Data Controller

The data controller responsible for this application is:

If you have any questions about data protection, you can reach us at the above address at any time.

Introduction

Learn Deutsch in Steps ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our language learning application on the web, on Android (via Google Play), or on iOS (via the Apple App Store).

As a service based in Germany, we adhere to the strict requirements of the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and the Digital Services Act (DDG).

Information We Collect

1. Personal Information

• Account Data: Email address, name, surname, password (hashed with industry-standard bcrypt)
• Contact Information: Email used for support requests
• Preferences: Language preference for translations, UI theme settings

2. Learning Data

• Words you've learned and their mastery levels (0%–100% scale)
• Learning progress, statistics, and study session history
• Categories and CEFR levels (A1–C1) you are studying
• Coin balance, daily login streaks, and category unlock history

3. Technical Data

• Device information (browser type, operating system, device model)
• IP address (used for security and rate limiting; not stored long-term)
• Authentication tokens (session cookies on web, encrypted tokens on mobile)
• Crash reports and basic usage analytics (pages visited, features used)

4. Information We Do Not Collect

• We do not collect precise geolocation data
• We do not collect contacts, photos, or other device data
• We do not record audio from text-to-speech playback

How We Use Your Information

We use your information for the following purposes:

• Service Provision: To provide and maintain our language learning service, including syncing progress across devices
• Personalization: To customize your learning experience, track progress, and manage your coin balance
• Communication: To respond to support requests, send account-related notifications, and inform you of important service changes
• Security: To protect against fraud, unauthorized access, and abuse (including rate limiting and token validation)
• Improvement: To analyze anonymized usage patterns and improve our service
• Legal Compliance: To comply with legal obligations under German and EU law

Legal Basis for Processing

Under Article 6 GDPR, we process your data based on the following legal grounds:

• Contract Performance (Art. 6(1)(b) GDPR): Processing necessary to provide our service — e.g., account management, progress tracking, coin economy
• Consent (Art. 6(1)(a) GDPR): Where you have given explicit consent — e.g., optional analytics, marketing communications. You may withdraw consent at any time
• Legitimate Interest (Art. 6(1)(f) GDPR): For service security, fraud prevention, and improvement. Our interest does not override your fundamental rights
• Legal Obligation (Art. 6(1)(c) GDPR): To comply with tax, commercial, or regulatory requirements

Third-Party Services and SDKs

Our app integrates the following third-party services. Each processes data as described below:

AI-Generated Content

Parts of our educational content, including translations and example sentences, are generated or assisted by artificial intelligence tools. While we review this content for accuracy, minor errors may occur. This AI-assisted content creation does not involve the processing of your personal data.

Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties. We may share data only in the following cases:

• Service Providers: Third-party processors listed above who help us operate the service (all bound by data processing agreements)
• Legal Requirements: When required by German or EU law, court order, or governmental request
• Business Transfers: In case of merger or acquisition (you will be notified in advance and may delete your account)

All third-party data processors are contractually bound to comply with GDPR and maintain appropriate data protection standards.

Data Storage and Security

• Location: All data is stored on servers located within the European Union
• Encryption: Passwords are hashed using bcrypt. Data in transit is encrypted via TLS/HTTPS. Mobile refresh tokens are stored in platform-secure storage (Android Keystore / iOS Keychain)
• Access Control: Strict role-based access controls and multi-factor authentication for administrative access
• Retention: Account data is kept for the duration of your account. Learning progress is retained to enable seamless continuation. Upon account deletion, all personal data is permanently removed within 30 days
• Backups: Regular encrypted backups for data integrity, retained for up to 90 days before permanent deletion

Account Deletion

You can delete your account at any time from within the app under Settings → Account → Delete Account. Account deletion will permanently remove:

• Your profile information (name, email)
• All learning progress and statistics
• Coin balance and transaction history
• All category unlock records

Your Rights Under GDPR

Regardless of your location, you have the following rights regarding your personal data:

To exercise any of these rights, please contact us at contact@learndeutsch.de

We will respond to your request within 30 days as required by GDPR.

Cookies and Local Storage

We use essential cookies and local storage for:

• Authentication: Session cookies for web login, encrypted tokens for mobile authentication
• Preferences: Language selection and theme settings
• Security: CSRF protection and rate limiting

We use only strictly necessary cookies. We do not use advertising, analytics, or third-party tracking cookies. No cookie consent banner is required because all cookies are essential for service functionality under ePrivacy regulations.

Children's Privacy

Our app is an educational language learning tool suitable for users of all ages. However, under the General Data Protection Regulation (GDPR), we require parental or guardian consent for processing personal data of users under 16 years of age. Children under 16 may use the app with parental consent. If we become aware that we have collected data from a child under 16 without appropriate parental consent, we will promptly delete the account. Parents or guardians can contact us at contact@learndeutsch.de to review or request deletion of their child's data.

International Data Transfers

Our servers are located within the European Union. Some third-party services (e.g., RevenueCat, Google, Apple) may process data outside the EU/EEA. Where this occurs, appropriate safeguards are in place, including EU Standard Contractual Clauses (SCCs) or adequacy decisions by the European Commission, to ensure your data receives an equivalent level of protection.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification at least 14 days before the changes take effect. The "Last updated" date at the top will be revised accordingly. Continued use of the service after the effective date constitutes acceptance of the updated policy. If you disagree with the changes, you may delete your account.

Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. The competent German federal authority is:

You may also contact the data protection authority of the German federal state in which we are located, or the authority in your own EU member state.

Contact Us

For any questions about this Privacy Policy, data protection, or to exercise your rights, please contact:

German Legal Documents

As required by German law, legally binding German-language versions of our legal documents are available below.