Privacy Policy

Overview

Yudemon is designed with privacy at its core. We believe your health and practice data belongs to you, and we've built our products to respect that principle.

The Yudemon mobile app (Yudemon HRV) works entirely on your device without requiring any account or data sharing. ApexFlow, our racing analytics platform, requires cloud storage to function but gives you full control over your data.

Yudemon HRV Mobile App

Local-Only Usage (No Account)

When using Yudemon HRV without an account:

• No personal information is collected or transmitted
• All data (practice sessions, settings, progress) stays entirely on your device
• No network communication occurs except for subscription processing
• We cannot access, view, or recover your data

Account-Based Usage (Optional)

Required Information:

• Email address only – used for account authentication, recovery, and occasional product updates (you can unsubscribe anytime)

Optional Data (Only if you enable cloud sync):

• Practice statistics (session counts, duration, streaks)
• App preferences (breathing rates, session settings, audio levels)
• Heart rate variability data and session averages
• Journey mode progress and personal resonance frequency discoveries

Cloud sync is entirely optional. You control exactly what data gets backed up through individual category toggles in your account settings.

ApexFlow Racing Analytics

ApexFlow combines heart rate data with racing telemetry to help drivers understand their physiological state during racing sessions. Unlike the main Yudemon HRV app, ApexFlow requires cloud storage to function – there is no local-only mode.

Data We Collect

From the Desktop App:

• Heart rate data: Beat-by-beat RR intervals from your Bluetooth heart rate sensor (e.g., Polar H10)
• Racing telemetry: Data from your iRacing sessions including speed, throttle, brake, steering, lap times, and track position

Processed and Stored:

• Session metadata: Track name, car name, session type (practice/qualifying/race), duration
• Physiological metrics: Heart rate, heart rate variability (RMSSD), and breathing rate estimates
• Performance data: Lap times, incidents, position changes
• GPS coordinates: Virtual track positions from the racing simulation
• User-provided tags: Custom labels you add to sessions

What We Don't Collect

• Your iRacing username or account information
• Your real-world location or IP address (beyond standard web traffic)
• Any data from outside your racing sessions

Data Storage and Retention

• Raw files (telemetry and heart rate recordings): Retained indefinitely until you delete the session or your account
• Processed session data: Retained indefinitely until you delete the session or your account
• Session summaries: Cached for fast loading, updated when sessions change

ApexFlow-Specific Processing

Your data is processed by automated systems to:

• Parse racing telemetry files and extract relevant variables
• Detect and correct artifacts in heart rate data
• Compute heart rate variability metrics
• Align physiological data with telemetry timestamps
• Identify laps, incidents, and position changes
• Generate per-lap and session-level statistics

This processing happens automatically when you upload a session. No human reviews your individual data.

How We Use Your Information

Email Addresses

• Account authentication and password recovery
• Occasional product updates and feature announcements (unsubscribe available)
• Never shared with third parties

Health and Practice Data

• Stored securely in your personal, private cloud storage
• Used primarily for cross-device data synchronization and to provide insights and analytics to you
• When you use our web dashboard, summary metrics derived from your sessions (for example session duration, average heart rate, heart rate variability, and breathing rate) – but never your raw beat-by-beat recordings – may be processed at an individual, identified level by our analytics provider (PostHog) to help us understand how features are used and improve our products
• We never sell your data, and we never share it with third parties other than the service providers that operate the product on our behalf under contractual data-protection obligations
• You can export or delete all data at any time

Sharing With a Coach (Optional)

• You can choose to share your session analytics with a coach or practitioner by entering their email address in your account settings – this is entirely optional and off by default
• Sharing gives that person read-only access to your session analytics on the web dashboard (sessions, trends, insights, and per-session detail including heart-rate data); they cannot change or delete anything, and they never see your account settings
• The moment you share is recorded as your consent, and you can revoke access at any time from the same settings page – access ends immediately
• Sharing relationships are included in your data export and are permanently removed when either account is deleted

Third-Party Services

Firebase (Google)

• Manages secure account authentication and cloud data storage
• Your data is stored in your individual, private database
• Complies with HIPAA and GDPR requirements
• Google cannot access your personal health data

Google BigQuery

• Stores processed session data for analytics queries
• Same privacy protections as Firebase
• Data partitioned and isolated by user

Google Cloud Storage (ApexFlow Only)

• Temporarily stores raw telemetry and heart rate files during processing
• Files automatically deleted after 90 days
• Access restricted to your account only

RevenueCat

• Handles subscription management across platforms
• Only receives subscription status, not personal or health data
• Enables sharing Yudemon Pro across iOS, Android, and web platforms

PostHog (Web Dashboard Analytics)

• Provides product analytics and session replay for our web dashboard (app.yudemon.com), so we can understand how the dashboard is used and improve it
• Receives usage events tied to your account identifier – including which features you use, page performance/loading times, and summary session metrics (such as average heart rate, heart rate variability, and breathing rate). It never receives your email address or your raw beat-by-beat recordings
• Session replay records your interactions with the dashboard with all text and input fields masked, so the actual values and content you view are not captured
• Processes this data solely on our behalf under a data-processing agreement, and does not sell it
• Used only on the web platform – the mobile app does not use PostHog

Apple App Store / Google Play Store

• Processes subscription payments
• Shares only necessary transaction information with RevenueCat
• We do not receive your payment information

Your Data Rights

Access and Control

• View all your data anytime in the app or web dashboard
• Export all your data in standard formats
• Choose exactly what data to sync to the cloud (HRV app)
• Disable cloud sync at any time (HRV app)

Data Deletion

• Delete your account and all cloud data instantly from within the app or web dashboard
• Delete individual ApexFlow sessions at any time
• Local data remains on your device unless you manually delete the app
• Automatic deletion of cloud data after account deletion

Data Portability

• Export your complete practice history, settings, and progress
• Export ApexFlow sessions with full telemetry and physiological data
• Data provided in machine-readable formats for use with other applications

Data Security

Local Storage (Mobile App)

• All data encrypted using iOS/Android system-level security
• Protected by your device's security (passcode, biometrics)

Cloud Storage

• Secure encryption during transmission (TLS) and at rest
• Hosted on Google Cloud with enterprise-grade security
• Access controls ensure only you can access your data
• Security managed by Google's infrastructure and monitoring

Geographic Considerations

International Users

• Data may be stored in Google Cloud facilities worldwide
• All storage locations comply with applicable privacy laws
• EU users' data handled in compliance with GDPR

California Residents (CCPA)

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of sale (we never sell data)
• Right to non-discrimination for exercising these rights

Children's Privacy

• Yudemon is not intended for children under 13
• We do not knowingly collect information from children under 13
• If we learn we have collected such information, we will delete it immediately

Health Data Considerations

• Heart rate variability data is considered sensitive health information
• We treat all practice and health data with the highest level of protection
• Never sold and never used for advertising. We may use aggregated, de-identified data for internal research and to improve our products, but we will never share your data with external researchers or any other third parties (beyond the service providers that operate Yudemon on our behalf) without your explicit consent
• You maintain complete ownership and control of your health data

Changes to This Policy

• We will notify users of significant changes via email or in-app notification
• Continued use after changes constitutes acceptance
• Previous versions available upon request

Data Retention Summary

Contact Information

For privacy questions or to exercise your data rights:

• Email: privacy@yudemon.com
• Website: www.yudemon.com
• Response time: Within 30 days as required by law

Legal Basis for Processing (GDPR)

• Account creation: Contract performance
• Cloud sync: Your explicit consent (you can withdraw anytime)
• App functionality: Legitimate interest in providing the service
• Communication: Your consent (easily withdrawn)
• Web dashboard analytics & session replay: Your consent (covered by the same consent that enables cloud data and the web dashboard; you can withdraw at any time)

Key Principles

Yudemon HRV works completely offline and locally by default. All cloud features are optional enhancements that you explicitly choose to enable.

ApexFlow requires cloud storage to function, but you maintain full control: data uploads require manual approval, you can delete any session, and you can export or delete all your data at any time.

Your privacy and data ownership are never compromised.