Privacy Policy

Last updated: September 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. General Information on Data Processing

As a matter of principle, we only process personal data to the extent necessary to provide a functional website and our content and services. The processing of personal data takes place regularly only after the user has given his or her consent. An exception applies in cases where prior consent cannot be obtained for factual reasons and the processing of the data is permitted by law.

3. Server Log Files

The provider of this website automatically collects and stores information in so-called server log files, which your browser automatically transmits. These are:

• Browser type and browser version
• Operating system used
• Referrer URL
• Hostname of the accessing computer
• Time of the server request
• IP address (anonymized)

This data cannot be assigned to specific persons. This data is not merged with other data sources. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in the secure and efficient operation of the website).

4. Payment processing via Mollie

For the processing of payments, we use the service of Mollie (Mollie B.V., Keizersgracht 313, 1016 EE Amsterdam, Netherlands).

When you place an order, you will be redirected to Mollie's hosted payment page. Data processed there (name, e-mail address, payment data, delivery address) are subject to Mollie's privacy policy: https://www.mollie.com/de/privacy

We only receive a confirmation from Mollie that the payment was successful, as well as the order data necessary for order processing (product, variant, delivery address). We do not have access to complete payment information (e.g. credit card numbers) at any time.

The data is transmitted on the basis of Art. 6 para. 1 lit. b GDPR (performance of a contract).

5. Customer Reviews

On our website, we display customer reviews exclusively from a locally stored XML file. No requests are sent to external review platforms when these reviews are loaded.

The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in the display of customer reviews).

6. Emails about reviews and unfinished orders

Once your order has been delivered, we may send you a single email asking you to review the product you purchased. For this we process your email address, your first name and the initial of your last name, and your order number – all of which we already hold from your order. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in feedback on our products) in conjunction with Section 7 (3) of the German Act Against Unfair Competition (UWG).

If you started an order but did not complete it, we may write to you once, in individual cases, to ask whether we can help with anything, and may point out a discount code. Here too we only use the data from the abandoned order. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in clarifying and completing orders that have been started). These emails are not sent automatically; each one is triggered individually by us. You can object to them just as you can to review requests – an objection always covers both kinds.

You may object to this use of your email address at any time, at no cost other than the transmission costs at base rates. Simply use the unsubscribe link at the end of every review request, or send an informal message to info@yawn-labs.com. After an objection we store your email address permanently on a suppression list – solely for the purpose of not contacting you again. Order-related emails such as confirmations and shipping notifications are unaffected, as they form part of performing the contract.

The personal link in the request contains a random string used to match your order to the review form; it expires after 90 days. If you submit a review, we publish your first name with the initial of your last name, the star rating, your text and any image you upload on our website after moderation. Your order number and email address are not published. You may request the deletion of a published review at any time.

7. Contact Form / E-mail

If you contact us by e-mail, the data you transmit (e-mail address, name and content of the inquiry, if applicable) will be stored for the purpose of processing the inquiry and in case of follow-up questions. This data will not be passed on without your consent.

The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in answering customer inquiries) or Art. 6 para. 1 lit. b GDPR for pre-contractual or contractual inquiries.

Revocation Form

On our revocation page, an online form is available through which you can submit your revocation. The data entered (order number, name, e-mail address, delivery address, date) will be transmitted to us by e-mail exclusively for the purpose of processing your revocation and will not be stored beyond that. The legal basis is Art. 6 para. 1 lit. c GDPR (fulfillment of a legal obligation to receive revocations).

8. Cookies and local storage

This website does not use tracking or marketing cookies. A technically necessary session cookie is set, which exclusively stores your language preference (German/English). This cookie does not contain any personal data and is deleted when you close your browser. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in a functional website).

In addition, this website stores information in your browser's local storage so that your shopping cart and the details you enter in the order form – name, address, email address, delivery country and any coupon code – are not lost if your order is interrupted or abandoned, and you do not have to type everything again. This information stays on your device; it is only transmitted to us when you submit the order. It is deleted automatically once your order has been paid, and at the latest one hour after your last visit. You can remove it yourself at any time using your browser's function for clearing site data. If you abandon the payment process, we additionally set a technically necessary cookie for 24 hours which contains nothing but a random identifier of the order you started. It allows you to continue the payment without having to place a second order, and is deleted as soon as the order has been paid or has expired. The legal basis for storing it on your device is Sec. 25 (2) no. 2 TDDDG (strictly necessary for us to provide the service you explicitly requested, namely the ordering process); the subsequent processing of the order data is based on Art. 6 para. 1 lit. b GDPR.

Mollie B.V. may set its own cookies as part of the payment process; these are subject to Mollie's privacy policy (www.mollie.com/de/privacy).

9. Web Analytics (Simple Analytics)

This website uses Simple Analytics, a privacy-friendly analytics service from Simple Analytics B.V., Mauritskade 11, 1092 AD Amsterdam, Netherlands.

Simple Analytics stores no cookies, collects no personal data, and creates no individual user profiles. Only aggregated page view statistics are collected (pages viewed, referring source, device category). IP addresses are not stored.

The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in anonymous reach measurement). Since no personal data is processed, no consent is required. Further information: simpleanalytics.com/privacy.

10. Your Rights

You have the following rights with respect to us:

• Information (Art. 15 GDPR): Right to information about the data stored about you.
• Rectification (Art. 16 GDPR): Right to correction of incorrect data.
• Deletion (Art. 17 GDPR): Right to deletion under certain conditions.
• Restriction (Art. 18 GDPR): Right to restriction of processing.
• Data portability (Art. 20 GDPR): Right to receive your data in a machine-readable format.
• Objection (Art. 21 GDPR): Right to object to processing based on legitimate interests.

To exercise your rights, please contact: philipp@yawn-labs.com

11. Right to lodge a complaint with a supervisory authority

You have the right to complain to a data protection supervisory authority about our processing of your personal data. The competent authority is that of the federal state in which you have your residence, or the authority that is competent for us as the controller:

12. Data Security

This website uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content (e.g. orders). You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://".

13. doppio App and online configurator

This privacy policy also applies to our mobile app "doppio" (iPhone and Android), which you use to configure your doppio Shot Timer over a USB cable, and to the online configurator on this website. The controller is the entity named under item 1. The app does not require a user account or login and contains no advertising and no third-party analytics or tracking services. Your timer's settings and measurements stay on your device; only the data described below is transmitted.

Installation ID

On first launch, the app generates a random, device-wide installation identifier (client_id) with no personal reference. It is used exclusively to associate requests to our server with a device and to prevent abuse of the analysis recording feature (see below) – for example when several devices share a public IP address on the same mobile network. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in a functional, abuse-protected service). This identifier is only transmitted if you start an analysis recording.

The identifier is stored on your device and only transmitted to our server when you start an analysis recording; on our server we do not store it in plain text, only as a non-reversible hash. On your device it is automatically removed when you uninstall the app or clear its data via your system settings.

Firmware updates

When you start a firmware update, or when the app or the configurator shows the currently available firmware version, it asks our server for the matching firmware and then downloads it. For the doppio v2, your timer's version line is transmitted so that the server can select the matching firmware; the rest of the transmitted device text is not stored. Exception: if the server cannot determine a matching firmware for your timer (unknown version string), we send the version string together with an excerpt of the device output (measurements from the last few seconds) and the identifier of your browser or the app by email to our support in order to resolve the problem and help you. We log the time, the firmware variant and version delivered, and a hash of your IP address formed with a secret key in order to limit abuse (request limit per hour). We delete these log entries after 30 days. The legal basis is Art. 6 para. 1 lit. b GDPR (providing the firmware for your device) and Art. 6 para. 1 lit. f GDPR (legitimate interest in protecting the service).

Analysis recording (voluntary)

In the expert mode of the app and the online configurator, you can start a recording of the raw data stream from your connected timer to help us develop new machine presets. Doing so transmits the machine model you entered (free text) and the technical raw data stream from your device (serial or MIDI/SysEx data) to our server via an encrypted connection (HTTPS), where it is stored outside the publicly accessible web directory. Together with the recording we store the start time, the identifier of your browser or the app (user agent), for the app its version and the operating system version, as well as hashes of your IP address and the installation ID, which serve only to limit abuse.

The recording starts only when you actively trigger it and continues until you stop it or a technical limit is reached. The legal basis is your consent (Art. 6 para. 1 lit. a GDPR), given by starting the recording; you may withdraw it at any time by stopping the recording, without affecting the lawfulness of processing carried out before the withdrawal.

We use this data exclusively to evaluate and improve our device presets and do not share it with third parties. Without a separate deletion request, we keep a submitted recording until we have evaluated it for preset development, and delete it afterwards. You may request full deletion of your recording — machine model and raw data stream — ahead of that at any time, informally, by emailing philipp@yawn-labs.com.

What the app does not collect

The app does not request your location, contacts, photos, videos, payment information, health data or messages, and does not access your browsing history. It uses neither Bluetooth nor Wi-Fi or the local network to connect to devices – the connection to the timer runs exclusively over the USB cable. The app uses your phone's motion sensor only locally for a visual background effect; these values are neither stored nor transmitted.

Permissions

The app needs access to connected USB devices to communicate with your doppio timer over the cable, and an internet connection for firmware updates, presets, and the voluntary analysis recording described above. Loading presets and firmware produces the server log files described under item 3 on our server. No further permissions – such as camera, microphone, location, contacts, Bluetooth or local network – are requested.

14. Topicality and amendment of this data protection declaration

This data protection declaration is currently valid and has the status stated above. Due to the further development of our website or due to changed legal or official requirements, it may become necessary to change this data protection declaration. The current data protection declaration can be retrieved and printed by you at any time on this page.