1. Who We Are (Data Controller)

The data controller for GermanVault is:

A data controller is the person or organisation that determines why and how personal data is processed. For questions about this policy or your data rights, contact us using the details above.

We do not have a designated Data Protection Officer (DPO) as we do not meet the thresholds requiring one under Article 37 GDPR. The contact above handles all data protection enquiries.

2. Data We Collect and the Legal Basis

We only collect data that is necessary for the purposes listed below. The column "Legal basis" refers to the lawful ground for processing under Article 6 of the GDPR. Users outside the EU/UK have equivalent protections under their local laws.

¹ Legitimate interest (device identifier): Enabling core favourites functionality for users who have not registered. Our interest in providing a useful, frictionless experience outweighs the minimal privacy impact of storing a technical identifier, which is not linked to a real-world identity.

² Legitimate interest (non-personalised ads): Displaying contextual advertising to fund a free application. Contextual ads do not involve profiling and the impact on privacy is minimal.

³ Legitimate interest (navigation history): Understanding which content areas are most valuable so we can improve the app. The data is limited to page paths (e.g. /verbs/haben) and contains no sensitive information. You may object to this processing by contacting us (see Section 18).

3. How We Use Your Data

• To create and manage your account and verify your email address.
• To store and sync your learning progress, streak, and mastery scores across your devices.
• To personalise the in-app experience (greeting, saved preferences, last-visited content).
• To generate AI-powered quiz questions relevant to your chosen topic.
• To deliver optional daily push notifications (only if you enable them).
• To display advertisements that fund the free app (personalised only with your consent).
• To comply with our legal obligations (e.g. recording your consent decision for advertising).
• To investigate and respond to security incidents or abuse reports.

We do not use your data for any purpose that is incompatible with the purposes listed above.

4. Third-Party Service Providers

We share data only with the following sub-processors and partners. Each acts under a data processing agreement or equivalent contractual safeguard. We do not sell your personal data.

Google Firebase (Google LLC)

Firebase Authentication manages secure sign-in. Firebase Firestore stores your learning progress, profile, and settings. Firebase Cloud Messaging (FCM) delivers push notifications. Firebase is subject to Google's Data Processing Agreement under GDPR.
Policy: firebase.google.com/support/privacy

Google AdMob (Google LLC)

AdMob displays in-app advertisements. When personalised ads are enabled (with your consent), AdMob may use the Google Advertising ID and in-app interaction data to show interest-based ads. When you choose "Essential only", AdMob serves non-personalised, contextual ads without profiling. You can also reset or opt out of personalised ads at the Android OS level: Settings → Privacy → Ads → Delete advertising ID (Android 12+) or Opt out of Ads Personalisation (earlier versions).
Policy: policies.google.com/privacy

OpenAI (OpenAI, LLC)

The quiz feature sends a list of German vocabulary items to OpenAI's API via a Firebase Cloud Function. No personal data is included in these requests — only a topic name and app-content vocabulary items. OpenAI processes this data under its API terms and privacy policy. We do not retain prompt content on our own infrastructure.
Policy: openai.com/policies/privacy-policy

Google Play Services (Google LLC)

Play Services handles app distribution, in-app updates, and review prompts. Google processes standard app distribution data as the platform provider under their own privacy policy.

5. Advertising and Your Consent

GermanVault is free to use. We display ads via Google AdMob to fund ongoing development. On first launch you will be shown a consent dialogue with two options:

• Accept all (personalised ads) — AdMob uses your Google Advertising ID and in-app behaviour to show you ads tailored to your interests. Legal basis: your consent (Art. 6(1)(a) GDPR).
• Essential only (non-personalised ads) — AdMob shows contextual ads based only on the current page content. Your advertising identifier is not used for profiling. Legal basis: our legitimate interest in funding the free app (Art. 6(1)(f) GDPR).

For users in the EEA and UK, this consent satisfies the requirements of GDPR and the UK GDPR. For users in California, personalised advertising constitutes "sharing" of personal information for cross-context behavioural advertising under the CCPA; you may opt out as described in Section 12.

6. Push Notifications

GermanVault can deliver optional daily notifications with a German word or phrase. On Android 13 and later, the app will request the POST_NOTIFICATIONS permission before sending any notification — this permission is off by default and you must actively grant it.

When notifications are enabled, a Firebase Cloud Messaging (FCM) token is generated and stored in our Firestore database (pushTokens collection) solely for routing purposes. This token is not used for advertising or shared with any party other than Google's FCM infrastructure. You can withdraw this consent at any time in Settings → Daily Notifications. Disabling notifications deletes the token from active use; account deletion removes it permanently.

7. Quiz and AI Features

The Quiz feature uses OpenAI's language model (via a Firebase Cloud Function we operate) to generate multiple-choice questions. When you start a quiz, the following data is sent to OpenAI:

• The quiz topic name (e.g. "verbs", "idioms")
• A selection of German vocabulary items from our content database relevant to that topic

Your personal data (name, email, UID, progress, device ID) is never included in quiz generation requests. The OpenAI API key is stored exclusively on our Firebase Cloud Function server — it is not present in the app binary or transmitted to your device. Legal basis for this processing: performance of a contract (Art. 6(1)(b) GDPR) — the quiz is a core feature of the service.

8. Automated Decisions and Profiling

The app performs automated calculations on your local learning data to produce the following outputs:

• Mastery score — calculated from how many times you have viewed an item.
• Weekly streak — whether you used the app on each of the last 7 days.
• Weak topic detection — items with the lowest mastery scores are surfaced as suggested review topics.

These calculations are performed for the sole purpose of helping you track and improve your learning. They do not constitute automated decision-making that produces "legal or similarly significant effects" within the meaning of Article 22 GDPR — they affect only your in-app experience and carry no external consequence.

Google AdMob performs profiling for advertising purposes when you consent to personalised ads (see Section 5). We do not carry out any other profiling.

9. Data We Do NOT Collect

• We do not collect or store passwords — authentication is handled entirely by Firebase Auth using industry-standard hashing.
• We do not collect precise or approximate location data.
• We do not access your contacts, camera, microphone, or storage.
• We do not collect financial or payment data (the app is free).
• We do not process special categories of personal data (health, race, religion, etc.).
• We do not build advertising profiles ourselves — any ad profiling is handled by Google AdMob under their own terms.
• We do not sell, rent, or trade your personal data to any third party.

10. Data Retention

We retain personal data only as long as necessary for the purposes it was collected:

• Account data and learning progress — retained for the lifetime of your account. Deleted immediately and permanently when you delete your account (see Section 13).
• Push tokens — retained while push notifications are enabled. Removed when you disable notifications or delete your account.
• Anonymous device profile — retained indefinitely to preserve your favourites. If you later create an account, this data is migrated to your account and the anonymous record is marked as redirected. You may request deletion of an anonymous profile by contacting us.
• Ad consent choice — stored locally on your device only. Not retained on our servers.
• Advertising data (AdMob) — governed by Google's retention policies.
• Quiz prompt data sent to OpenAI — we do not retain prompt content on our servers. Retention by OpenAI is governed by their Privacy Policy.

11. Your Rights — EU / UK (GDPR) GDPR UK GDPR

If you are located in the European Economic Area or the United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR / UK GDPR). We honour these rights for all users regardless of location.

• Right of access (Art. 15) — you may request a copy of all personal data we hold about you, including the categories, purposes, and recipients.
• Right to rectification (Art. 16) — you may ask us to correct inaccurate or incomplete data. You can update your display name directly in the app.
• Right to erasure / "right to be forgotten" (Art. 17) — you may request deletion of your personal data where it is no longer necessary or where you withdraw consent. In-app account deletion (Section 13) fulfils this right immediately.
• Right to restriction of processing (Art. 18) — you may ask us to stop using your data in certain circumstances while a dispute is resolved.
• Right to data portability (Art. 20) — where processing is based on contract or consent, you may request your data in a structured, machine-readable format (e.g. your learning progress as JSON).
• Right to object (Art. 21) — you may object at any time to processing based on legitimate interests (see footnotes ¹–³ in Section 2). We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent (Art. 7(3)) — for processing based on consent (personalised ads, push notifications), you may withdraw at any time. Withdrawal does not affect processing that already occurred.
• Right not to be subject to solely automated decisions with significant effects (Art. 22) — the automated calculations described in Section 8 do not fall within Art. 22 scope, but you may always contact us if you believe an automated process has significantly affected you.
• Right to lodge a complaint (Art. 77) — you have the right to complain to the supervisory authority in your EU member state or, in the UK, to the Information Commissioner's Office (ICO). Find your national authority at: edpb.europa.eu  ·  UK ICO: ico.org.uk/make-a-complaint

12. Your Rights — California (CCPA / CPRA) CCPA

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you the following rights:

• Right to know — you may request disclosure of the categories and specific pieces of personal information we collect, use, disclose, and sell (or "share").
• Right to delete — you may request deletion of personal information we collected from you (subject to certain exceptions). In-app account deletion fulfils this right (see Section 13).
• Right to opt out of the "sale" or "sharing" of personal information — we do not sell personal information. However, enabling personalised ads constitutes "sharing" of the Google Advertising ID with AdMob for cross-context behavioural advertising under CPRA. To opt out, choose "Essential only" in the in-app consent dialogue or go to Settings → Advertising Preferences and select "Essential only".
• Right to correct — you may request correction of inaccurate personal information we maintain about you.
• Right to limit use of sensitive personal information — we do not collect sensitive personal information as defined under CPRA.
• Right to non-discrimination — we will not deny, degrade, or penalise your access to GermanVault if you exercise any CCPA/CPRA right.

To submit a CCPA/CPRA request, email support@germanvault.app with the subject "California Privacy Request". We will respond within 45 days (extendable by a further 45 days with notice).

We do not have actual knowledge of selling or sharing personal information of consumers under 16 years of age.

13. Account and Data Deletion

You can delete your account and all associated personal data at any time, directly within the app:

1. Open GermanVault and tap the side menu icon.
2. Go to Settings.
3. Scroll to the Account section and tap Delete Account.
4. Read the confirmation message and tap Delete to confirm.

This action immediately and permanently:

• Deletes your Firebase Authentication record (email, display name, UID).
• Deletes your Firestore user document (learning progress, quiz data, profile, push token).
• Clears all locally stored app data on the device.

Deletion is irreversible. If you cannot access the app, email support@germanvault.app and we will manually process your deletion request within 30 days.

14. Children's Privacy

GermanVault is not directed at children. We apply the following age thresholds in line with applicable law:

• United States (COPPA) — we do not knowingly collect personal information from children under 13.
• European Economic Area and UK (GDPR) — we do not knowingly collect personal information from children under 16. (Some member states set a lower age of digital consent, but we apply 16 as a conservative standard.)
• Other jurisdictions — we apply the local minimum age for digital services or 13, whichever is higher.

If you believe your child has created an account or provided personal data through GermanVault, please contact us at support@germanvault.app. We will verify the report and delete the data promptly.

15. Security Measures

We implement the following technical and organisational measures to protect personal data:

• All data in transit between the app and Firebase/Google is encrypted using TLS 1.2 or later.
• Cleartext (unencrypted) HTTP traffic is blocked at the Android OS level via a network_security_config.xml file.
• Firebase Security Rules enforce that only authenticated users can access their own data in Firestore — cross-user data access is not possible.
• Firebase App Check prevents unauthorised apps or scripts from accessing our Firestore backend using spoofed credentials.
• The OpenAI API key is stored exclusively in Firebase Cloud Functions (server-side) and is never transmitted to or stored on user devices.
• Android backup is disabled (android:allowBackup="false") to prevent data being restored to untrusted devices via the Android backup system.

Despite these measures, no data transmission or storage system is guaranteed to be 100% secure. If you discover a security vulnerability, please disclose it responsibly to support@germanvault.app.

16. International Data Transfers

GermanVault is operated from [YOUR COUNTRY]. Our service providers — Google LLC (Firebase, AdMob) and OpenAI, LLC — are headquartered in the United States and may process data on servers outside the EEA or UK.

These transfers are protected by one or more of the following safeguards:

• EU Standard Contractual Clauses (SCCs) — Google and OpenAI have executed SCCs approved by the European Commission for transfers from the EEA to third countries.
• UK International Data Transfer Agreements (IDTAs) — applicable for transfers from the UK.
• Google Cloud's EU data residency commitments — for Firebase, you may review Google's data location policies at firebase.google.com/support/privacy.

By using GermanVault, you acknowledge that your data may be transferred to and processed in countries with different data protection standards than your own. The measures above are designed to ensure that your data receives an equivalent level of protection regardless of where it is processed.

17. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top. We categorise changes as follows:

• Non-material changes (e.g. clarifications, formatting, adding detail to existing practices) — the updated date will reflect the change; no separate notice is given.
• Material changes (e.g. collecting new categories of data, sharing with new third parties, changing the legal basis for processing) — we will notify you via an in-app notice at next launch before the change takes effect. Where the change requires new consent (e.g. a new category of personalised processing), we will request that consent explicitly; continued use of the app will not constitute consent for such changes.

The current version of this policy is always available at the URL provided in the app's Play Store listing and in Settings → Privacy Policy.

18. Contact and Complaints

For any questions, data subject requests, or concerns about this Privacy Policy or our data practices, please contact:

If you are not satisfied with our response, you have the right to lodge a complaint with a supervisory authority:

• EU residents — contact your national data protection authority. Find yours at: edpb.europa.eu
• UK residents — Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint
• California residents — California Privacy Protection Agency (CPPA): cppa.ca.gov

---

This Privacy Policy applies exclusively to the GermanVault Android application (com.mendzyy.germanvault) distributed via the Google Play Store. It does not apply to third-party websites, services, or advertisers linked from within the app.  ·  Version 1.0  ·  26 May 2026  ·  © 2026 GermanVault

Note: The placeholders [YOUR FULL LEGAL NAME / COMPANY NAME] and [YOUR COUNTRY] in this document must be completed with accurate information before this policy is published. This document does not constitute legal advice. Consider having it reviewed by a qualified legal professional in your jurisdiction before publication.