Privacy Notice

At a glance

• Yawa works without an account and without you telling us who you are.
• Forecast requests go through Yawa's own server. Weather providers never see your IP address, only a pair of coordinates.
• Your places, settings and cached forecasts stay on your device.
• Usage statistics and crash reports are off unless you switch them on, and you can switch them off again at any time in Settings → About → Privacy.
• The AI overview is written on your device. On Android, Google's ML Kit reports to Google how the feature performs — never the forecast or the text, and nothing at all once you switch the overview off.
• Nothing is sold. The app uses nothing for advertising; the website's ad-conversion tag runs only if you accept it.

Who is responsible

Dario Digregorio Apps Kirchbachstr. 28 83024 Rosenheim Germany

Email: info@dario-digregorio.de

Yawa is a small independent project, not a company with a data protection officer. Write to the address above with any question about this notice, and see the Imprint for the remaining provider details.

Forecasts and your location

To show weather for a place, the app sends to the Yawa server: the coordinates of that place, your language, unit preferences, the place's time zone and country, and — unavoidably, as with any internet request — your IP address. The server asks the weather provider you selected and returns the forecast.

• Coordinates and forecasts are not stored on the server. The server keeps them only in memory for the length of the request.
• Weather and map providers receive the coordinates from the Yawa server, never from your device, so they do not see your IP address or any identifier of yours.
• The app normally asks for location access while you use it. Current-location home screen widgets can optionally use background location access (“Always” on iOS, “Allow all the time” on Android) to check where you are during a background refresh. Saved-place widgets do not need this access. Yawa requests one location fix per refresh and stops listening afterwards; it does not continuously track your movements. You can revoke location access in your device settings or choose a saved place instead.
• Location accuracy is requested at a medium level, which is enough for local weather and less precise than the maximum the device could provide.

Legal basis: Art. 6(1)(b) GDPR — processing necessary to provide the service you asked for.

Searching for places

When you search for a place by name, that search text is forwarded through the Yawa server to OpenWeatherMap's geocoding service to turn it into coordinates. Searches are not stored.

Legal basis: Art. 6(1)(b) GDPR.

Your anonymous account

On first launch the app creates an anonymous Firebase account. It is a random identifier; it contains no name, email address or device identifier and is not linked to you as a person. Yawa uses it to attach a Pro subscription to your installation and to restore it after a reinstall.

Legal basis: Art. 6(1)(b) GDPR.

Optional sign-in

You can upgrade the anonymous account by signing in with Apple or Google, so Pro follows you to another device. Yawa then also receives the name, email address and, with Google, the profile picture connected to that sign-in; they are shown only on your account screen, and the picture is loaded from Google's servers. Apple's "Hide My Email" is supported by Apple's own mechanism; Yawa never sees more than the sign-in provider passes on.

Legal basis: Art. 6(1)(b) GDPR.

Purchases and Pro

Yawa Pro is bought and billed by the App Store or Google Play. Yawa never sees your payment details.

Purchases are managed through RevenueCat, which receives your anonymous account identifier as a customer identifier, the purchase receipt from the store, and basic device and country information. When the app needs to confirm that a subscription is genuinely active, the Yawa server checks the entitlement with RevenueCat using that identifier; the result is cached in the server's memory for a few minutes and never written to disk.

Legal basis: Art. 6(1)(b) GDPR.

Usage statistics, crash reports and performance data

If — and only if — you switch on usage statistics, the app uses Firebase Analytics, Firebase Crashlytics and Firebase Performance Monitoring. They collect:

• which screens you open and a small number of events, such as adding a place, opening the radar, or seeing the Pro offer;
• your anonymous account identifier, app version, flavour, device language and whether you have Pro;
• crash reports with the stack trace, device model, operating system version and the app's technical log messages leading up to the crash;
• timings for app start and network requests.

Technical log messages are written so that they contain no place names, coordinates, search terms or user identifiers.

This setting is off by default. You choose it during onboarding and can change it at any time in Settings → About → Privacy → Usage statistics. Switching it off stops any further collection and tells Firebase to clear the analytics data associated with your installation.

Legal basis: Art. 6(1)(a) GDPR — your consent, which you may withdraw at any time with effect for the future.

Protecting the server from abuse

Every request to the Yawa server carries a Firebase App Check token, issued by Play Integrity on Android and App Attest on iOS. It certifies that the request comes from a genuine, unmodified copy of Yawa. The token is not a user identifier.

Yawa also uses Firebase Remote Config to switch features on and off without an app update; the app fetches a small configuration file and sends its App Check token and app version in doing so.

Legal basis: Art. 6(1)(f) GDPR — the legitimate interest in keeping a free, rate-limited weather service from being drained by automated abuse, and in being able to disable a broken feature quickly.

Home screen widgets and background refresh

Widgets read a small pre-rendered payload from a storage area shared between the app and the widget on your device. The app schedules background refreshes about once an hour; the operating system determines when they actually run. Free widgets refresh the last viewed place, while Pro widgets can refresh other places too. Saved places use their stored coordinates. For your current location, a refresh checks a fresh device location only if you have granted background access. Those coordinates are sent through the Yawa server for place lookup and weather retrieval, as described above. If access is missing or the location cannot be confirmed, the widget shows a message instead of silently displaying weather for an old city.

AI overview

Where your device has a built-in AI model, Yawa uses it to write the overview of your forecast right on the device: Apple Intelligence on iPhone and iPad, Gemini Nano on Android. The forecast figures the model is given and the text it writes stay on your device; Yawa sends them nowhere.

On Android, Yawa reaches Gemini Nano through Google's ML Kit. ML Kit does not send the forecast or the overview to Google either. But whenever Yawa checks whether your phone supports the feature, downloads the model or writes an overview, ML Kit sends Google metrics about how the feature performs:

• device model, Android version and the AI hardware available;
• Yawa's package name and version;
• an identifier for this installation, which is not meant to identify you or your device;
• timings, events such as a model download, error codes, and the language in use.

Google uses them to measure performance, fix errors, maintain and improve ML Kit and detect misuse, as described in Google's Privacy Policy. They are encrypted in transit and not passed on to third parties.

Overviews are saved on your device with the forecast they describe and deleted along with it. Switching the AI overview off in Settings → AI enhancements stops all of this: Yawa then does not use the model at all, not even to check whether it is there.

Legal basis: Art. 6(1)(f) GDPR — the legitimate interest in offering a written overview that is created on your device.

What stays on your device

• Your saved places, including their coordinates and names
• Cached forecasts (so the app works offline and does not re-fetch needlessly)
• Overviews written by your device's AI
• Settings: units, theme, dashboard layout, language, weather source, your privacy choice
• Map and radar tile caches
• The widget payload in the shared app group

None of this is transmitted to Yawa. Deleting the app removes all of it.

The website yetanotherweather.app

Firebase Hosting serves this site and records standard server log data (IP address, time, requested page, referrer, user agent) for security and troubleshooting.

Fonts, icons and scripts come from this site itself. While you browse, your browser contacts no other server, with one exception: the Google Ads tag described below, and only after you accept it.

The sky on the home page is drawn in your browser from a sample forecast; the site never asks for your location. The store ratings shown on the home page are copied into the page when it is built, so viewing them contacts neither Apple nor Google.

Google Ads conversion tag. Only if you accept the cookie banner on the home page does the site load Google's ads tag from Google's servers. It then counts visits to the App Store and Google Play that start on this site and may set advertising cookies (such as _gcl_au); Google processes your IP address and browser data for this. Accepting allows conversion measurement only: ad personalisation and analytics stay off. Until you accept, the tag is not loaded at all and nothing is sent to Google. You can withdraw at any time under Cookie settings at the bottom of every page; the tag then stops measuring and its cookies on this site are deleted.

Links to Google Play carry a campaign label (utm_source=yetanotherweather.app) so Google Play can count installs that came from this site. It does not identify you.

Your cookie choice and your light or dark theme are kept in your browser's local storage and never sent anywhere. Clearing the site's data resets them. After you accept, the ads tag may also keep an entry there (_gcl_ls); withdrawing deletes the tag's cookies and that entry.

Legal basis: Art. 6(1)(f) GDPR for the secure operation of the site; Art. 6(1)(a) GDPR and § 25(1) TDDDG for the conversion tag.

Who receives data

Weather, radar and map providers receive coordinates from the Yawa server, so they see the server's IP address, not yours.

Transfers outside the EU

The Yawa server runs on Google Cloud Run in the United States (region us-central1), and several of the recipients above are based in the United States. Transfers are covered by the EU–US Data Privacy Framework where the recipient is certified, and otherwise by the European Commission's Standard Contractual Clauses. US authorities may have access rights that do not match the European standard; this residual risk cannot be fully excluded.

How long data is kept

• Forecast and search requests: not stored — held only for the duration of the request
• Server logs: warnings and errors only, retained by Google Cloud Logging for 30 days
• Crash reports: up to 90 days at Firebase Crashlytics
• Usage statistics: according to the retention period set in Firebase Analytics, and deleted on request
• Account and subscription data: until you delete the account or the subscription record is deleted on request

Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection under Art. 15–21 GDPR, and the right to withdraw consent at any time with effect for the future (the switch in Settings → About → Privacy; for the website's conversion tag, Cookie settings at the bottom of every page).

To help locate analytics or subscription data, include the identifier shown in Settings → Account if you have it. If you cannot access the app or find the identifier, you can still make a request by email; see Support.

You may also lodge a complaint with a supervisory authority. The competent one here is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 27, 91522 Ansbach, Germany.

Deleting your data

• Email info@dario-digregorio.de to request deletion of your Yawa account and associated data, or of particular data without deleting the account. Support explains what to include; you do not need to reinstall the app to make a request.
• After verification, the request covers the Firebase account and sign-in data, associated RevenueCat subscription records and usage statistics, including deletion requests to service providers. Any billing, tax or security records that must be retained to meet legal obligations will be identified in the reply, with their retention explained. Apple and Google handle their own account and purchase records under their privacy policies.
• This does not clear places, settings and caches stored on your device; remove the app to clear those.
• Deleting your account does not cancel a subscription. Cancel it separately in your App Store or Google Play account settings to stop future renewal charges.

Children

Yawa is not directed at children under 16, and no data is knowingly collected from them. If you believe a child has provided personal data, write to the address above and it will be deleted.

Changes to this notice

This notice is updated when the app changes. The current version always lives at this address, and material changes are mentioned in the app's What's New page.

Effective: 12 October 2026.

This notice exists in German and English. In case of discrepancies the German version prevails; this does not affect mandatory provisions of the law of your country of residence.