Privacy policy

Last updated: 3 October 2026

This policy explains what personal data the GYST app and its server (gyst.schnaq.com) process, why, on what legal basis, who else receives it, how long it is kept, and what rights you have under the General Data Protection Regulation (GDPR).

1. Who is responsible

The controller within the meaning of Art. 4(7) GDPR is:

Write to that address about anything in this policy, including to exercise your rights (section 8).

2. In short

• We process what is needed to run your account and your household: your email address, your name, and what you and your household enter in the app.
• Other members of your household see your name and what you do in the household. They never see your email address.
• There is no advertising, no analytics and no tracking in the app, and we do not sell data.
• Crash reports and push notifications are optional, off until you turn them on, and can be turned off again in the app.
• You can download your data and delete your account yourself, in the app, under Profile.
• Children under 16 get an account from a parent or legal guardian, without an email address or password (section 9).

3. What we process, why, and on what basis

3.1 Your account

When you register we store your email address, the name you give, your password — only as a one-way hash (bcrypt), never readable — and when the account was created and last used. We use them to sign you in and to show your name to your household.

Legal basis: performance of the contract of using GYST, Art. 6(1)(b) GDPR. Without an email address and password there is no account.

To confirm that the email address is yours, and to let you choose a new password if you forget yours, we email you a six-digit code that you enter in the app. We store the code only as a keyed hash, and when you confirmed your address. The emails are sent through Brevo (section 5); they contain your name, the code and links to this policy and the imprint, and no tracking images. Legal basis: Art. 6(1)(b) GDPR.

To create an account yourself you must be 16 or older (section 9). The app asks for your date of birth to check this; the date stays on your device and is not sent to us. We store only that you confirmed being 16 or older, and when. Legal basis: our legitimate interest in being able to show that we did not open an account for a child without a parent's or guardian's consent, Art. 6(1)(f) GDPR.

3.2 Your household

GYST stores what you and the other members enter: households and who belongs to them (and who is a taskmaster), tasks (title, description, points, schedule, colour, who is assigned), completions (who logged a task, who earned the points, when, and how many points), rewards, redemptions and whether a reward was handed over, invite codes, and the household's join password (as a hash).

Members of a household see each other's names, completions, points, rankings and redemptions — that is the purpose of the app. Email addresses are only ever shown to their owner.

Legal basis: Art. 6(1)(b) GDPR. Where you enter information about other people (for example, a task naming a child), you are responsible for being allowed to.

3.3 Staying signed in

After sign-in the app keeps a short-lived access token (one hour) and a refresh token (30 days) in the secure storage of your device. The server stores the refresh token only as a hash, one per device.

Legal basis: Art. 6(1)(b) GDPR; storing them on your device is strictly necessary for the service you asked for (§ 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG).

3.4 Server logs and abuse protection

Every request to the server is logged with its time, method, path, response status, a request ID, your IP address and your device's user agent. The IP address is also counted, in memory only, to limit repeated sign-in, registration and household-join attempts.

Purpose: running the service securely, finding faults and stopping brute-force attacks. Legal basis: our legitimate interest in a secure and working service, Art. 6(1)(f) GDPR.

3.5 Server error reports

When the server itself hits an unexpected error, it sends a report to our error-tracking service (Sentry, section 5): the error, where in the code it happened, and technical details of the request that caused it (such as method, path and user agent). Passwords, tokens and request contents are removed before sending; cookies and IP addresses are not attached.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in fixing faults.

3.6 App crash reports (optional)

The app asks once, after you sign in, whether it may send crash reports. Nothing is sent unless you agree. A report contains the error, the app version and technical device details (model, operating system), and a random identifier for the installation that is reset if you reinstall. It never contains your tasks, rewards, names, email address or messages; a failed request is reported by method, path and status only, never with its contents.

Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw it at any time under Profile → Privacy → “Send crash reports”; that stops further reports straight away. It does not delete reports already sent — ask us to (section 1).

3.7 Push notifications (optional)

The app asks once whether it may send notifications, for example when a task is assigned to you. Only if you agree does your device obtain a push token from Google Firebase Cloud Messaging; we store that token with the device's platform and language. Each notification's text — a member's name and a task or reward title — passes through Google and, on iPhones, Apple to reach your device, and is shown on your lock screen.

Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can turn notifications off under Profile → Notifications or in your phone's settings. Logging out removes the device's token.

3.8 Settings on your device

The app stores your answers to the two questions above and similar settings on your device. That is strictly necessary to remember your choice (§ 25(2) no. 2 TDDDG).

3.9 Contacting us

If you write to us, we use your message and address to answer it. Legal basis: Art. 6(1)(b) GDPR where it concerns your account, otherwise Art. 6(1)(f) GDPR.

3.10 This website

These pages set no cookies, load nothing from other servers and contain no scripts. Requests for them are logged like any other (section 3.4).

4. What we do not do

No advertising, no analytics or tracking tools, no selling or renting of data, no profiling, and no automated decisions that have legal or similarly significant effects on you (Art. 22 GDPR). The leaderboard only adds up the points your household awarded.

5. Who receives data

We use the following service providers, bound by data processing agreements (Art. 28 GDPR):

Beyond these, data goes to the other members of your household as described in section 3.2, and to authorities only where we are legally obliged to disclose it.

Transfers outside the EU

Some of these providers are based in the USA or may access data from there. Transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR) for providers certified under it, and otherwise on the EU standard contractual clauses (Art. 46(2)(c) GDPR).

6. How long we keep data

7. Security

All connections are encrypted (TLS). Passwords, join passwords and refresh tokens are stored only as hashes, sign-in attempts are rate-limited, and backups are encrypted and kept in a private bucket.

8. Your rights

You have the right to:

• access your data (Art. 15 GDPR) and receive it in a portable format (Art. 20) — in the app under Profile → “Download my data”;
• have incorrect data corrected (Art. 16);
• have your data erased (Art. 17) — in the app under Profile → “Delete account”;
• restrict processing (Art. 18);
• object to processing based on our legitimate interests (Art. 21), on grounds relating to your particular situation;
• withdraw consent at any time with effect for the future (Art. 7(3)) — crash reports under Profile → Privacy, notifications under Profile → Notifications;
• lodge a complaint with a data protection supervisory authority (Art. 77), for example the one where you live or the one responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Postfach 20 04 44, 40102 Düsseldorf, Germany, phone +49 211 38424-0.

For anything the app does not offer directly, write to us (section 1).

9. Children

GYST is made for households, including families with children. You need to be 16 or older to create an account yourself; the app checks this when you register (section 3.1). We apply this age in every country, even where the law sets a lower one. If we learn that a child under 16 created an account without the consent of a parent or legal guardian, we delete the account.

9.1 Child accounts

A child under 16 gets an account from a parent or legal guardian who is a taskmaster of the household. Before adding the child, the guardian declares that they are the child's parent or legal guardian and consents, for the child, to the processing this policy describes. We record that declaration: who gave it, when, for which version of this policy, and whether the child may receive notifications.

For a child account we store the child's name, the month and year of birth (to know when the child turns 16), who the guardian is, and the declarations. A child account has no email address and no password: the child signs in with a single-use code from the guardian's phone, valid for 15 minutes and stored only as a hash. In the household the child is a member like any other: the others see the child's name and what the child does there.

A child account never sends crash reports and receives push notifications only if the guardian allowed them. A child cannot create, join or leave households and cannot become a taskmaster.

Legal basis: the contract of using GYST, concluded with the guardian's consent, Art. 6(1)(b) GDPR; for notifications, the guardian's consent, Art. 6(1)(a) and Art. 8 GDPR. The declarations are kept to show that consent was given, Art. 6(1)(c) together with Art. 7(1) and Art. 8(2) GDPR.

9.2 The guardian's rights

The guardian exercises the child's rights (section 8) in the app under Profile → Children: downloading the child's data, signing the child out on every phone, deleting the child's account, and allowing or withdrawing notifications at any time (Art. 7(3) GDPR; a withdrawal takes effect immediately). Anything else, the guardian or the child can ask us for (section 1).

9.3 When the guardian leaves

When the guardian leaves the household or deletes their account, they name another taskmaster who is also the child's parent or legal guardian, and that person takes over. If they name nobody, the household's other taskmasters are asked to take over; if none does within 30 days, the account of a child under 16 is deleted. If no taskmaster is left at all, it is deleted at once, because nobody is left to consent for the child. A guardian cannot be removed from the household by someone else while their child is in it.

9.4 Turning 16

From the first day of the month after their sixteenth birthday, the child can take the account over in the app under Profile: they add their own email address and a password and from then on manage the account themselves, as described in section 3.1. Their household and everything they did in it stay. We then delete the birth month and the link to the guardian; the guardian's declarations stay with the account (section 6). The former guardian is told by notification.

10. Changes

We update this policy when the app or the law changes. The date at the top shows the current version.