Privacy Policy

This translation is for information purposes only. The German version is legally binding.

1. Data controller

Raphael Boullet, Hohentwielstraße 108, 70199 Stuttgart, Germany
Email: kontakt@vokabelchampion.app

2. Hosting of the website and the app

The website and app are hosted by Netlify, Inc. (USA). When the site is accessed, Netlify processes technically necessary data: IP address, date and time, page accessed, browser and operating system. This serves to ensure secure and stable delivery (Art. 6(1)(f) GDPR).

Data transfer to the USA: Netlify is certified under the EU-US Data Privacy Framework (Adequacy Decision by the European Commission, Art. 45 GDPR); in addition, the European Commission’s Standard Contractual Clauses from the data processing agreement with Netlify apply. Netlify deletes the server logs as soon as they are no longer required for operational and security purposes; they remain available for our analysis for approximately 24 hours, after which we retain only the daily totals.

Statistics without tracking: Once a day, we extract only aggregate data from these server logs, such as how often a page was viewed, which site visitors came from (e.g. LinkedIn), which country they were from, and how often the app was opened via a promotional link. IP addresses, device identifiers or cookies are not stored for this purpose; individual visitors cannot be identified (Art. 6(1)(f) GDPR, legitimate interest: understanding the reach of our project).

3. Third-party fonts and content

All text, images and the video are hosted on our own server. When the website is accessed, no connection is established with Google, social networks or other third-party providers.

4. Contact form

If you contact us via the contact form, we store: name (optional), email address, role, enquiry, subject and message. To protect against misuse, we also store the browser identifier and a truncated, daily-changing hash of the IP address, from which the address cannot be reverse-engineered.

The purpose is to respond to your enquiry (Art. 6(1)(b) and (f) of the GDPR). The data is stored by Supabase, Inc. on servers in the EU (Ireland) and will be deleted no later than 6 months after the enquiry has been completed.

5. Account in the app

An account is created for the app. The following are stored: username, in-app name, vocabulary score and progress, and – in the case of a class – points for the leaderboard. The password is stored only as an unreadable hash; neither parents nor the operator can view it. Providing a parent’s email address is optional and is used solely for the ‘Forgotten password’ function and to receive replies from support.

Children under the age of 16 require their parents’ consent (Art. 8 GDPR); this is confirmed upon registration. The legal basis is the provision of the app (Article 6(1)(a) and (b) of the GDPR). Storage location: Supabase, EU (Ireland).

Parent account and linking with the child. Parents can create their own account (username, name in the app, email address as a mandatory field, password as an unreadable verification value). A connection is only established if the child displays a connection code in their app and the parent enters it or scans the QR code. The code is valid for 10 minutes and can only be used once; only an unreadable verification value is stored. Incorrectly entered codes are counted for one day to limit the number of attempts. The system also records which parent account is linked to which child account and since when. Linked parents can see the following information about the child: name in the app, language, level, time of last activity, days of practice over the last seven days and the number of words spelled correctly. They cannot see vocabulary, settings or passwords. The child can see who is linked and can disconnect in the parents’ area; parents can also disconnect the link. If an account is deleted, its links are deleted, whilst the other account remains active. Parents can also log in using their email address.

If the app was opened via a promotional link (e.g. from a LinkedIn post), we store an abbreviation of this link (such as ‘tester-autumn’) in the account to track how many accounts a promotion has generated. The abbreviation does not reveal anything about the individual.

The account, along with all associated data, can be deleted at any time via the parents’ area of the app. Anyone who is no longer able to access the app can request deletion via the contact form (select ‘Delete account’ as the reason for your enquiry).

6. Error reports and days of use in the app

If an error occurs in the app, a technical error report is saved: time and date, error message with technical details, app version, URL accessed, browser identifier, a truncated, daily-changing hash value of the IP address from which the address cannot be reverse-engineered, and, for logged-in users, the account identifier. The purpose is to identify and rectify errors and to limit misuse (Article 6(1)(f) of the GDPR). The reports are deleted after 30 days; when an account is deleted, the link to that account is removed.

In addition, for each account, we record the days on which the app was used (date only) in order to count how many accounts are active. This information is deleted along with the account. It is stored on Supabase, EU (Ireland).

7. App from the App Store and Google Play

The Android app for Google Play is a lightweight wrapper (Trusted Web Activity) that opens the app address app.vokabelchampion.app in full-screen mode. It does not collect any additional data and contains no advertising or analytics components. When downloading and updating the app, Google Play processes data under its own responsibility; Google’s privacy policy applies.

The iPhone version has not yet been released. As soon as it is available in the App Store, we will update this section to specify what data Apple processes during the download.

8. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object (Articles 15 to 21 of the GDPR). You may withdraw any consent you have given at any time. Please contact us via the contact form or email us at kontakt@vokabelchampion.app.

You can also lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information in Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, www.baden-wuerttemberg.datenschutz.de.

As at: 27 October 2026