Privacy Policy
1. Who we are
Klartakt ("we", "us") is a mobile application for learning German. This policy explains what personal data we process, why, on what legal basis, and your rights. Maryam Rabiee is the data controller for the processing described here.
2. Data we process
You provide:
- Account data — email address, and a password (stored only as a secure hash by our authentication provider) or a Sign in with Apple / Google identifier.
- Learning data — study progress, spaced-repetition state, streaks, daily goals, study sessions, chosen level and exam goal, and settings (app language, translation language, audio preferences).
- Content you create — custom vocabulary cards you add, and error reports/flags you submit about cards.
- Social & classroom data — friend connections you make, and, if you join a class, your membership and homework/assignment progress, which is visible to the teacher who owns that class and (in limited form) to classmates.
- Conversation data (Pro "Gespräch") — the text and voice audio you send to the AI conversation partner, and its transcriptions.
Collected automatically:
- Technical & diagnostic data — device/OS type, app version, crash reports and error logs.
- Purchase data — subscription status and transaction identifiers. We never receive your full card or bank details — those are handled by Apple/Google.
- Usage data — in-app events used to improve the product.
We do not collect precise location, contacts, or advertising identifiers, and we do not sell your personal data or use it for third-party advertising.
3. Why we process it, and the legal basis (GDPR Art. 6)
| Purpose | Legal basis |
|---|---|
| Create and run your account; sync progress across devices | Performance of a contract (Art. 6(1)(b)) |
| Provide learning, grammar, dictionary, and conversation features | Performance of a contract |
| Process subscriptions and entitlements | Performance of a contract |
| Send study reminders / push notifications | Consent (Art. 6(1)(a)) — you can disable them |
| Diagnose crashes and improve the app | Legitimate interests (Art. 6(1)(f)) |
| Prevent abuse, secure the service | Legitimate interests |
| Comply with legal obligations (e.g. tax on purchases) | Legal obligation (Art. 6(1)(c)) |
4. AI features and third parties
- Conversation partner & audio — text/voice you submit is sent to OpenAI and Anthropic to generate replies, transcriptions, and audio.
- Dictionary — look-ups query Wiktionary (de.wiktionary.org); the searched word is sent to that service. Wiktionary content is used under CC BY-SA with attribution shown in the app.
- Where our AI providers offer the option, we do not permit your content to be used to train their models.
5. Service providers (processors)
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Database, authentication, storage (hosted in the EU, eu-central-1) | Account + learning data |
| RevenueCat | Subscription management | Subscription status, transaction IDs |
| Sentry | Crash and error reporting | Device/app diagnostic data |
| OpenAI | Content generation, text-to-speech, transcription | Conversation text/audio |
| Anthropic | Grammar lessons, AI conversation partner | Conversation text |
| Google (Gemini) | Internal content-quality checks | Content only, not user personal data |
| Resend | Transactional email (sign-up, password reset) | Email address |
| Apple / Google | Sign-in and app-store purchases | Per their own privacy policies |
6. International transfers
Our primary database and storage are hosted in the European Union. Some providers listed above may process data outside the EEA (for example in the United States). Where they do, transfers are safeguarded by mechanisms such as the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
7. How long we keep data
- Account and learning data: for as long as your account exists.
- On your device: an offline copy of your own data, plus a rolling ~8-day window of study sessions (the server keeps the durable long-term history).
- Crash/diagnostic data: up to 90 days.
- After account deletion: erased or anonymised within 30 days, except where we must retain records to meet legal obligations (e.g. tax records for purchases).
8. Your rights (GDPR)
You have the right to access, rectify, erase, restrict and port your data, and to withdraw consent at any time. You can delete your account and all associated data from within the app (Settings → Account), or contact us at p.gomaar@gmail.com.
Your right to object (Art. 21 GDPR)
You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data that is based on our legitimate interests (Art. 6(1)(f)) — including the crash-reporting and product-improvement processing described in section 3.
To exercise this right, email p.gomaar@gmail.com. If you object, we will stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms.
You may also lodge a complaint with a supervisory authority. For Bavaria this is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), or the authority in your own country of residence.
9. Children and younger learners
Klartakt is not directed at children and is not marketed as a children's service. Creating an account requires you to be at least 16, the age of digital consent in Germany (GDPR Art. 8). We do not knowingly collect personal data from children under 16 who have registered on their own.
Younger learners may use Klartakt under the account and supervision of a parent, legal guardian, or teacher — for example as a member of a class their teacher created. In that case the supervising adult is the account holder, is responsible for any consent required under Art. 8 GDPR, and should supervise use of the AI conversation and social/classroom features.
If you believe a child under 16 has registered their own account, contact p.gomaar@gmail.com and we will delete the account and its data.
10. Security
We use encryption in transit, hashed passwords, and row-level access controls so that you can only access your own data. No system is perfectly secure, but we take reasonable measures to protect your information.
11. Changes
We may update this policy; we will post the new version here and update the effective date, and notify you of material changes where required.
12. Contact
Maryam Rabiee · Unterbiberger Straße 20, 81737 Munich, Germany · p.gomaar@gmail.com