1.Who We Are (Data Controller)

GermanLing (“we”, “us”, “our”) provides the GermanLing mobile application (the “App”) and is the data controller responsible for your personal information.

Contact: support@germanling.app

For any privacy questions or to exercise your rights, contact us at the email above.

2.Information We Collect (Data Minimization)

We collect only the minimum data needed to run the App:

Account information: your email address only, used solely to create, secure, and manage your account (including, if you choose them, Google or Apple sign-in identifiers).

Dashboard data: the minimal learning data needed to generate your personal dashboard — lesson progress, scores, streaks, and achievements — plus the written and spoken responses you submit for AI grading.

Preferences: interface language, theme, font size, daily goal, and notification settings.

Purchase data: purchase/subscription receipts used to verify entitlements. Payment card details are handled solely by the app stores; we never receive or store them.

Device & technical data: crash diagnostics needed to keep the App working reliably.

We collect nothing else. We do not intentionally collect special-category/sensitive data and ask that you not include it in free-text or audio submissions.

3.How and Why We Use Your Information (Purposes)

• Provide, maintain, and secure the App and your account
• Track progress and personalize content (e.g. spaced-repetition review)
• Grade your writing/speaking practice using AI (see Section 9)
• Process subscriptions and prevent fraud/abuse (usage quotas)
• Send on-device study reminders and service messages (where enabled)
• Diagnose crashes and improve the App
• Comply with legal obligations and enforce our Terms

4.Legal Bases for Processing (EU/EEA & UK GDPR)

Where the GDPR applies, we rely on:

• Contract (Art. 6(1)(b)): to provide the App and the features you request, including AI grading you initiate.
• Legitimate interests (Art. 6(1)(f)): to secure the service, prevent abuse, and improve the App, balanced against your rights.
• Consent (Art. 6(1)(a)): for optional notifications/reminders, where required. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): to comply with applicable law.

5.Sharing and Disclosure

We do not share your information with anyone. We never sell, rent, or trade your personal information, and we never disclose it to third parties for marketing or advertising.

Your data is processed only by the infrastructure providers that run the App strictly on our instructions — Google Firebase/Google Cloud (authentication, database, storage, serverless functions, crash reporting) and the Google Gemini API for AI grading (inference-only; never used to train models) — and by the Apple App Store or Google Play Store when you make a purchase. These providers cannot use your data for their own purposes.

We may disclose information only where the law requires it. We do not use your content to build advertising profiles.

6.International Data Transfers

We use Google Cloud infrastructure, and your data may be processed in the United States and other countries that may not provide the same level of protection as your home country. Where we transfer personal data out of the EEA, UK, or other regulated regions, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum) and equivalent mechanisms.

7.Data Retention

We retain personal data for as long as your account is active and as needed to provide the App. Audio recordings submitted for speaking grading are deleted shortly after grading completes (and in any case within 24 hours). When you delete your account, we permanently delete your associated personal data within 30 days, except where we must retain limited records to meet legal, tax, or security obligations.

8.Security

We use appropriate technical and organizational measures, including encryption in transit, access controls, and a server-side architecture that keeps API credentials off your device. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We will notify you and regulators of data breaches where required by law.

9.AI Grading Data Flow

When you submit a writing or speaking response, your text or audio is sent through our secure server to Google’s Gemini API for grading. Audio is deleted immediately after grading (or within 24 hours if grading fails). Your transcribed text and score are retained on your account so you can review your practice history. The API is configured for inference only — your data is not used to train Google’s models. Please avoid including personal or sensitive details in your responses.

10.Your Rights — EU/EEA & UK (GDPR)

You have the rights to access, rectify, erase, restrict, and port your data, to object to certain processing, and to withdraw consent. You can exercise erasure directly by deleting your account in Settings, or contact us at support@germanling.app. You also have the right to lodge a complaint with your local supervisory authority (in the UK, the ICO).

11.Your Rights — California (CCPA/CPRA)

California residents have the right to know/access the categories and specific pieces of personal information collected, the right to delete, the right to correct, and the right to opt out of “sale” or “sharing” of personal information. We do not sell or share personal information as those terms are defined under the CPRA, and we do not use or disclose sensitive personal information for purposes requiring an opt-out. We will not discriminate against you for exercising your rights. To make a request, contact support@germanling.app; we will verify your request via your account email. You may use an authorized agent.

12.Your Rights — Canada (PIPEDA)

If you are in Canada, you may access and request correction of your personal information and withdraw consent (subject to legal or contractual limits). We collect, use, and disclose personal information only for purposes a reasonable person would consider appropriate. You may direct questions or complaints to us at support@germanling.app, and you may escalate to the Office of the Privacy Commissioner of Canada.

13.Your Rights — Australia (Privacy Act / APPs)

If you are in Australia, the Australian Privacy Principles apply. You may request access to and correction of your personal information, and complain about how we handle it by contacting support@germanling.app. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC). We will take reasonable steps to notify you and the OAIC of eligible data breaches.

14.Children’s Privacy

The App is not directed to children under 13 (or the minimum age required in your country, such as 16 in parts of the EEA). We do not knowingly collect personal information from children below the applicable age. If you believe a child has provided us data, contact support@germanling.app and we will delete it.

15.Third-Party Services

• Firebase Authentication, Cloud Firestore, Firebase Storage, Cloud Functions, Crashlytics (Google)
• Google Gemini API (AI grading)
• Apple App Store / Google Play Store (purchases)

These providers process data under their own privacy policies, which we encourage you to review. They act only as processors on our behalf and may not use your data for their own purposes.

16.Changes to This Policy

We may update this Policy from time to time. Material changes will be notified in the App, and we will update the “Last updated” date above. Continued use after changes take effect constitutes acceptance.

17.Contact Us

For privacy questions or to exercise your rights, contact GermanLing at support@germanling.app.