Privacy Policy

1. Controller Daniel Weidensdörfer, Bautzner Str. 22, c/o Quartier22, 01099 Dresden, Germany Email: hallo@danielweidensdoerfer.de 2. What data we process a) Account: email address, user ID, username. When you sign in with Google, additionally your name, Google account ID and the link to your profile picture (for display in the app). We only store the link, not the image itself. Providing your email address, username and password is required for registration and for providing the app (mandatory information). Without this data we cannot create an account for you. b) Learning content and settings: card sets (languages, topic), vocabulary pairs, learning progress (correct/incorrect, streaks, learning level, last answer), recently used languages and app settings (e.g. cards per day). c) AI generation: Your inputs (e.g. languages, topic, text) and the generated language pairs. d) Credits and purchases: credit balance and changes. For purchases we store purchase data. For Google Play and the Apple App Store, this is the purchase token/transaction ID, product, order number, time and refund status. For Stripe, this is name, email, billing and payment data as well as invoices. We do not receive card numbers. You enter them directly with the payment provider. e) Technical data: device, operating system, app version, error reports, IP address and web server log files. f) Usage data (only with consent): app usage, events. g) Feedback and error reports: topic, message, time and user ID. For failed AI generations we store the time and user ID. 3. Purposes and legal bases - Account, learning content, AI generation, credits: performance of a contract (Art. 6(1)(b) GDPR). - Error reports (Sentry): legitimate interest in a stable and secure app (Art. 6(1)(f) GDPR). - Purchases and accounting: performance of a contract and legal obligation (Art. 6(1)(b), (c) GDPR). - Sign-in with Google: performance of a contract (Art. 6(1)(b) GDPR). - Feedback and error analysis: performance of a contract or legitimate interest (Art. 6(1)(b), (f) GDPR). - System emails (AWS SES): performance of a contract (Art. 6(1)(b) GDPR) for the automated sending of necessary emails (e.g. for account confirmation or password reset). - Hosting of the website/app (Firebase Hosting): legitimate interest in a stable, secure and fast provision of our online presence (Art. 6(1)(f) GDPR). - Email communication and support (Google Workspace): performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR) or legitimate interest in the efficient handling and answering of your enquiries (Art. 6(1)(f) GDPR). - Domain and name servers (Spaceship): legitimate interest in the reliable and secure availability of our domain (Art. 6(1)(f) GDPR). 4. Recipients and processors - Supabase, Inc. (USA) (hosting, authentication, database): The data is stored on servers in Frankfurt (EU). - Google Firebase Hosting: Provided by Google Ireland Limited. This service provides the infrastructure for delivering our website and web app. - Functional Software Inc. (Sentry), USA: Error reports. The data is stored in the EU. - Google Ireland Limited (Gemini API): Your inputs for AI generation are transmitted to Google. Google does not use these inputs to train its models. - Google Ireland Limited (Sign-in with Google): Google learns that you are signing in to our app. If the app displays your profile picture, your device loads it directly from Google servers. In doing so, Google receives technical data such as your IP address. Google's privacy policy also applies. - Google Workspace: Provided by Google Ireland Limited. We use this service to manage our email inbox (hallo@danielweidensdoerfer.de). When you send us an email, your message, your name and your email address are processed on Google's servers. - Payment processing: Google Play (Google Ireland Limited) and Apple App Store (Apple Distribution International Ltd., Ireland) (in-app purchases). Stripe Payments Europe Ltd., Ireland (web purchases). Payment data such as card numbers is processed only by the respective payment service. We store purchase data as described under 2d. - Spaceship (domain registrar): Provided by Spaceship, Inc., USA. Spaceship operates the name servers of our domain and processes the DNS requests when the app/website is accessed. - Amazon Web Services (AWS) SES: Provided by Amazon Web Services EMEA SARL, Luxembourg. We use this service for the reliable sending of technical and system-related emails. 5. Transfers to third countries Supabase and Sentry store data in the EU. Because the providers Supabase, Inc. and Functional Software Inc. are based in the USA, access from the USA cannot be ruled out. Google (Firebase, Gemini, sign-in, Workspace), Stripe, Spaceship and AWS may transfer data to the USA. This is based on the EU-US Data Privacy Framework or on standard contractual clauses. 6. Storage period We store data as long as your account exists. After deletion we remove it, unless statutory retention periods apply (e.g. 8 years for accounting records). You can delete your account directly in the app settings. When you delete your account, we remove your account and learning data. We keep purchase and invoice data for up to 8 years due to statutory retention periods. It is then blocked for other purposes. Server log files (hosting, API, authentication) are deleted after 30 days at the latest. Emails to us are stored until your enquiry is resolved. After that we delete them, unless statutory retention obligations apply. 7. Your rights Access, rectification, erasure, restriction, data portability, objection and withdrawal of consent. Write to hallo@danielweidensdoerfer.de. You can lodge a complaint with a supervisory authority, in particular with the Saxon Data Protection and Transparency Commissioner (Sächsische Datenschutz- und Transparenzbeauftragte). Right to object: Where your data is processed to safeguard legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time, on grounds relating to your particular situation. To do so, write to hallo@danielweidensdoerfer.de. 8. No automated decision-making (profiling) We do not make decisions with legal effect based solely on automated processing. The AI only generates learning content. 9. Minimum age The app is intended for users aged 16 and over. 10. Changes We amend this policy as necessary. The version currently published always applies. Last updated: 09.11.2026