Privacy Policy

1. Controller

The controller responsible for processing personal data in the “Palaora” app for iOS and Android and in the web app at https://palaora.com is:

[…]
[…]
E-mail: […]
Phone: […]

No data protection officer has been appointed, because there is no legal obligation to do so. For any data protection question, please contact us directly using the details above.

2. In short

Palaora is a language-learning app (currently German, with English as the interface language) (vocabulary with the Leitner system, grammar lessons, reading texts, quizzes, duels, offline use). The iOS and Android apps display our web app https://palaora.com, so data processing is the same in every case.

• An account is optional. You can use the app without one.
• We show no ads and use no advertising ID, no tracking, no analytics tools and no profiling.
• We do not sell your data.
• We never receive payment data (such as card details); purchases are handled exclusively by Apple or Google.

3. What data we process and why

3.1 Server logs

Each time our server is accessed, the IP address, time, requested path and user agent (information about device, operating system and browser) are stored in log files. We need this data to keep the service running, find errors and prevent abuse and attacks.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation). Retention: no longer than 14 days.

3.2 Using the app without an account (guest ID)

Without an account, the app assigns your device a random, pseudonymous guest ID. Your learning progress is linked to this ID, not to your name.

Legal basis: Art. 6(1)(b) GDPR (providing the app under our Terms of Use).

3.3 Account

If you create an account, we store your e-mail address and password. The password is never stored in plain text, only as a salted hash (PBKDF2). Optionally, you can add a display name, your level, your learning language and an avatar emoji.

Legal basis: Art. 6(1)(b) GDPR.

3.4 Learning progress and reports

For the learning features to work, we store your learning progress: answers, review schedule (Leitner boxes), streaks, points and favourites. If you report an error or send us a message, we store it in order to handle it.

Legal basis: Art. 6(1)(b) GDPR.

3.5 Storage on your device

The app stores the data it needs to work on your device, for example your sign-in or guest ID, settings and learning content for offline use. This storage is strictly necessary for the use of the app you have requested and therefore does not require consent (Section 25(2) no. 2 of the German TDDDG). When you delete your account in the app, your sign-in and the locally stored settings are also removed from the device. Uninstalling the app removes all of its data from the device.

3.6 Reminders

Review reminders are scheduled locally on your device. We do not use any third-party push service. To show the number of cards due, the app asks our server for that number. You can switch reminders off at any time in the app or in your device’s system settings.

Legal basis: Art. 6(1)(b) GDPR.

3.7 Audio pronunciation

Our server fetches the pronunciation of German words and sentences from Google’s text-to-speech service. Only the German word or sentence is sent, no personal data.

3.8 Subscriptions and purchases

Subscriptions are sold and billed by Apple (App Store) or Google (Google Play). Apple and Google are themselves responsible for payment processing, and their privacy policies apply. We never receive your payment data.

From Apple or Google we receive a signed purchase record containing the product, transaction ID, expiry date and a random, pseudonymous account token that links the purchase to your account. We also process status notifications from Apple or Google (for example renewal, cancellation, refund) so that your premium status is correct.

Legal basis: Art. 6(1)(b) GDPR; for keeping purchase records, Art. 6(1)(c) GDPR in conjunction with Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB).

4. Recipients

• Hetzner Online GmbH, Germany – hosting of server, database and logs. Hetzner processes the data as our processor (Art. 28 GDPR) in Germany.
• Cloudflare, Inc., USA – reverse proxy and content delivery network. All requests to the app pass through Cloudflare; IP addresses and request data are processed to deliver the app and protect it from attacks. Legal basis: Art. 6(1)(f) GDPR.
• Apple or Google – sale and billing of subscriptions as independent controllers (section 3.8).

Beyond this, we only disclose data where we are legally obliged to do so.

5. Transfers to the USA

Cloudflare, Inc. is certified under the EU-US Data Privacy Framework. For certified companies, an adequacy decision of the European Commission applies (Art. 45 GDPR). In addition, the European Commission’s Standard Contractual Clauses have been agreed (Art. 46(2)(c) GDPR).

6. How long we keep data

• Server logs: no longer than 14 days.
• Account and guest data, learning progress and reports: until you delete your account.
• When you delete your account (in the app under Account → Settings → Delete account, or by e-mail), your account and all personal data are deleted immediately from the live database: learning progress, favourites, game data, reports and messages, reminders, sign-in data. Backups are overwritten within 30 days.
• Financial records (payments, receipts, Apple or Google purchase records): only for as long as tax and commercial law require (Section 147 AO, Section 257 HGB: up to 10 years). After an account is deleted, they are pseudonymised: your user ID is replaced so that the records no longer identify you.

7. Your rights

You have the right to

• access your data (Art. 15 GDPR),
• have inaccurate data corrected (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing (Art. 21 GDPR).

Right to object: where we process data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation.

Simply write to us at […].

8. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority of the German federal state in which the operator lives, or the authority where you live.

9. Are you obliged to provide data?

You are under no legal or contractual obligation to provide us with data. Without an account, you can use the app as a guest.

10. No automated decisions

We make no automated decisions within the meaning of Art. 22 GDPR and do not create profiles.

11. Children

The app is not directed at children under 13. Users under 16 should only use the app with the consent of a parent.

12. Changes

We update this privacy policy when the app or the law changes. The version published in the app applies.