Back to home

Privacy policy

Last updated: July 2026

This policy explains what data DIY Pilot collects, why, on what legal basis, and how long we keep it. It covers both the app and this website.

1. Controller

The controller responsible for data processing within the meaning of the GDPR is:

Nicki Eliza Schinow
Bachstr. 7
79238 Ehrenkirchen
Germany
Phone: 01732897906 (no Support)
E-mail: privacy@diypilot.app

2. This website

Server log files

When you visit this website, our hosting provider automatically records data your browser transmits: the page requested, date and time, the amount of data transferred, the referring page, your browser type and version, your operating system, and your IP address in shortened form. This data is not merged with other sources and is used solely to operate the site securely and reliably.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, functioning website). Retention: log files are deleted after 7 days.

Hosting

We host the content of our website with the following provider:

Mittwald

The provider is Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4–6, 32339 Espelkamp, Germany (hereinafter “Mittwald”).

For details, please see Mittwald’s privacy policy.

We use Mittwald on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in presenting our website as reliably as possible. Where consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time.

Data processing agreement

We have concluded a data processing agreement (DPA) for the use of the service named above. This agreement is required under data protection law and ensures that the provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

Website analytics

We use Plausible Analytics, which runs on EU servers. Plausible sets no cookies, stores no IP addresses and builds no profiles of individual visitors. All figures are aggregated and tell us only which pages get read.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding how the site is used). Because no personal data is stored, no consent banner is required.

3. The app

Account data

Your e-mail address and display name, provided when you sign up. You can try the app without an account; an account is only needed once you want to save a project, keep an inventory or connect a board.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Retention: until you delete your account, plus up to 30 days in backups.

Project and inventory data, including photos

Ideas you save, photos you take of your rooms, tools and materials, and the entries generated from them. Photos of your home are sensitive by nature, so we keep them to the minimum needed to give you a suggestion.

Legal basis: Art. 6(1)(b) GDPR. Retention: until you delete the project or your account.

What happens to your photos

Photos stay inside our own infrastructure. They are uploaded to our storage at Supabase and linked to your project or space entry. They are not sent to any AI provider, and they are not used to train AI models.

Legal basis: Art. 6(1)(b) GDPR. Retention: until you delete the project or your account.

Project suggestions (AI)

To generate suggestions we send text only to OpenAI: the description you type about your space, plus the names and categories of your inventory items. No photos, no e-mail address, no name and no account ID are transmitted. OpenAI processes this on servers in the USA using the GPT-4o mini model, and does not use data sent via its API to train its models.

Provider: OpenAI Ireland Ltd. / OpenAI, L.L.C. Legal basis: Art. 6(1)(b) GDPR. Transfer: see section 6.

Usage analytics

We use Firebase Analytics (Google) to see which screens and features get used and where people get stuck. Firebase uses device identifiers, so this only runs if you agree to it.

Provider: Google Ireland Ltd. Legal basis: Art. 6(1)(a) GDPR (consent) and § 25(1) TDDDG. You can withdraw at any time in the app settings, with effect for the future. Retention: 14 months.

Purchase data

Your subscription status. Payment itself runs through Apple; we never see or store card details. We use RevenueCat to check whether a subscription is active.

Providers: Apple Distribution International Ltd.; RevenueCat, Inc. (USA). Legal basis: Art. 6(1)(b) GDPR. Retention: as required by German tax and commercial law (up to 10 years for records with an accounting function).

Pinterest boards

If you connect a Pinterest board, we access it via Pinterest's interface to read the images and their style attributes. This happens only when you actively connect a board, and you can disconnect it at any time in the settings. Pinterest is an independent controller for what happens on its side.

Legal basis: Art. 6(1)(a) GDPR (consent).

Push notifications

Only if you switch them on. You can withdraw this at any time in iOS Settings, with no effect on the lawfulness of processing before withdrawal.

Legal basis: Art. 6(1)(a) GDPR (consent).

Messages you send us

If you e-mail us, we keep your message and contact details to answer it.

Legal basis: Art. 6(1)(b) or (f) GDPR. Retention: 6 months after the matter is closed, unless statutory retention periods apply.

4. Shopping lists and affiliate links

Links in a shopping list take you to third-party retailers. When you follow one, the retailer and the affiliate network we work with may set cookies or use similar tracking to attribute the visit, and we may receive a commission at no extra cost to you. This happens on the retailer's side, under their own privacy policies, and we receive only aggregated, non-personal reporting.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in financing the service). [PLEASE ADD ONCE LIVE: name the affiliate network and link its privacy policy.]

5. Who receives your data

We do not sell your personal data. We do not use your photos, projects or saved ideas for advertising. Data is shared only with processors who help us run the service:

  • Supabase — database and photo storage, EU infrastructure. Processor under Art. 28 GDPR.
  • Mittwald — website hosting, Germany.
  • Plausible Analytics — website statistics, EU servers.
  • OpenAI — generating project suggestions from text. No photos. USA.
  • Google (Firebase Analytics) — app usage statistics, only with your consent.
  • Apple — app distribution and payment, independent controller under its own privacy policy.
  • RevenueCat — subscription status. USA.
  • Pinterest — only if you connect a board yourself.

6. Transfers outside the EU

Your photos and your database records stay on EU infrastructure. Three services process data in the USA: OpenAI (the text of your space description and inventory item names), RevenueCat (subscription status) and Google/Firebase (usage statistics, only with your consent). These transfers are based on the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR and, where applicable, the EU-US Data Privacy Framework. Despite these safeguards, US authorities may in principle be able to access data. You can avoid the Firebase transfer entirely by declining analytics.

7. Automated decision-making

Project suggestions are generated automatically, but they are suggestions only. They produce no legal effects and no similarly significant effects for you within the meaning of Art. 22 GDPR. You always decide what to build.

8. Your rights

Under the GDPR you have the right to:

  • Access the personal data we hold about you (Art. 15).
  • Rectification of inaccurate or incomplete data (Art. 16).
  • Erasure of your account and associated data (Art. 17).
  • Restriction of processing (Art. 18).
  • Data portability — your data in a machine-readable format (Art. 20).
  • Object to processing based on legitimate interest (Art. 21).
  • Withdraw consent at any time, with effect for the future (Art. 7(3)).

Write to privacy@diypilot.app and we will respond within one month.

9. Right to complain

You may lodge a complaint with a supervisory authority, in particular in the member state of your residence, place of work or the alleged infringement. The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart
www.baden-wuerttemberg.datenschutz.de

10. Data security

Data is encrypted in transit (TLS) and stored on access-restricted infrastructure.

11. Children

DIY Pilot is not intended for anyone under 16. We do not knowingly collect data from children.

12. Changes

We may update this policy. The date above always shows the current version, and we will tell you in the app or by e-mail about significant changes.

13. Contact

Questions about privacy: privacy@diypilot.app.