Your routines stay on your iPhone.

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) for this website and the Not Yet app is:

Lars Keggenhoff
c/o Buerogemeinschaft EG
Widdersdorfer Straße 217A
50825 Köln
Germany
Email: info@not-yet.app

See also the imprint.

2. This website, its host and visit counts

This website is a set of static pages hosted on GitHub Pages, a service of GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA.

When you open a page, your browser sends technical data that GitHub needs to deliver it and to keep the service secure: your IP address, date and time, the page requested, the referring page and your browser and operating system. GitHub stores this in server logs. We have no access to these logs and receive no visitor statistics from GitHub. GitHub may process this data in the USA. GitHub, Inc. is certified under the EU-U.S. Data Privacy Framework. Details: GitHub General Privacy Statement.

Legal basis is our legitimate interest in delivering a secure website (Art. 6(1)(f) GDPR).

This website sets no cookies and loads nothing from other companies: fonts, images, styles and scripts come from not-yet.app itself, the visit counter from our own subdomain a.not-yet.app (see below). There are no forms, embedded videos, maps or social media buttons. If you switch to dark mode or pick a language, your browser remembers that choice in its local storage on your device; it is never sent anywhere.

Visit counts with Umami

We count visits to this website with Umami, an open-source analytics tool, on an instance we run ourselves at a.not-yet.app. The server is hosted by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, in a data centre in Nuremberg. No analytics company or ad network is involved, and the data is not passed on, not sold and not combined with other data.

Per visit, Umami records the page, the referring page, the browser, the operating system, the device type and the country, which it derives from your IP address. The IP address itself is not stored. We also count clicks on the TestFlight invite links, the language menu and the dark mode switch. On NFC tag pages only /t/ is counted, never the tag ID.

Umami sets no cookies, builds no profiles and doesn’t follow you to other websites. We only see totals, which can’t be traced back to you.

Legal basis is our legitimate interest in knowing how the website is used, so we can improve it (Art. 6(1)(f) GDPR).

Don’t want to be counted? Turn the switch below off. Your browser then stores umami.disabled in its local storage, and the counting script isn’t even loaded. A content blocker has the same effect; nothing on this website depends on it.

Count my visits on this website

The app itself has no analytics and sends nothing to us. The visit counter is for this website only and has no connection to the app.

3. Email and beta invites

If you email us, for example at info@not-yet.app, we use your email address, your name if you give it and your message only to answer you. Emails to this address are stored in our mailbox at Infomaniak Network SA in Geneva, Switzerland. The EU Commission has issued an adequacy decision for Switzerland.

You can join the beta directly through our public TestFlight link. That happens between you and Apple, and Apple’s TestFlight terms and privacy policy apply. In App Store Connect we see only the tester details Apple shows us; for people who join through the public link, that usually doesn’t include an email address. If you write to us instead, for example because the beta is full, we use your email address only to answer you and to invite you. For an invite by email, we enter your address, and your name if you gave it, in App Store Connect, and Apple sends you the TestFlight invite.

Legal basis is your request (Art. 6(1)(b) GDPR) and our legitimate interest in answering messages (Art. 6(1)(f) GDPR). We delete emails when they are no longer needed, and at any time on request. You can leave the beta at any time in the TestFlight app; on request we remove you as a tester.

4. The app: what stays on your devices

Not Yet works without an account. Everything you create or change in the app, such as routines, runs, to-dos, alarms, water, coins, rewards, NFC tag links, lock settings and the websites you add to the filter, is stored on your iPhone. The app shares it only with its own widgets, Live Activities, system extensions and your paired Apple Watch.

The app has no server and sends none of this data to us or to anyone else. It contains no analytics, advertising or tracking tools and no third-party code that sends data. It works fully offline.

If you back up your iPhone to iCloud or to a computer, iOS includes the app’s data in that backup, under Apple’s terms and in your own account. That is how your routines move to a new iPhone. We have no access to your iCloud. Deleting the app deletes its data from your iPhone.

5. Apple Watch

The Not Yet app on Apple Watch gets your plan for the day directly from your iPhone through Apple’s WatchConnectivity, and sends your taps back the same way. No server is involved, and nothing reaches us.

6. Permissions

Each permission is optional. The app asks only when you use the feature, and you can change your choice at any time in the iOS Settings app.

Notifications and Live Activities

Reminders for routines, sidequests and water are scheduled locally on your iPhone. They are not sent through a server. Live Activities on your Lock Screen are updated on the device.

Alarms

Alarms use Apple’s AlarmKit so they ring even in silent mode. They are scheduled on your iPhone.

Motion and Fitness

If an alarm task asks you to walk a few steps or shake your iPhone, the app reads the step count and motion sensors on the device, only while that task is open. Nothing is stored or sent.

Apple Health (Walking and Water)

Not Yet uses Apple Health only if you turn it on, and asks for permission only then. With Walking, the app reads today's step count to give you coins for it. With “Sync with Apple Health” under Water, the app writes every glass you log to Health as water and reads today's water from Health, so glasses from other apps count too. Not Yet reads or writes no other health data. This data stays on your iPhone and in Health, is never sent to us and is never used for advertising. You can withdraw the permission at any time in the Health app.

Calendar

If you allow calendar access, Not Yet reads only the calendars you pick in the app: for birthday to-dos and to end a sidequest before your next appointment. It reads them on your iPhone, doesn’t change them and doesn’t copy them anywhere.

Screen Time: Focus lock, Bedtime lock and Adult sites

The locks and the filter for adult websites use Apple’s Screen Time interface (Family Controls). The apps you choose are stored by iOS as opaque tokens on your iPhone. Not Yet can’t see which apps they are, and no usage data leaves your device. The filter for adult websites is Apple’s own filter, applied by iOS on your iPhone; the websites you add yourself are stored only there.

NFC tags

An NFC tag written by Not Yet contains only a link with a random ID, like https://not-yet.app/t/7xk2ab9pqd. Which routine a tag starts is stored only in the app on your iPhone. If a phone without the app scans the tag, it opens that page on this website; the ID says nothing about you, and the visit counter doesn’t record it.

So that such links can open the app, iOS checks a small file from this website through Apple’s servers (Associated Domains). That exchange happens between your iPhone and Apple.

7. Sharing from the app

Run cards are images the app creates on your iPhone. They are only shared when you share them yourself through the iOS share sheet, with the app or person you choose. The same goes for the alarm log, a hidden diagnostic list you can share as text if we ask for it to fix an alarm problem.

8. In-app purchases (Not Yet Plus)

You buy Not Yet Plus in the App Store. Apple handles the purchase, the payment and any subscription renewals. We receive no payment data, no name and no Apple ID. Offer codes and gift codes are redeemed through Apple too.

To know whether Plus is active, the app checks the purchase information that Apple provides through StoreKit on your iPhone. That check happens on the device. The app sends nothing about it to us, and there is no server of ours that could store it. In App Store Connect, Apple shows us only sales figures that don’t identify you.

You manage or cancel a subscription in your Apple Account settings. If you share Plus through Family Sharing, Apple handles that as well. For the payment itself, Apple’s privacy policy applies.

9. TestFlight beta

During the beta, Not Yet is installed through Apple’s TestFlight. If you send feedback or screenshots in TestFlight, or if the app crashes and you have allowed it, Apple passes this to us in App Store Connect together with technical data such as device model, iOS version and app version. We use it only to fix problems. Legal basis is our legitimate interest in a working app (Art. 6(1)(f) GDPR). Apple’s own processing is covered by Apple’s privacy policy.

10. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). To use them, email info@not-yet.app. Since the app keeps your data only on your devices and in your own iCloud backup, the only personal data we hold are the emails you send us and, during the beta, your tester entry in App Store Connect. The visit counts on this website can’t be linked to you.

You can also complain to a data protection supervisory authority.

We update this policy when the app or the website changes. The date at the top shows the current version.