Lyntl
Privacy policy – Lyntl
Version 1.0 · as of 25 October 2026
This policy explains what personal data the Lyntl app and its server process, why, on what legal basis, who else receives it and what rights you have. It applies to the Lyntl apps for iOS and Android, to the website lyntl.app and to the server they talk to.
At a glance
- Lyntl reminds you when maintenance is due on the appliances in your home and keeps your service history.
- You need an account (email address and password). Everything else you enter is up to you.
- We use your data only to run Lyntl. No advertising, no tracking, no analytics tools from other companies, no selling of data.
- Reminders come as push notifications. You can switch them off at any time.
- You can delete your account in the app. Your data is deleted straight away.
1. Who is responsible
The controller under the General Data Protection Regulation (GDPR) is:
Julian Brenne
4, Folkendengerstrooss
L-9186 Stegen
Luxembourg
Email: hello@lyntl.app
We have not appointed a data protection officer because the law does not require one for an offer of this size. For any privacy question, write to the address above.
2. What we process, why, and on what legal basis
2.1 Your account
What: email address, password (stored only as a secure hash), language of the app, whether and when you confirmed your email address, your reminder settings (how many days in advance, push and email on or off), the date the account was created and last changed.
Signing in: each time you sign in, we create a sign-in token for your device. We store a hash of the token, the model name your device reports (for example "iPhone 15") and when it was last used. On your phone the token is kept in the secure storage of the operating system (Keychain on iOS, Keystore on Android).
Why: to create your account, sign you in and keep your data separate from everyone else's.
Legal basis: Art. 6(1)(b) GDPR (performance of the contract: providing the app). Storing the sign-in token on your device is strictly necessary for the service you asked for (Art. 5(3) ePrivacy Directive; in Luxembourg Art. 4(3)(e) of the amended law of 30 May 2005, in Germany § 25(2) no. 2 TDDDG).
2.2 What you enter about your home
What: your home (name, optional description and address, time zone), rooms or places, your appliances (category, manufacturer, model, type-plate text, serial number, installation date, your own notes), their maintenance tasks and intervals, reminders, and your service history (date, what was done, optional notes and the name of whoever did the work). We also record whether you marked a task as done from a reminder notification or elsewhere in the app.
Some fields are free text. Please don't enter more about other people than you need, for example only the name of the company that serviced your boiler.
Why: to show your appliances and tasks, work out when maintenance is next due and keep your service record.
Legal basis: Art. 6(1)(b) GDPR.
The time zone of your home decides when "today" starts and when reminders go out. We derive it from your language setting when you sign up; you can change it.
2.3 Reminders by push notification
What: when you allow notifications, your device receives a push token from Apple (iOS) or Google (Android) and from Expo. We store this token with your account, the platform (iOS or Android), when it was last seen and whether it still works. For every reminder we keep a delivery record: when it was due to go out, whether it was sent, skipped or failed, and the technical acknowledgement from the push service.
A notification contains the reminder text, for example the name of the appliance and the task that is due.
How it travels: our server hands the notification to Expo's push service, which passes it to Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM, Google), which deliver it to your device. According to Expo, it keeps the content only as long as it needs to deliver it.
Why: reminders are Lyntl's main purpose. The delivery records prevent duplicate notifications and help us find faults.
Legal basis: Art. 6(1)(b) GDPR. You decide whether you get push notifications: in your device's settings and in the app. When you sign out, the app removes the push token for that device. When you reset your password or delete your account, we remove all push tokens.
2.4 Emails
What: your email address, the content of the email and the delivery status reported by the email service (delivered, bounced, complaint).
We send:
- a link to confirm your email address (valid for 60 minutes);
- a 6-digit code when you have forgotten your password (valid for 15 minutes; we store only a hash of it);
- important notices about your account or this service.
We don't send newsletters or advertising.
Legal basis: Art. 6(1)(b) GDPR.
When you open the confirmation link in your browser, our server shows a short page. Our server sets no cookies; for the security cookie of our hosting provider, see section 2.6.
2.5 Searching the catalogue
When you search for an appliance, we compare your search term with our product catalogue and don't store it with your account.
2.6 Operating the server, security and error monitoring
What: when the app talks to our server, the server processes technical data: IP address, date and time, the address requested, status code, amount of data, app and operating-system version (user agent) and, if you are signed in, your user ID. We limit how often sign-in, password reset and similar requests can be made from one address or for one account.
To find errors and slow spots we use Laravel Nightwatch. It records requests, errors, database queries, background jobs and outgoing messages, which can include your user ID and your IP address. We don't send search terms, passwords or codes to it.
When you open one of our web pages (for example the start page lyntl.app, this privacy policy or the confirmation link from an email), the network service Cloudflare, which our hosting provider Laravel Cloud uses, sets a security cookie (__cf_bm, deleted after 30 minutes). It helps tell people from automated attacks. We don't read it and it isn't used for tracking. Storing it is strictly necessary for the page you asked for (Art. 5(3) ePrivacy Directive; in Luxembourg Art. 4(3)(e) of the amended law of 30 May 2005), so it needs no consent. Our web pages set no other cookies and load nothing from other companies. The app itself sets no cookies.
Why: to run the service securely and reliably, to prevent misuse and to fix faults.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a secure, working service.
2.7 Improving Lyntl
To see whether Lyntl works as intended (for example, how many reminders lead to a logged service), we run counts directly on our own database. We report only totals, not individual people. We don't use third-party analytics or tracking tools.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to improve the app.
2.8 Contacting us
If you write to us, we use your email address and message to answer you.
Legal basis: Art. 6(1)(b) GDPR where your message concerns your account; otherwise Art. 6(1)(f) GDPR (answering enquiries).
2.9 App stores and test versions
You download Lyntl from the Apple App Store or Google Play. Apple and Google process data about the download under their own responsibility and privacy policies; we receive only anonymous statistics.
During the test phase, Lyntl is also distributed through Apple TestFlight, and test versions can be opened in Expo's app Expo Go. If you take part through TestFlight, Apple gives us the name and email address you were invited with and, if you agree in Apple's settings, crash reports and feedback you send. Expo Go is Expo's own app; Expo processes data in it under its own privacy policy.
The app downloads updates from Expo's update service (EAS Update). To do so it sends Expo your IP address, the platform, the app version, the update channel and a random identifier for the installation.
Legal basis: Art. 6(1)(b) GDPR for app updates; Art. 6(1)(f) GDPR for the test versions. Our legitimate interest is to test Lyntl before its release.
3. Who receives data
We use the following service providers. They process data only on our behalf and under our instructions (Art. 28 GDPR), except Apple and Google for the app stores (section 2.9).
| Provider | What for | Where | Transfer safeguard |
|---|---|---|---|
| Laravel Holdings Inc., USA (Laravel Cloud) | Hosting of our server and our web pages, with the network service Cloudflare | Data centre in Frankfurt, Germany (AWS eu-central-1) | EU-US Data Privacy Framework (Laravel is certified) |
| Neon (Databricks, Inc.), USA | Database | Data centre in Frankfurt, Germany (AWS eu-central-1) | EU-US Data Privacy Framework (Databricks and Neon are certified) |
| Laravel Holdings Inc., USA (Laravel Nightwatch) | Error and performance monitoring | EU (may be accessed from the USA) | EU-US Data Privacy Framework (Laravel is certified) |
| 650 Industries, Inc. (Expo), USA | Push notification service and app updates | USA | EU-US Data Privacy Framework (Expo is certified) |
| Apple Inc. / Apple Distribution International Ltd. | Delivery of push notifications to iOS devices (APNs) | EU and USA | Data Privacy Framework where certified / Standard Contractual Clauses |
| Google Ireland Ltd. / Google LLC | Delivery of push notifications to Android devices (FCM) | EU and USA | Data Privacy Framework where certified / Standard Contractual Clauses |
Some of these companies use their own subcontractors (for example cloud data centres). Where data reaches a country outside the EU/EEA, we rely on an adequacy decision of the European Commission (Art. 45 GDPR; for the USA the EU-US Data Privacy Framework, for certified companies) or on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can ask us for a copy of the safeguards.
We do not sell or rent your data. We disclose data to authorities only where the law obliges us to (Art. 6(1)(c) GDPR).
4. How long we keep data
- Account and everything you entered: until you delete your account. Then it is deleted at once, in one step. This includes your home, appliances, tasks, reminders, service history, delivery records, sign-in tokens and push tokens.
- Sign-in tokens: until you sign out on that device, reset your password or delete your account.
- Push tokens: until you sign out on that device, reset your password or delete your account. A token that Expo reports as no longer registered is switched off and no longer used.
- Password reset codes: valid for 15 minutes and used once.
- Server logs: up to 7 days.
- Monitoring data (Laravel Nightwatch): up to 90 days.
- Restore history of the database: our database provider keeps a history of changes so that the database can be restored after a fault; it is overwritten automatically after at most 7 days. Deleted data may stay in it until then; we don't restore it except to recover from a fault.
- Emails to us: as long as needed to answer, and longer only where the law requires it.
If the law requires us to keep certain data longer, we restrict it to that purpose.
5. Deleting your account
In the app, open Account → Delete account and confirm with your password. We delete your account and all data linked to it immediately; this cannot be undone.
Deleting the app from your phone does not delete your account.
6. Your rights
You have the right to:
- access the data we hold about you (Art. 15 GDPR);
- rectification of incorrect data (Art. 16 GDPR); you can change most data directly in the app;
- erasure (Art. 17 GDPR); you can delete your account in the app at any time;
- restriction of processing (Art. 18 GDPR);
- data portability: to receive the data you gave us in a common machine-readable format (Art. 20 GDPR); on request we send you an export by email;
- withdraw consent you have given, with effect for the future (Art. 7(3) GDPR), for example for notifications in your device settings.
Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We then stop, unless we can show compelling legitimate grounds or need the data to establish, exercise or defend legal claims.
To use these rights, write to the email address in section 1. We may ask you to confirm that the account is yours.
Right to complain: you can complain to a data protection supervisory authority, in particular in the EU country where you live or work or where the alleged breach took place (Art. 77 GDPR). The authority responsible for us is the Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg, www.cnpd.lu.
If you live in the United Kingdom, you can also complain to the Information Commissioner's Office (ico.org.uk).
7. Do you have to provide data?
You need an email address and a password to use Lyntl, because the app stores your home and reminders in your account. Everything else is optional; without it, some features (for example reminders by push notification) won't work. There is no legal obligation to provide data.
8. No automated decisions
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects (Art. 22 GDPR). Lyntl calculates due dates from the intervals you set; that is a calculation for you, not a decision about you.
9. Security
Connections between the app, our server and our providers are encrypted (TLS). Passwords, sign-in tokens and reset codes are stored only as hashes. Your data is separated by account, and access to the server is limited to the people who run Lyntl.
10. Children
Lyntl is not intended for people under 16.
11. Changes
We update this policy when Lyntl or the law changes. The current version is always available in the app and at https://api.lyntl.app/privacy. If a change affects you significantly, we will tell you in the app or by email.