Privacy Policy

1. Information We Collect

When you create an account, we collect your email address, username, and password (stored securely as a bcrypt hash). If you use Sign in with Apple, we receive only the account information you authorize Apple to share. We store Apple's opaque user identifier, additionally in protected Keychain storage on iOS, and an encrypted Apple refresh token only for sign-in, status checks, and revocation. For verified Apple account changes, we store forwarding status and, for at most 90 days, only a one-way hash of the event identifier with its type, time, and processing outcome. That event ledger never stores the signed event, Apple user identifier, or relay address, and we never store your password or Apple token in plain text.

As you use the app, we collect your learning progress (practiced content, mastery scores, error patterns, active-practice seconds aggregated by day and trainer, and answered-task counts plus active-practice seconds aggregated by local clock hour without a date, trainer, or content), XP and streak data, CEFR-level Speed Round best scores, custom collections, device tokens for push notifications, and the product, transaction, and entitlement information required to verify a purchase. We do not receive your full payment-card details. For data-minimized product measurement, we also store one-time account milestones (first authenticated app open, completed onboarding, first learning day, first completed learning session, and a return on a later learning day) together with platform, app version, build number, and interface language. We do not collect advertising or device identifiers, IP addresses, answers, scores, individual response timings, tap or click histories, or free-form event properties for this measurement.

2. How We Use Your Information

• Provide personalized spaced repetition learning
• Track your progress and mastery levels
• Send push notifications (daily reminders, streak warnings)
• Display leaderboards and league rankings
• Improve the app experience using aggregate product milestones

3. Data Storage

Your data is stored on secure servers. Learning progress is stored in PostgreSQL, and session data uses Redis with automatic expiration. While offline, answers that have not yet been sent are stored temporarily on your device under the active account; signing out or deleting the account removes them from the device. Data-minimized product measurement happens only on our servers; we do not use a third-party analytics SDK for it. We use Firebase Cloud Messaging for push notifications.

Learning Reminder Measurement

Learning reminders are on by default, are sent only if you allow notifications on your device, and can be turned off in the app at any time. While reminders are on, we keep only the latest sent, opened, and resulting-learning timestamps per account and reminder type. We use them to enforce message limits, prevent duplicate counting, and measure whether reminders help. Daily reporting contains only aggregate opt-in snapshots, FCM-accepted sends, explicit opens, and the first server-accepted learning interaction within 24 hours. It contains no learner or device dimension, notification or learning content, raw answers, provider message identifiers, or free-form properties. FCM acceptance does not prove that the operating system displayed a notification. Account-linked operational timestamps are deleted with the account. Practice reminders and weekly recaps are optional and initially off. We store the device IANA time zone for local scheduling. A counter capped at three reminders without subsequent learning reduces reminder frequency; this operational state is also deleted with the account.

Ephemeral Catalog Search

When you use German Explorer, we send your search term only inside the encrypted request body to the Deutsch Hero backend to answer that current catalog lookup. The term is not placed in the request URL, stored in our database, used for product measurement or analytics, or shared with ElevenLabs, Cloudflare R2, the CDN, or any other third party. Offline search stays entirely on your device.

Local Pronunciation Recordings

If you use the optional pronunciation exercise, Deutsch Hero accesses the microphone only while you record. Each recording stays solely in temporary storage on your device, is never uploaded, analyzed, or used for advertising, and is removed when you retry, change the sentence, leave the exercise, or interrupt the app. Deutsch Hero does not automatically grade or score your pronunciation.

Optional Crash Diagnostics

Crash diagnostics are on by default and can be turned off in Profile at any time. While they are on, Firebase Crashlytics receives technical crash reports. These reports can contain the crash stack and process state, app and build version, installation identifiers, device model, operating-system version, architecture, memory and disk information, and crash time. We add no account or learner identifier, answer, learning content, search term, pronunciation recording, custom key, custom log, or breadcrumb. Reports are not used for advertising, tracking, product analytics, or learner profiling and are not linked to your account identity. Disabling diagnostics stops further collection and deletes reports not yet sent. Firebase Crashlytics begins removing submitted crash reports and associated technical identifiers from live and backup systems after 90 days.

4. Third-Party Services

• Firebase Cloud Messaging — for push notifications
• Apple Push Notification Service (APNs) — for iOS notifications
• Sign in with Apple — for optional account authentication
• Apple App Store and Google Play — for purchase processing, subscriptions, and transaction verification
• ElevenLabs — generates speech on an audio cache miss using only canonical, reviewed German catalog text
• Cloudflare R2 and CDN — R2 stores generated audio files immutably; the CDN serves them and processes ordinary network request data such as the IP address
• Firebase Crashlytics — processes technical crash diagnostics for troubleshooting unless you turn crash diagnostics off in Profile

5. Data Sharing

We do not sell your personal information. On an audio cache miss, our backend sends ElevenLabs only canonical, reviewed German catalog text. We never send ElevenLabs, Cloudflare R2, or its CDN learner-entered or user-created text or pronunciation recordings. Our backend also does not forward account identity or the learner's IP address to ElevenLabs. R2 stores only the generated, immutable audio file. When audio is requested, the Cloudflare CDN processes ordinary network request data, including the IP address, to deliver and cache that file. We disclose to the other service providers listed above only the data required for authentication, notifications, purchase processing, and crash diagnostics unless you have turned them off in Profile. Leaderboards show other users only your username and the relevant score (XP or Speed Round best score).

6. Data Retention

We retain your data while your account is active. In-app deletion removes your account data immediately. The single product-measurement row is linked directly to your account, is deleted automatically with it, and is not a raw event log. If Apple revokes the credential, we delete an Apple-only account; for an account that remains independently accessible by password, we instead remove the Apple link and sign out every session. If Apple's revocation service is temporarily unavailable, only the encrypted credential—no longer linked to your account—may remain for automatic revocation retries for up to 30 days, after which it is deleted. The minimized Apple event ledger is deleted after at most 90 days.

7. Your Rights

• Access your personal data
• Correct inaccurate data
• Delete your account and all associated data
• Disable individual or all learning reminders in the app and additionally block push notifications in device settings
• Disable optional crash diagnostics in Profile at any time and delete reports not yet sent

8. Children's Privacy

Deutsch Hero is not directed to children under 13. If you believe a child under 13 has provided personal information to us, please contact us so we can delete it.

9. Changes to This Policy

We may update this privacy policy from time to time. We will notify users of significant changes through the app or email.

10. Contact

Questions? Reach us at [email protected].