Privacy Policy

Effective date: 16 September 2026

1. Who we are

Serena (“the App”) is published by Jonas Hiltl.

2. Scope of this policy

This policy explains what information the App collects, how that information is stored and used, and the choices you have. It applies only to the iOS version of Serena and not to any other websites, services or applications.

3. What information the App collects

Data type	Purpose	Where it is kept	Shared with third parties?
Urge logs (time, outcome, cause, spot)	Enable progress analytics and streak tracking	On your device only (local sqlite database)	No
Onboarding Answers (selected answers)	Personalise user experience	On your device only (local sqlite database)	No
Skin Scans (photos)	Analyze skin condition and track healing progress	Temporarily uploaded securely for AI analysis; not stored; results sent back to device	Google; Images are securely sent to Google AI services for analysis. See Google Privacy Policy.
In-app settings (notification times, theme)	Personalise user experience	On device	No
Usage analytics (which features you use, how far you get in onboarding, errors and crashes)	Understand how the App is used so we can improve it	PostHog, on servers in the European Union	PostHog, our analytics provider
Diagnostic crash logs (optional, via Apple’s opt-in “Share With App Developers”)	Improve stability	Apple aggregated console	Apple; never linked to your identity
Support e-mails you send to us	Respond to enquiries	Our e-mail inbox	No—unless required for legal reasons

The App does not ask you to create an account. It does not collect your name, e-mail address, health records, advertising identifier, or precise GPS coordinates. Usage analytics are linked to a random identifier generated on your device, not to you personally, and we show no advertising.

4. Health data

Urge logs you enter may reveal mental-health–related information (dermatillomania behaviour). Your entries, your notes and your history stay entirely on your device unless you export them. When you create an export file, it is saved locally and you choose how and with whom to share it (e.g. physician, therapist, cloud drive, e-mail).

The usage analytics described in section 3 include the fact that you logged an urge and the options you picked, but never your notes, your history or your skin-scan photos. If you would rather we did not collect analytics from you at all, e-mail contact@krimi.ai and we will exclude you.

5. How the information is used

Display streak counters, charts and personalised recommendations inside the App.
Maintain your chosen settings between sessions.
Understand, in aggregate, how people use the App so we can improve it.
Diagnose crashes and errors.

We do not use your data for advertising or marketing, we do not sell it, and we do not build advertising profiles. Analytics are only ever read in aggregate.

We do not sell or rent your data. The only parties who see any of it are the service providers we use to run the App, who act only on our instructions:

PostHog — usage analytics, stored in the European Union.
Google — AI analysis of skin-scan photos, as described in section 3.
RevenueCat and Apple — subscriptions and payments.

Beyond that, we will disclose data only if:

You explicitly export and send it yourself;
We are required to do so by law (rare, and only after verifying the request).

7. Data storage and security

All personal data are kept in an encrypted container on your iPhone/iPad, protected by Apple’s file-system encryption.
Your urge logs, notes, settings and scans are never uploaded to our servers. The usage analytics described in section 3 are sent securely to PostHog and kept for up to 12 months.
You can erase everything at any time by deleting the App or using Settings → Erase All Data inside the App. That also stops any further analytics being collected; to have analytics we already collected deleted, e-mail us.

Access – export your urge log at any time.
Deletion – delete the App or tap “Erase All Data” to remove all information immediately; e-mail us to have your analytics deleted too.
Correction – edit or delete individual entries inside the App.
Objection & restriction – we do no marketing or advertising profiling at all. You can object to analytics at any time by e-mailing contact@krimi.ai, and we will exclude you.

To exercise additional rights or ask questions, e-mail us at contact@krimi.ai.

9. Children’s privacy

Serena is intended for users aged 13 and older. We do not knowingly collect data from children under 13. If you believe a child has provided data, please contact us and we will delete it.

10. Changes to this policy

If we change how we handle personal information, we will update this document and display an in-app notice on the first launch after the change. The “Effective date” at the top will always show the latest version.

11. Contact

For privacy questions, requests or concerns, please write to:

Jonas Hiltl

E-mail: contact@krimi.ai

By installing or using Serena, you acknowledge that you have read and understood this Privacy Policy.