Privacy policy

Last updated: 3 November 2026

Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:

Kemal Aslan
Kouřimská 2336/10
130 00 Praha
Czech Republic

For anything about your data, email hello@yearsin.com.

The short version

  • We only collect what YearsIn needs to work: your account, the gear you add and your reports.
  • Your profile, gear, reports and approved photos are public. Your email address is not.
  • We remove location data (EXIF/GPS) from every photo before storing it.
  • No ads, no tracking, no analytics cookies. We don't sell personal data.
  • You can delete your account and everything in it at any time under My gear.

What we collect and why

  • Account: email address, password (stored only as a hash by our authentication provider), username and optional display name and bio. Needed to provide your account (Art. 6(1)(b) GDPR).
  • Gear and reports: items you own or owned, dates, how often you use them, status, ratings, issues and notes. This is the core of the service (Art. 6(1)(b)).
  • Photos: timestamp photos you upload to verify ownership. Location and camera metadata is removed before storage. Please don't show faces, addresses or other personal details in photos.
  • Account and review emails: we email you to confirm your address when you sign up, to reset your password when you ask for it, and to tell you whether your timestamp photo was approved, and why not if it wasn't. These are part of the service (Art. 6(1)(b)).
  • Check-in emails: we email you at 1, 6 and 12 months of ownership and then once a year to ask how your gear is holding up. This is part of the service; you can turn it off at any time under My gear or with the link in every email (Art. 6(1)(b) and (f)).
  • Technical data: our hosting provider processes IP addresses and request data to deliver and protect the website (Art. 6(1)(f)). We don't use them to profile you.

What is public

Your username, display name, bio, the gear on your profile, your owner reports and approved timestamp photos are visible to everyone. Item pages with owner reports may appear in search engines; profile pages and photos are marked so search engines leave them out. Your email address, your email settings and photos that are not (yet) approved are never public.

Aggregated statistics

We combine reports from many owners into scores and statistics (for example, “94% still working after 2 years”). These statistics are anonymous: they don't identify you. We may publish them and share or license them to third parties such as brands or research and search companies. Anonymous statistics remain after you delete your account.

Cookies

We only use cookies that are strictly necessary to keep you signed in. We don't use advertising or analytics cookies, so there is no cookie banner. When you follow a link to a shop, that shop may set its own cookies (for example to attribute a commission to us); its own privacy policy applies there.

Service providers

We use these providers to run YearsIn. They process data only on our instructions:

  • Supabase (database, sign-in, photo storage), with data stored in the EU.
  • Vercel (website hosting), USA, under the EU-U.S. Data Privacy Framework and standard contractual clauses.
  • Resend (sending emails: sign-up, password reset, photo reviews and check-ins), USA, under standard contractual clauses.

How long we keep data

We keep your account, gear, reports and photos until you delete them or your account. When you delete your account, we delete your personal data, including your photos, right away; backups are overwritten within 30 days. Anonymous statistics are kept. Sign-ups that are never confirmed are deleted after 24 hours.

Your rights

You have the right to access, correct, delete, restrict and port your data, and to object to processing based on legitimate interests. You can delete your account yourself under My gear; for everything else, email us. You also have the right to complain to a data protection authority, for example the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz).

Age

YearsIn is for people aged 16 and over.