accounting purposes. Analytics events are held by PostHog under its own retention rules and are tied to your random analytics identifier, not to your identity; reinstalling the App creates a new one.
Our PostHog analytics data is stored in the European Union. RevenueCat processes data in the United States, and our backend runs on Cloudflare’s global network. Apple and Google process payment data under their own policies. Where personal data is transferred outside the EU/EEA/UK, we rely on our providers’ Standard Contractual Clauses and other appropriate safeguards.
To exercise additional rights or ask questions, e-mail us at contact@krimi.ai.
The App does not use advertising trackers, does not belong to an advertising network, and does not follow you across other apps or websites, which is why it never asks for tracking permission. It uses first-party product analytics and error reports as described in section 1.
This website sets no advertising or analytics cookies.
Serena is intended for users aged 13 and older. We do not knowingly collect data from children under 13. If you believe a child has provided data, please contact us and we will delete it.
If we change how we handle personal information, we will update this document and display an in-app notice on the first launch after the change. The “Effective date” at the top will always show the latest version.
For privacy questions, requests or concerns, please write to:
Jonas Hiltl
E-mail: contact@krimi.ai
By installing or using Serena, you acknowledge that you have read and understood this Privacy Policy.