Privacy notice

The controller for data processing on this website and in the GermanBuddy application is [REQUIRED: full name, or company name with legal form and authorised representative], [REQUIRED: street, postcode and city].

Contact: legal@germanbuddy.de. For privacy questions you can also write to privacy@germanbuddy.de.

GermanBuddy is under development. It is a test, not a finished product, and it is open only to testers who have been expressly invited. If you have not been invited, please do not enter any data, and do not enter real personal data of third parties.

The lessons are for learning German. Please do not rely on them where something must be reliably correct, for example in official or legal matters.

When you open GermanBuddy, the hosting provider processes technically necessary connection data (in particular IP address, date and time, page requested, browser and operating system details) to deliver the pages and keep operation secure. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation). The data is kept only as long as necessary for that purpose.

After you sign in, one technically necessary cookie (an HttpOnly session cookie) keeps you signed in. Your display settings, such as theme and language, are stored in your browser. We use no advertising, tracking or analytics services. Apart from the optional features in section 6, we load no fonts or scripts from third parties. If the app fails in your browser, a technical error report is sent to our own server.

GermanBuddy is operated with the following service providers. A data processing agreement under Art. 28 GDPR is, or will be, concluded with each of them.

• Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA: hosting of the web application. Data may be transferred to the USA. Where the provider is certified under the EU-US Data Privacy Framework, or EU standard contractual clauses are in place, the transfer relies on them (Arts. 45, 46 GDPR).
• Supabase: database, in the EU region (Stockholm, Sweden). Supabase is a US company; where data is accessed from outside the EU, the transfer relies on the EU-US Data Privacy Framework or standard contractual clauses (Arts. 45, 46 GDPR).
• STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany: sending emails such as sign-in codes and study reminders.

For the test we process the following data of invited testers:

• Account data: name, email address, hashed password, role and language settings.
• Learning data: lesson progress, vocabulary reviews, quiz scores, study streaks and points, daily goal.
• Security data: sign-in attempts, session data and logs of changes, so that we can protect accounts and find faults.
• Support messages: what you write to us.
• Emails: sign-in codes and, if you leave them on, study reminders. Every reminder email has a one-click opt-out.

Purpose: providing and securing the test. Legal basis: Art. 6(1)(b) GDPR (use of the app you were invited to) and Art. 6(1)(f) GDPR (legitimate interest in security and in improving the test). You can download your data or delete your account yourself in Settings, in the Account section.

These features send data to a third party only when you use them:

• Google sign-in: if you choose to sign in with Google, we receive your name, email address and profile picture from Google. Google's privacy policy applies.
• Pronunciation practice (Microsoft Azure Speech): when you allow the microphone, your recording is sent over an encrypted connection, together with the target sentence, for assessment. We do not store the recording, only your score and the feedback text. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by not using the feature or by revoking the microphone permission.
• YouTube import: if you import vocabulary from a YouTube link, the video's transcript is fetched through the YouTube Data API.
• AI features: these are switched off by default. If they are switched on, the text you submit to an AI feature is sent to the AI provider we have set up (currently OpenAI) to produce the result. Please do not enter personal data there.

We keep your account and learning data while your account exists. If you delete your account, we delete your personal data within 30 days, unless a legal retention duty applies. When the test ends, all test data is deleted, or earlier if you ask. Server logs are kept only as long as needed for security and fault-finding.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). Where processing rests on your consent, you can withdraw it at any time with effect for the future (Art. 7(3)).

Contact: privacy@germanbuddy.de. We reply within 30 days. Much of this you can do yourself in Settings, in the Account section.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement.

No automated decision-making, including profiling, under Art. 22 GDPR takes place. GermanBuddy calculates when a word is due for review and suggests the next lesson; these suggestions have no legal or similarly significant effect on you.

GermanBuddy is intended for people aged 16 and over. If you are younger, please use it only with the consent of your parents or guardians.

We update this notice when the offering or the law changes. The version published here applies.