Privacy Policy

As of: 19 October 2026

Unofficial translation. This is a convenience translation. The legally binding version is the German original (datenschutz); in case of any discrepancy, the German version prevails.

1. Controllers

The controllers within the meaning of the Swiss Data Protection Act (FADP) are (simple partnership):

yuKast – Dennis Wilsmann & Mate Kurtin c/o Dennis Wilsmann, Hungerstrasse 58, 8832 Wilen bei Wollerau, Switzerland E-mail: legal@yukast.com

For privacy enquiries: privacy@yukast.com

2. Scope

This policy follows the revised Swiss Federal Act on Data Protection (FADP, in force since 1 September 2023) and the Data Protection Ordinance (DPO). It applies to the yuKast app and to the web pages at yukast.app (e.g. shared contributions, verification pages and event pages).

3. What personal data we process

We process personal data in accordance with the principles of good faith, proportionality, purpose limitation and transparency (Art. 6 FADP). We obtain consent wherever the law or the feature requires it.

3.1 Use without an account

• Scope: you can also view the map, feed, shared contributions, events, booths and the search in event offerings without an account.
• Data: we do not create a profile for this. Only technical connection data arises (see 3.11) and, if you allow it, your location for showing contributions near you (see 3.3).

3.2 Account and authentication

• Data: e-mail address, chosen username, sign-in/session tokens. For sign-in we send you a one-time code or sign-in link by e-mail.
• Claiming a booth without an account: if, as an exhibitor, you claim a booth via code or QR without creating an account, we create an anonymous session without an e-mail address for it.
• Purpose: providing the user account, sign-in/sign-out, attribution of your contributions.
• Processor: Supabase (authentication, e-mail delivery, database), see section 4.

3.3 Location data

• Data: geo-coordinates (latitude/longitude) and time of capture of a contribution; approximate location to show contributions near you. Contributions can only be created with a current, precise GPS location of your device.
• Place name: to give a contribution a place name (e.g. the city), we transmit the contribution's coordinates to the Nominatim service of the OpenStreetMap Foundation (without any user identifier), see section 4/5.
• Purpose: core feature — contributions are geo-located and shown by proximity.
• Consent: you control location sharing via your device permissions and can revoke it there at any time.
• Navigation: if you choose "Navigate to the booth", we open Apple Maps or Google Maps with the booth's position as the destination. The privacy terms of their providers apply to your use of these apps.

3.4 Photo and video uploads

• Data: images/videos you capture or select (including audio track for videos) and associated metadata (e.g. capture source, time of capture, device model).
• Purpose: publishing your contributions.
• Storage and delivery: Amazon Web Services (AWS S3), Frankfurt region (eu-central-1); the media are delivered via the AWS CloudFront content delivery network, see section 4.

3.5 Sharing and authenticity seal

• Data: when you share a contribution, we generate an image or video with a verification code (e.g. YK-XXXX-XXXX). Anyone who checks the code at yukast.app/v/ sees whether the contribution was captured live with the yuKast camera, the place name and the time of capture — never the exact coordinates. If the contribution is deleted or hidden, the verification page no longer shows any details.
• Reach measurement: for each share we record that a share took place (your user identifier, time, channel) and whether the shared link was opened. We do not store IP addresses or device identifiers in doing so.
• Purpose: proof of authenticity of shared content; evaluating how often shared content is opened.

3.6 Events and booths

• Data: for events (e.g. flea markets), we process for exhibitors the booth name, description, photos, offerings/inventory, prices and the booth's position, as well as the assignment of the booth to the account or anonymous session.
• Public: these booth details are visible to everyone in the app and on the event page (yukast.app/e/…), even without an account, and are searchable.
• Purpose: presenting events, booths and offerings; searching for offerings.

3.7 AI-assisted analysis and translation

• Data: every uploaded image/video is analysed automatically. For booth photos we additionally detect offerings and prices and suggest descriptions. Booth offerings and prices are automatically translated into the other app languages. For this we use your device's language setting.
• Purpose: automatic scene description, tagging (search), moderation checks (detection of impermissible content), capture of booth offerings, and translation.
• Recipient: Anthropic (the "Claude" model) — content is transmitted to Anthropic for analysis. Disclosure abroad (USA), see section 5.

3.8 Map display

• Data: when you use the map view in the app, map tiles are loaded from Google (Google thereby processes technical connection data, e.g. IP address). On the event web pages (yukast.app/e/…), your browser loads the background of the site map as an image directly from Google (Google Maps Static API); Google thereby also processes technical connection data such as the IP address. Your search terms and selected booths are not sent to Google.
• Purpose: displaying the map and the surroundings in the site map.
• Recipient: Google (Google Maps), see section 4/5.

3.9 Push notifications

• Data: device push token and the app language (for notifications in your language).
• Purpose: sending notifications (e.g. activity near you), only if you enable push.
• Recipient: Google Firebase Cloud Messaging, see section 4/5.
• Consent: via enabling it; revocable at any time in the settings.

3.10 Error diagnostics and status messages

• Data: technical diagnostic data (error messages, device/app info). For status and outage notices, the app retrieves a configuration from Google Firebase Remote Config (Google thereby processes technical data such as the IP address and an app installation identifier).
• Purpose: stability, troubleshooting and information about outages.
• Recipient: Sentry; Google (Firebase Remote Config), see section 4/5.

3.11 Connection data and abuse protection

• Data: when the app interfaces and the web pages at yukast.app are accessed, technical connection data arises (e.g. IP address, time, requested address, language setting of the browser or device). The web pages at yukast.app are delivered via Cloudflare.
• Purpose: delivering the content, security and protection against abuse. To limit excessive access, we count requests per IP address or per account. These counters are held in working memory only and expire after the respective time window (one hour at most).
• Recipient: Cloudflare, see section 4/5.

4. Disclosure to third parties / processors

We have corresponding contracts for processing on our behalf (Art. 9 FADP) in place with our processors. The OpenStreetMap Foundation is not a processor; we pass only coordinates without any user identifier on to it.

5. Disclosure abroad

Some services process data in the USA or outside Switzerland. Since 15 September 2024 the Federal Council recognises the Swiss–U.S. Data Privacy Framework (Swiss-U.S. DPF): transfers to US companies certified under it enjoy adequate protection. Where a service is not DPF-certified, we base the transfer on the Standard Contractual Clauses (SCC) recognised by the FDPIC (Art. 16 et seq. FADP).

6. Retention

• Account data: for the duration of the account.
• Contributions/media: until deleted by you or by moderation. After deletion, content is first hidden (soft delete) and the associated media files are permanently removed from storage after 30 days.
• Booth details: until the booth or the event is deleted.
• Counters for abuse protection: one hour at most, in working memory only.
• On account deletion, your content is deleted/anonymised and the auth account is removed. Your booths are deleted as well; shares remain in the reach measurement only without your user identifier.

7. Your rights

Under the FADP you have in particular the right to information (Art. 25 FADP), rectification (Art. 32 FADP), deletion or destruction of your personal data, and to data release/portability (Art. 28 FADP). You may withdraw consent-based processing at any time with effect for the future.

You can delete your account directly in the app. For other requests: privacy@yukast.com.

8. Federal Data Protection and Information Commissioner (FDPIC)

You may contact the FDPIC (www.edoeb.admin.ch). You may also assert civil-law claims before the competent courts.

9. Contact

Dennis Wilsmann & Mate Kurtin · legal@yukast.com