Privacy policy

1. Controller

The controller for the processing within the meaning of the General Data Protection Regulation is:

Moritz Müller
Zillestraße 74
10585 Berlin
Germany
support@lingonyx.com

No data protection officer has been appointed because the legal conditions for that are not met. Questions about data protection go to the address above.

2. This website

2.1 Hosting and access data

The website is hosted on Cloudflare. The provider is Cloudflare, Inc., USA, and delivery runs through servers in Europe. On every request Cloudflare processes technically necessary access data on our behalf:

• IP address of the requesting device
• date and time of the request
• address of the requested file
• amount of data transferred and whether the request succeeded
• browser type and operating system

Without this data a page cannot be delivered and an attack cannot be fended off. The legal basis is our legitimate interest in secure and stable operation under Art. 6 (1) (f) GDPR. A data processing agreement under Art. 28 GDPR is in place with Cloudflare.

2.2 No cookies, no analytics, no third party content

This website sets no cookies, uses no analytics tool and embeds no fonts, maps, videos or scripts from other servers. That is why there is no consent banner here either. Opening a page contacts lingonyx.com and nothing else.

2.3 Contact by email

Anyone who writes to us thereby passes on their sender address and the content of the message. We use these details solely to answer the enquiry. The legal basis is Art. 6 (1) (b) GDPR where an account or the app is concerned, otherwise Art. 6 (1) (f) GDPR. Once the matter is closed the correspondence is deleted, unless a statutory retention period stands in the way.

2.4 Waiting list

Whoever signs up on the home page gives us their email address so that we can write exactly once: when the app is released. We store the address, the language of the page, the time of the entry and the time of the confirmation, plus the shortened IP address without the last octet in each case, and in addition a random key for the links in the mail and the time of the most recently sent confirmation mail. The shortened address is the proof that the consent came from that network; it does not lead back to a person.

The entry only takes effect once you click the link in the confirmation mail. Without that click it disappears by itself after 30 days. The legal basis is your consent under Art. 6 (1) (a) GDPR. You can withdraw it at any time and without giving reasons: with the unsubscribe button your mail program offers for our mails or with a message to support@lingonyx.com. The address is deleted with it. Storage is at Supabase, sending runs through Mailjet.

3. The Lingonyx app

3.1 Use without an account

The app is fully usable without an account. In that case all data stays in the protected storage of the app on the device and is not transferred anywhere:

• the learning progress, meaning which cards are due when and how they were answered
• the chosen source and target language
• settings such as colour world, answer mode and whether the introduction has been seen
• feedback on course content together with the place in the course it refers to

The course content including the audio recordings is part of the app and is not loaded later. Learning is therefore possible without a network connection.

3.2 Account and sign-in

An account is optional. It serves to back up the learning progress and to continue it on another device. There are four ways:

Start right away

A provisional account is created that consists of nothing but a random identifier. Neither a name nor an email address is collected. Such an account can later be linked with one of the other ways.

Email address and password

Stored are the email address, the password in encrypted form and the times of creation and last sign-in. The address is verified by a confirmation mail.

Sign in with Google

The provider is Google Ireland Limited, Ireland. After your confirmation Google passes on the email address stored there, your name and an identifier. The Google privacy policy applies in addition.

Sign in with Apple

The provider is Apple Distribution International Ltd., Ireland. Apple transmits an identifier and, unless you prevent it, name and email address. With the option to hide the address we receive only an anonymous forwarding address from Apple.

The legal basis is Art. 6 (1) (b) GDPR, because without this data no account can be kept. There is no obligation to create an account; the app works in full without one.

3.3 Backing up the learning progress

With an account the learning state is additionally stored on a server. Stored per account and course are:

• an image of the learning state, meaning cards, due dates and answer history in summarised form
• the identifier of the course and the version of the course content
• a display name and the chosen source language, where present
• a device label such as iPhone or Android, so it is clear which device the latest state came from
• times of creation and of the last change

The server is hosted by Supabase, Inc. in a data centre in Frankfurt am Main. The database is set up so that every row is accessible to its own account only. The local storage on the device remains the main source, the server is backup and sync. The legal basis is Art. 6 (1) (b) GDPR.

3.4 Analysis of the backed up learning progress

From the learning states that are on the server for the backup anyway, we analyse in summarised form where in a course many people stop and which cards fail particularly often. This produces figures such as how many are still learning after seven days, or which lesson most people get stuck on.

There is no analytics tool in the app for this and no identifier on the device. Nothing is collected in addition and nothing is transferred in addition. The analysis serves to improve courses and app, not to judge individual people. We see the results as a sum across many accounts.

The legal basis is our legitimate interest in a course that works, under Art. 6 (1) (f) GDPR; the analysis is a further purpose compatible with the original one under Art. 5 (1) (b) GDPR. You can object to it under Art. 21 GDPR, an informal mail is enough. Without an account there is no basis for it in the first place, because then no learning state is on the server.

3.5 Emails around the account

Confirmation and password mails are sent by Mailjet, a service of Mailjet SAS, France. The email address and the content of the respective message are transmitted for that. There is no newsletter. The one message about the release only goes to those who signed up for the waiting list, see 2.4. The legal basis is Art. 6 (1) (b) GDPR.

3.6 Error and crash reports

If the app crashes or a serious error occurs, a technical report is sent to Sentry, operated by Functional Software, Inc., USA, with storage in the European Union. Transmitted are:

• error message and call chain in the program code
• version of the app, device model and version of the operating system
• time of the error

Expressly not transmitted are the IP address, the account identifier and the headers of network requests. Free text from the program output is discarded, addresses are shortened to the path before sending. Reports only arise in published versions of the app. The legal basis is our legitimate interest in a working app under Art. 6 (1) (f) GDPR.

3.7 Feedback from the app

On the learning screen you can write feedback about course content and optionally attach a picture. This feedback currently stays on the device. There is no counterpart it would be sent to. Should that change, this policy will be adjusted beforehand.

3.8 Permissions

The app asks for exactly one permission group, and only when you trigger it yourself: access to photos and camera, so that a picture can be attached to feedback. The picture is not uploaded; only the local address of the file is stored. Without this permission the app is fully usable.

3.9 What the app does not do

There are no ads, no advertising identifier, no analytics tool that records your behaviour on the device, no tracking across providers, no profiling and no automated decision making within the meaning of Art. 22 GDPR. Data is not sold and not passed on for advertising purposes. What is analysed statistically from the backed up learning state is described above under 3.4.

4. Recipients

Beyond the purposes named we pass on no data. In use are:

Cloudflare, Inc., USA

Delivery of this website and receipt of the waiting list form. Certified under the EU-US Data Privacy Framework.

Supabase, Inc., USA

Accounts, backup of the learning progress and the addresses of the waiting list, operated in Frankfurt am Main. The transfer is based on the standard contractual clauses of the European Commission.

Mailjet SAS, France

Sending of the confirmation and password mails and of the waiting list mails.

Functional Software, Inc. (Sentry), USA

Error and crash reports with storage in the European Union. Certified under the EU-US Data Privacy Framework.

Google Ireland Limited and Apple Distribution International Ltd.

Only if you sign in with Google or Apple. Both are independently responsible for their part of the processing.

As operators of the app stores, Apple and Google also process their own data about the download and installation of the app. We have no influence over that.

5. Transfer to third countries

Cloudflare and Sentry are companies based in the USA. Both are certified under the EU-US Data Privacy Framework, so an adequacy decision of the European Commission applies to them. Supabase, Inc. is not certified; here the transfer is based on the standard contractual clauses under Art. 46 (2) (c) GDPR. The actual storage takes place in the European Union in both cases.

6. Storage period

• Data on the device: until you reset the progress in the app or delete the app.
• Account data and backed up learning state: until you delete the account. After that they are removed immediately and completely.
• Provisional accounts from Start right away: without a learning state after 30 days, with a learning state after one year without use. An account with a linked sign-in is never affected by this.
• Error reports: 90 days, after that Sentry deletes them automatically.
• Access data of the website: only for a short time to fend off attacks, at most a few days.
• Email correspondence: until the enquiry is settled, subject to statutory retention periods.
• Waiting list: 30 days without confirmation, with confirmation until the message about the release or until you unsubscribe.

7. Your rights

You have these rights towards us:

• access to the data stored about you, Art. 15 GDPR
• rectification of incorrect data, Art. 16 GDPR
• erasure, Art. 17 GDPR
• restriction of processing, Art. 18 GDPR
• release of your data in a common format, Art. 20 GDPR
• objection to processing based on a legitimate interest, Art. 21 GDPR
• withdrawal of a given consent with effect for the future, Art. 7 (3) GDPR

An informal email to support@lingonyx.com is enough.

Independently of that you can complain to a data protection supervisory authority, Art. 77 GDPR. Responsible is the authority of your place of residence or the one of our seat. A list of all German authorities is kept by the Federal Commissioner for Data Protection and Freedom of Information at bfdi.bund.de in the Service area.

8. Deleting the account and the data

The account can be deleted in the app under Settings. How that works and what is removed is described on the page Delete account.

9. Children

The app is not specifically aimed at children under 16. There is no chat function, there are no public profiles and no connection to other users.

10. Changes to this policy

If the behaviour of the app or of this website changes, this policy is adjusted before the version concerned is published. The date above names the latest state.