Privacy Policy

GermanBuddy ("we", "our", or "us") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard information when you use the GermanBuddy language learning platform accessible at germanbuddy.de and its associated mobile applications.

By using GermanBuddy, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use our services.

We collect the following categories of personal data:

• Account data: Your name, email address, and hashed password when you register.
• Learning data: Lesson progress, vocabulary reviews, quiz scores, study streaks, and XP earned.
• Usage data: Pages visited, features used, session durations, and device/browser information.
• Communications: Messages you send to our support team.
• Third-party sign-in: If you sign in with Google, we receive your Google profile name, email, and profile picture.

We use your data to:

• Provide, operate, and improve the GermanBuddy service.
• Personalise your learning experience and calculate spaced repetition intervals.
• Send transactional emails (email verification, password reset).
• Analyse aggregate usage trends to improve the platform.
• Respond to your support requests.
• Comply with legal obligations.

We do not sell your personal data to third parties.

GermanBuddy uses a single HttpOnly authentication cookie to maintain your session. This cookie is not accessible to JavaScript and cannot be read by third-party scripts.

We do not use advertising cookies, tracking pixels, or third-party analytics beyond basic server-side request logging.

Your data is stored in encrypted PostgreSQL databases hosted in the EU. Passwords are hashed using bcrypt with a cost factor of 10 before storage — we never store plaintext passwords.

We apply industry-standard security practices including TLS encryption in transit, regular backups, and role-based access control for our team.

We retain your account data for as long as your account is active. If you delete your account, we remove your personal data within 30 days, except where retention is required by law.

Anonymised and aggregated learning analytics may be retained indefinitely to improve our educational models.

If you are located in the European Union, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your personal data ("right to be forgotten").
• Restrict processing of your data.
• Data portability — receive your data in a machine-readable format.
• Object to processing based on legitimate interests.

To exercise any of these rights, email us at privacy@germanbuddy.de. We will respond within 30 days.

GermanBuddy may integrate with the following third parties:

• Google OAuth: For optional sign-in. Subject to Google's Privacy Policy.
• OpenAI: For AI pronunciation analysis. Audio is processed transiently and not stored by OpenAI beyond the API call.
• YouTube: When you import vocabulary from YouTube URLs, the video transcript is fetched via the YouTube Data API.

GermanBuddy is not directed at children under 13 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

We may update this Privacy Policy from time to time. We will notify registered users by email of any material changes. Continued use of GermanBuddy after the effective date constitutes acceptance of the new policy.

For privacy-related questions, contact us at: privacy@germanbuddy.de