Privacy Policy

1. Overview

Wortkessel is an app for learning German vocabulary through spaced repetition and focused practice modes. It is available as a mobile app and as an online service in a web browser. The service operator is based in Germany and processes data under the applicable requirements of the GDPR and German digital-services law.

You do not have to provide your real name and may use a pseudonym. An email address, account identifier, payment identifiers, technical events and synchronised data can still be personal data when they relate to a particular account or device.

We do not sell personal data and do not use advertising profiles, third-party advertising SDKs or cross-service tracking. Product statistics are limited to operating the service, understanding which screens are used and diagnosing errors.

2. Data we process

We may process the following categories of data to provide the app and web service:

• Account data: name or pseudonym, email address, password hash, sign-in settings, active sessions and technical session data.
• Learning and sync data: word progress, app settings, review data, test results, custom word sets, user-created words and submitted corrections or reports.
• Technical activity: app launch, screen view, periodic heartbeat, session identifier, platform, app version, event time and account identifier when signed in.
• Server logs: API path, response status, processing duration, client type and request time, plus IP address and user agent where needed for security, diagnostics or abuse prevention.
• Subscriptions and payments: selected plan, payment provider, external subscription or transaction identifiers, subscription status and period, renewal, cancellation and refund events, and technical webhook payloads.

We do not store payment-card details on our servers. Payment credentials are handled by the relevant payment provider, Apple App Store or Google Play.

3. Purposes and legal bases

We process data for the following limited purposes:

• creating accounts, signing users in, restoring access and protecting sessions;
• synchronising progress, settings and user-created words between devices;
• providing paid features, checking subscriptions and handling refunds;
• sending technical messages such as email verification and password reset emails;
• diagnosing errors, preventing abuse and keeping the service stable and secure;
• understanding aggregated product usage without advertising profiling.

Depending on the processing, the legal basis is performance of a contract or steps requested before entering one, our legitimate interest in service security and operation, compliance with payment and accounting obligations, or your consent where the device or applicable law requires separate permission.

4. Local data and permissions

The app stores some data locally so it can work quickly and partly offline:

• the local learning database, progress, preferences and audio cache;
• sign-in tokens and technical keys in protected device storage;
• sync and technical-event queues until they can be sent to the server;
• local website preferences such as the selected theme.

This storage is not used for advertising. Essential cookies and local storage usually do not require separate consent when they are necessary for a service you requested. See Cookies and Local Storage for details. You can remove local data in browser settings or by uninstalling the app.

Website fonts are served from our own domain. The website does not contact Google Fonts or another external service solely to display fonts.

The mobile app may request the following device permissions:

• Microphone and speech recognition for pronunciation practice. We do not store recordings on our server or use them for profiling. Recognition may be provided by the operating system, so Apple, Google or device-vendor settings and policies can also apply.
• Photos to set a profile image. The image is stored locally; related profile preferences may be synchronised, but we do not upload the photo file as a separate server-side profile image.
• Notifications for learning reminders when you allow them.

You can withdraw device permissions at any time in system settings.

5. Analytics and logs

Wortkessel does not use Google Analytics, advertising SDKs, retargeting pixels or advertising identifiers. First-party client analytics are sent to our server and limited to technical events such as app launch, screen view and heartbeat.

The website uses a first-party technical pixel from our API domain to estimate daily visits. It sets no cookies, connects to no third-party analytics service and is not used for advertising profiling.

Server logs are used for errors, failed requests, security and diagnostics. They are not intended for marketing or tracking users outside Wortkessel.

6. Service providers

We use service providers only where needed for operation, security, email or payments:

• Cloudflare for protection, proxying, caching and delivery of the website and API.
• Mailgun for transactional email.
• Polar for web subscriptions.
• Apple App Store for purchases and subscriptions on iOS.
• Google Play for purchases, subscriptions and Android testing.
• Operating-system providers for speech recognition, notifications and store features.

These providers can have their own roles, terms and privacy policies. Some processing may take place outside Germany or the EEA using the provider's applicable contractual and legal transfer mechanisms.

7. Retention and deletion

Account, sync, preference and user-created data are kept while the account exists or while needed to provide the service. Account deletion removes authentication methods, sessions, devices, learning progress, settings, review and test scores, custom dictionary data, submissions and reports. The remaining account record is anonymised so the original name, email address and profile image are no longer associated with it.

Payment, accounting, security and dispute records may be retained longer where required by law or needed for refunds, fraud prevention or proof of paid access. Technical logs and analytics events are retained only as long as needed to operate, secure and diagnose the service.

8. Your rights

Under the GDPR, you may request access, correction, deletion, restriction, data portability and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting earlier processing.

You may also complain to the competent German data-protection authority or another EU supervisory authority. You can delete your account in the app under Profile → Account → Delete Account, or use the external account deletion page.

9. Children

Wortkessel is not intended for independent use by children under 16 without consent from a parent or legal guardian. Contact support if you believe a child provided data without that consent.

10. Security

We use technical and organisational safeguards including HTTPS, password hashing, restricted access to server data and separation of operational data by purpose. No transmission or storage method is completely secure, so we also use logs and limits to identify errors and abuse.

11. Policy changes

We may update this policy. The current version and its update date will remain available on this page. We will notify users in the app when a change is material.

12. Contact

Data controller: Aleksandra Voronovskaia, Rintheimer Hauptstraße 44, 76131 Karlsruhe, Germany. For questions about this policy, subscriptions or deletion requests, contact us:

Email: alex.kavar@gmail.com

Telegram: @wortkessel_support_bot