App Privacy Policy

App Privacy Policy

This policy describes how the Uchim mobile app (iOS and Android) processes personal data. Data processing on the Uchim website is described separately in our Website Privacy Policy.

1. Controller

Uchim — Lukas Stoll, Rhönstraße 17, 71083 Herrenberg, Germany. Data-protection contact: upravlenie@uchim.app.

We are not legally required to appoint a Data Protection Officer and have not done so.

2. What the app processes

• Account and profile — email address, a hashed password, username, preferences, and subscription status. Legal basis: Art. 6 (1) (b) GDPR (to provide the service).
• Learning data — your progress, scores, streaks, saved lists, notes, and any pronunciation recordings you make. Legal basis: Art. 6 (1) (b) GDPR.
• Device and technical data — app and OS version, device model, and crash/diagnostic logs, used to keep the app stable and secure. Legal basis: Art. 6 (1) (f) GDPR.
• Usage analytics — only if you consent; first-party and used solely to improve the app. Legal basis: Art. 6 (1) (a) GDPR. You can withdraw consent in the app at any time.
• Push notifications — if you enable them, we process a device push token. Legal basis: Art. 6 (1) (a) GDPR.
• In-app purchases — processed by the Apple App Store or Google Play; we receive purchase and product identifiers needed to unlock features. Legal basis: Art. 6 (1) (b) GDPR.
• Support requests — the information you send us to get help. Legal basis: Art. 6 (1) (b) / (f) GDPR.

3. Permissions

The app may ask for: notifications, microphone (for pronunciation practice), and photo access (for a profile picture). You can grant or revoke each in your device settings.

4. Hosting and processors

Our backend runs on infrastructure provided by IONOS SE (Elgendorfer Straße 57, 56410 Montabaur, Germany) and Strato AG (Otto-Ostrowski-Straße 7, 10249 Berlin, Germany), both in Germany. They process data strictly on our behalf as processors under data-processing agreements (Art. 28 GDPR).

5. App stores

Apple (Apple Distribution International Ltd., Ireland) and Google (Google Ireland Ltd.) act as independent controllers for the data they process to operate the stores and handle payments, under their own privacy policies.

6. International transfers

We process data within the EU/EEA. Where a transfer to a third country is unavoidable, we rely on an adequacy decision (Art. 45) or appropriate safeguards such as the EU Standard Contractual Clauses (Art. 46).

7. Retention

We delete account and profile data within 30 days of an account-deletion request; learning data is erased on deletion; crash and diagnostic data is kept for 90–180 days and then anonymised; purchase records are kept as long as tax and commercial law require. You can delete your account directly in the app.

8. Children

The app is not directed to children under 16. We do not knowingly process their data and will delete it if we learn it was provided without the required consent.

9. No sale of data

We do not sell personal data, and we do not integrate third-party advertising SDKs without your prior consent where it is required. We do not carry out automated decision-making with legal or similarly significant effects (Art. 22 GDPR).

10. Your rights

You have the rights to access, rectification, erasure, restriction, data portability, and objection, the right to withdraw consent at any time, and the right to lodge a complaint with a supervisory authority (for us, the Landesbeauftragter für den Datenschutz Baden-Württemberg). To exercise any right, contact upravlenie@uchim.app.

11. Changes

We update this policy when our processing changes. The current version and effective date are shown at the top of this page.