Skip to content
sereno

Back to Sereno

Privacy Policy

Sereno Studio has no accounts: no email, no password, no username. Your practice data is stored in the European Union. It is never used to train AI models, never sold and never used for advertising.

This is a translation. The Italian version at launchd.online/sereno/it/privacy is the authoritative text and prevails in case of conflict.

Last updated: 24 September 2026 · Version 1.0

This policy explains what personal data the Sereno Studio app collects, why, how long it is kept and what rights you have. It is written under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).

1. Who processes your data

The data controller is:

launchd, a sole trader established in Italy.

Email for data protection matters: support@launchd.online

Contact form: launchd.online/contact

No Data Protection Officer has been appointed, as the conditions of Article 37 GDPR do not apply: we are not a public authority, our core activity does not consist of processing operations that require regular and systematic monitoring of data subjects on a large scale, and our core activity does not consist of large-scale processing of special categories of data. Write to the address above for any request.

2. In short

  • You are not asked to create an account. No email, no password, no username, no social sign-in. The app creates an anonymous identity on first launch.
  • What is stored is your practice. Which classes you watched and for how long, where you stopped in a class, your favourites, your badges and challenges, and the answers you gave during onboarding.
  • It is stored in the European Union, in Frankfurt, Germany. Product analytics is also in the European Union.
  • You can delete all of it from inside the app, in one tap, at any time, without asking anyone.
  • There is no advertising, no advertising identifier and no tracking across other apps or websites. Nothing is sold, rented or traded.
  • Nothing you do in the app is used to train AI models, ours or anyone else's.

3. What we collect

Data What it is Optional Where it is held Anonymous user identity An identifier created on first launch that links your records together. It is not linked to a name, an email address or any real-world identity, because the app never asks for one. No, it is how the service works European Union (Frankfurt) Practice history Which class you watched, when, and for how long No, it is the service European Union (Frankfurt) Resume positions Where you stopped in a class, so you can pick it up again No, it is the service European Union (Frankfurt) Favourites The identifiers of the classes you saved Yes, only if you save a class European Union (Frankfurt) Badges and challenges Which badges you earned, which challenges you joined, and the date Yes, only if you join a challenge European Union (Frankfurt) Onboarding answers Experience level, goals, focus areas, preferred session length, preferred time of day No, they are asked at first launch and can be changed later European Union (Frankfurt) Display name Free text you may type for yourself. Blank by default. It is never verified and does not have to be your real name. Yes, entirely European Union (Frankfurt) Profile photo The image never leaves your device. It is chosen through the system picker and stored inside the app's own container on the phone. Only the filename string is stored on our servers, so that the app knows a photo has been set. Yes, entirely The image: your device only. The filename: European Union (Frankfurt). Subscription state Whether a subscription is active, and which one No, it is how access works United States (see §6 and §7) Product analytics events Product interaction events, for example that a class was opened or that onboarding was completed, together with coarse device and operating system attributes such as device model and iOS version No, but see §4 on your right to object European Union

3.1 What we do not collect

The app collects no name, no email address, no postal address, no telephone number, no date of birth, no payment details and no precise location. The display name described above is free text you type for yourself: it is never checked against any identity document or account, and you can leave it blank.

Card and billing details are handled entirely by Apple and are never disclosed to us.

4. Why we process your data, and on what legal basis

Purpose Data Legal basis Showing your practice history and your progress Practice history Performance of the contract, Art. 6(1)(b) GDPR Letting you resume a class where you stopped Resume positions Performance of the contract, Art. 6(1)(b) GDPR Keeping the classes you saved Favourites Performance of the contract, Art. 6(1)(b) GDPR Awarding badges and running challenges Badges, challenges and their dates Performance of the contract, Art. 6(1)(b) GDPR Suggesting classes that match what you said you wanted Onboarding answers Performance of the contract, Art. 6(1)(b) GDPR Showing a display name and a profile photo in the app Display name, avatar filename Performance of the contract, Art. 6(1)(b) GDPR, at your initiative, since both are optional Giving access to the classes and managing the subscription Anonymous identity, subscription state Performance of the contract, Art. 6(1)(b) GDPR Understanding which parts of the app are used, so we can improve it Product analytics events, coarse device and operating system attributes Legitimate interest, Art. 6(1)(f) GDPR. The interest is improving a product we are responsible for, using aggregated counts rather than individual behaviour. Keeping the service secure and preventing abuse of the video catalogue Anonymous identity, request and playback metadata Legitimate interest, Art. 6(1)(f) GDPR. The interest is protecting the service and the licensed video from unauthorised access and redistribution. Sending push notifications, for example a practice reminder Notification token Consent, Art. 6(1)(a) GDPR, given through the iOS permission prompt Meeting legal obligations (tax, accounting) Transaction data received from Apple Legal obligation, Art. 6(1)(c) GDPR Notifications are optional and always were. You can withdraw consent at any time in iOS Settings, under Notifications, without affecting anything else in the app and without affecting the lawfulness of any notification sent before you withdrew it. The app works the same way without them.

Where we rely on legitimate interest you have the right to object under Article 21 GDPR. See §9.

5. What we do not do

This section is a list of things the app does not do. It is as much a part of this policy as the rest.

  • No advertising of any kind. No ad SDKs, no advertising identifier (IDFA), and no App Tracking Transparency prompt, because there is nothing to ask you about.
  • No tracking across other apps or websites. We do not follow you anywhere outside Sereno Studio.
  • Nothing is sold, rented or traded. Not to advertisers, not to data brokers, not to anyone.
  • No session replay. Screen recording in the analytics tool is switched off and stays off. An app that shows video of people practising in their own homes does not ship recordings of its own screen to a third party.
  • No profiling in the sense of Article 4(4) GDPR: we do not build a profile of you to evaluate or predict personal aspects such as your health, your economic situation or your behaviour.
  • No training of AI models on anything you do in the app, ours or anyone else's.
  • No camera, no microphone, no location, no contacts. The app never asks for them.
  • No photo library permission. A profile photo is chosen through the system picker, which hands the app a single image without giving it access to your library.
  • No user-generated content. No comments, no community, no messaging between users. There is nothing in the app that other users can see. The app reads no health app and asks for no health data. There is no HealthKit integration and no connection to Apple Health or to any other health or fitness app. Sereno Studio never learns your weight, your heart rate, your injuries or your medical history, because it never asks and has no way to read them.

Notifications are the only permission the app ever asks for, and they are optional.

6. Where your data is

Data Location Anonymous identity, practice history, resume positions, favourites, badges, challenges, onboarding answers, display name, avatar filename European Union, Frankfurt (Germany) Profile photo itself Your device only. It is never uploaded. Product analytics events European Union. The analytics service is used on its European Union instance. Subscription state United States, under the standard contractual clauses (see below) The video itself A global edge network. The video files carry no personal data. Local copy of your practice data On your iPhone The database is hosted in the European Union deliberately, and the analytics service runs on its European Union instance for the same reason.

The one transfer outside the European Union is the subscription state, which is handled by a provider in the United States. It consists of the anonymous user identity and whether a subscription is active. No practice data is sent. The transfer is covered by the standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914), incorporated in the data processing agreement with the provider.

Video delivery uses a global edge network so that a class starts quickly wherever you are. What travels over it is the video itself. No database, no profile and no practice data is held there.

7. Who we share your data with

We do not sell, rent or trade your personal data. We share it only with the providers that make the service work, each acting as a processor under a contract pursuant to Article 28 GDPR.

Provider Role Where What it receives Supabase Database and anonymous authentication European Union (Frankfurt) Everything listed in §3 as held in the European Union Cloudflare R2 Video delivery only Global edge network The video bytes. No personal data and no database tables. RevenueCat Subscription state United States The anonymous user identity and the subscription state. No practice data. PostHog Product analytics European Union (eu.i.posthog.com) Product interaction events and coarse device and operating system attributes. Session replay is disabled. Apple App distribution and payment processing United States and European Union Transaction data. Apple acts as an independent controller under its own policy. We may also disclose data to judicial or competent authorities where necessary to comply with a legal obligation or to establish, exercise or defend a legal claim.

If the business or a branch of it is transferred, data may pass to the acquirer. In that case we will notify you in advance inside the app and you may delete your data before the transfer.

8. How long we keep data

We keep your data until you delete it. There is no other retention period, because there is no account to expire and no reason to hold practice history you no longer want.

There are two ways to delete it:

  • Delete account, inside the app. This calls a dedicated endpoint that erases everything held against your anonymous identity on the server, and resets the local copy on the phone at the same time. It is immediate and irreversible. Nothing is kept in a recycle bin and nothing can be restored, by you or by us.
  • Deleting the app. This removes everything held on the device, including the profile photo and the local copy of your practice data. If you want the server side gone as well, use Delete account before you remove the app. Product analytics events are different. They are aggregated counts of how the app is used and are not tied to an identity we can look you up by, so they are not removed by the deletion routes above and cannot be, since there is nothing to match them against.

Transaction records held for tax and accounting purposes are kept for 10 years, as required by Italian law. They come from Apple and contain no practice data.

9. Your rights

Under Articles 15 to 22 GDPR you have the right to:

Right How to exercise it Access (Art. 15) Your practice history, favourites, badges and onboarding answers are all visible inside the app. For anything else, write to support@launchd.online. Rectification (Art. 16) The display name, the profile photo and the onboarding answers are all editable directly in the app. Erasure (Art. 17) Settings, then Delete account. Immediate and permanent. Restriction (Art. 18) Write to support@launchd.online Portability (Art. 20) Write to support@launchd.online and we will send you your records in a machine-readable format. Objection to processing based on legitimate interest (Art. 21) Write to support@launchd.online Withdrawal of consent for notifications (Art. 7) iOS Settings, then Notifications. At any time, without affecting anything sent beforehand. We respond within 30 days, extendable by a further two months in the complex cases provided for by Article 12(3) GDPR, with notice to you.

A limitation you should know about. Because there is no account with an email and password, we cannot verify your identity in the usual way, and we will not hand over or alter data for someone we cannot identify as its subject. This is the direct consequence of not asking you who you are. It is why the in-app routes, which run on your own device against your own identity, are the reliable way to exercise your rights, and why deletion from inside the app is the most certain of all.

Complaints. If you believe the processing of your data breaches the law, you have the right to lodge a complaint with the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy, www.garanteprivacy.it, or with the supervisory authority of the Member State where you reside.

10. Children

Sereno Studio is not directed at children under 16. The classes and the way they are presented are made for adults.

Because there is no account, we never knowingly collect a child's personal data: we do not ask for a name, an email address or a date of birth from anyone, of any age.

If you are a parent or guardian and you believe a child under 16 has used the app and left data on our servers, write to support@launchd.online and we will delete it. Deleting the app on the child's device, after using Delete account, achieves the same result immediately.

11. Security

We apply technical and organisational measures appropriate to the risk, including:

  • encryption of data in transit (TLS) and at rest;
  • row-level security in the database, under which one anonymous identity can never read or write another's rows. This is enforced by the server, not by the app, so it holds even if the app is tampered with;
  • video served through signed URLs that expire, so a link copied out of the app stops working;
  • privileged access keys never present in the app installed on the phone;
  • system access limited to the controller. No system is perfectly secure, and we will not pretend otherwise. In the event of a personal data breach likely to result in a high risk to your rights, we will notify you without undue delay as required by Article 34 GDPR, and inform the Garante within 72 hours.

12. No automated decision-making

We carry out no processing producing legal effects concerning you or similarly significantly affecting you within the meaning of Article 22 GDPR.

The app does suggest classes based on the answers you gave during onboarding. That suggestion is produced by fixed rules, it is a suggestion about which yoga class to open, and it has no legal or similarly significant effect on you. The whole catalogue remains browsable and searchable regardless of what it suggests.

13. Changes to this policy

If we change this policy we publish the new version at this address with a new update date and a new version number. The date and the version at the top of this page are the record of which text is in force.

If the changes concern the purposes of processing or the legal bases we rely on, we notify you inside the app and, where consent is required, ask for it afresh.

14. Contact

For anything about your personal data, write to support@launchd.online or use the contact form. Both reach the controller directly.

Sereno Studio is a wellness product. It is not a medical device and does not replace the advice of a doctor.