Privacy Policy

1. Introduction

Protecting your personal data is important to us. This privacy policy explains what data we collect, for what purpose, and how it is used, in accordance with the General Data Protection Regulation (GDPR).

We only collect and process data for the purposes described below.

2. Data Controller

This privacy policy applies to the following apps and websites, each operated by the same data controller (Fabian Grimme, Stavangerstr. 2, 10439 Berlin, Germany):

If you have any questions about this privacy policy or the processing of your data, please contact us at the email address listed above for the app or website you are using.

3. Data We Collect and Why

a) Flashcard Ratings

What data is collected

• Ratings provided by users for flashcards

Purpose

• To improve and evaluate flashcard content and learning quality

Legal basis

• Legitimate interest (Art. 6(1)(f) GDPR)

The ratings are used only for evaluating and improving the flashcards and are not used by us for profiling.

b) User Identification

What data is collected

• An anonymous user identifier (RevenueCat ID), or
• An email address, only if the user chooses to sign in

Purpose

• To associate flashcard ratings and usage with a specific user
• To enable account-related functionality if the user signs in

Legal basis

• Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR)
• Consent, where applicable (Art. 6(1)(a) GDPR)

Users can use the service anonymously. Providing an email address is optional.

c) Newsletter Subscription

What data is collected

• Email address

Purpose

• To send the newsletter

Legal basis

• Consent (Art. 6(1)(a) GDPR)

The email address is used exclusively for sending the newsletter. Users can unsubscribe at any time via the link provided in each newsletter.

d) Advertising and Google AdMob

This section applies only to the Painfree German / DER DIE DAS app. The DouDou-Chinese apps (including 听听 / Tingting) do not display advertisements, do not use Google AdMob, and do not track users across apps or websites owned by other companies.

The DER DIE DAS app may display advertisements provided by Google AdMob, a mobile advertising service operated by Google Ireland Limited.

What data may be collected by AdMob

Depending on the user's device settings, consent choices, and region, Google AdMob may collect and process information such as:

• Device identifiers
• IP address
• Approximate location information
• Advertising identifiers
• App interaction data
• Diagnostic and performance information

Purpose

• To display and measure advertisements
• To limit repetitive ads
• To detect fraud and abuse
• To improve advertising services
• To personalize ads, where consent has been given

Legal basis

• Consent (Art. 6(1)(a) GDPR), where required
• Legitimate interest (Art. 6(1)(f) GDPR) for basic advertising functionality and service security

Where legally required, users will be asked for consent before personalized advertising is enabled. Users can manage advertising preferences through their device settings, including limiting ad tracking or resetting advertising identifiers.

For more information about how Google processes data, please refer to Google's Privacy Policy: https://policies.google.com/privacy

Consent management

For users in the European Economic Area (EEA) and the UK, we use Google's User Messaging Platform (UMP) to collect and manage advertising consent choices before ads are personalized. Consent choices can be changed at any time via the in-app privacy/consent settings.

e) Crash and Error Reporting

What data is collected

• Crash reports and error logs, including device information, app version, and stack traces

Purpose

• To identify, diagnose, and fix technical issues and improve app stability

Legal basis

• Legitimate interest (Art. 6(1)(f) GDPR)

We use Sentry (Functional Software, Inc.) for crash and error reporting. For more information, see Sentry's privacy policy: https://sentry.io/privacy/

f) Push Notifications

What data is collected

• A device push token used to deliver notifications (for example, duel invitations and updates)

Purpose

• To send app-related notifications the user has enabled

Legal basis

• Consent, granted via the device's notification permission prompt (Art. 6(1)(a) GDPR)

Users can disable notifications at any time in their device settings.

g) Speech Recordings and AI-Assisted Processing

What data is collected

• Audio recordings submitted for pronunciation and speech evaluation
• Text submitted for AI-assisted validation (for example, in Pattern Chat Duel mode)

Purpose

• To generate pronunciation feedback and pitch/tone analysis
• To generate spoken audio for words and sentences (text-to-speech)
• To validate free-text answers in interactive exercises

Legal basis

• Performance of a contract (Art. 6(1)(b) GDPR)

Speech and text submitted for these features are processed using Microsoft Azure Cognitive Services (speech recognition, text-to-speech, and pronunciation assessment) and DeepSeek (AI-assisted answer validation). Audio recordings may be stored to support these features and to improve their accuracy.

h) Learning Activity Logs

What data is collected

• For each flashcard you answer: the card, whether your answer was right or wrong, when the card was shown and answered, how long you took, and the card's review schedule before and after the answer
• For each practice session: what kind of session it was, when it started and ended, and how many cards or words it covered
• The app version and the device platform (iOS or Android)

Purpose

• To estimate how much time your daily learning will take, based on your own answer times
• To adjust review intervals to how well you remember words

Legal basis

• Performance of a contract (Art. 6(1)(b) GDPR)
• Legitimate interest (Art. 6(1)(f) GDPR) in improving the learning schedule

These logs are linked to your anonymous user identifier or your account. They are kept until you delete your account and are then deleted with it. They are not used for advertising and are not shared with third parties.

i) Website Tools (doudou-chinese.com)

The website offers a translator, a word segmenter, a pinyin tool and an HSK sentence grader.

What data is collected

• In the translator: the English text you enter and the tone you choose, and, when you ask for an explanation, the Chinese translation
• In the word segmenter, the pinyin tool and the HSK sentence grader: the Chinese text you enter
• Your IP address
• Technical signals from your browser, collected by Cloudflare Turnstile (see below)

Purpose

• To translate your text and explain the translation, to split Chinese text into words, and to add pinyin
• To protect the tools from automated misuse and to enforce usage limits

Legal basis

• Performance of a contract (Art. 6(1)(b) GDPR) for processing your text
• Legitimate interest (Art. 6(1)(f) GDPR) in protecting the tools from automated misuse

Text you enter in the translator is sent to DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.), which generates the translation and the explanation and processes data in the People's Republic of China. The European Union has not issued an adequacy decision for China. Please do not enter personal data into the translator. The word segmenter, the pinyin tool and the HSK sentence grader process your text on our own server and do not pass it on.

Cloudflare Turnstile (Cloudflare, Inc., USA) checks that requests come from a person and not from a bot: before each translator request, and for the word segmenter, the pinyin tool and the HSK sentence grader once every 10 minutes. After that check, our server gives the page a pass for these 10 minutes. The pass is bound to your IP address and kept only in the page's memory; it is not stored as a cookie. For the check, Cloudflare processes signals such as your IP address and characteristics of your browser and device; see the Turnstile Privacy Addendum. Cloudflare is certified under the EU-U.S. Data Privacy Framework.

We do not store your texts in a database or link them to you, and our request logs do not record them. If processing a text fails, the error we log may contain part of it. To answer repeated translator requests without asking DeepSeek again, recent texts and their translations are kept in our server's memory until newer ones replace them or the server restarts. Your IP address is kept in memory only to limit how many requests you can make: per minute for each tool, and per day for the translator, whose count is reset every day. Our web server's access logs record your IP address, the time and the address requested, but not your text.

j) Usage Analytics

What data is collected

• Which screens are opened and which features are used (for example, starting or finishing a practice session)
• A random app-instance identifier generated by the analytics service
• Device model, operating system, app version, and approximate location derived from the IP address

Purpose

• To understand which features are used and improve the app

Legal basis

• Legitimate interest (Art. 6(1)(f) GDPR)

We use Google Analytics for Firebase (Google Ireland Limited). Collection of the advertising identifier and ad personalization signals is disabled, and analytics data is not linked to your account, email address, or RevenueCat ID. It is not used for advertising or tracking. For more information, see Google's Privacy Policy: https://policies.google.com/privacy

4. Third-Party Services

The app uses selected third-party service providers to support functionality, subscriptions, communication, and monetization.

• RevenueCat for subscription and purchase management
• Google AdMob for advertising (Painfree German / DER DIE DAS only)
• Sentry for crash and error reporting
• Google Analytics for Firebase for usage analytics
• Microsoft Azure Cognitive Services for speech recognition, text-to-speech, and pronunciation assessment
• DeepSeek for AI-assisted answer validation and the website translator
• Cloudflare Turnstile for bot protection on the website tools
• Newsletter service provider, if a newsletter subscription is used

These providers may process data in accordance with their own privacy policies and applicable data protection requirements.

5. No Further Use of Data

The data collected directly by us is not:

• Sold to third parties
• Shared with third parties for independent marketing purposes by us
• Combined with unrelated external data sources by us
• Used for automated decision-making by us

Data is processed only for the purposes explicitly described in this policy. Please note that third-party providers such as Google AdMob (used only in the Painfree German / DER DIE DAS app) may process data according to their own privacy policies.

6. Data Storage and Retention

Data is stored only for as long as necessary to fulfill the stated purposes or until the user:

• Deletes their account, or
• Withdraws consent, for example by unsubscribing from the newsletter or changing advertising consent preferences (Painfree German / DER DIE DAS only)

Anonymous data that can no longer be linked to an identifiable user may be retained for statistical or analytical purposes.

7. Your Rights

Under GDPR, you have the right to:

• Access your data (Art. 15 GDPR)
• Rectify inaccurate data (Art. 16 GDPR)
• Delete your data (Art. 17 GDPR)
• Restrict processing (Art. 18 GDPR)
• Object to processing based on legitimate interest (Art. 21 GDPR)
• Withdraw consent at any time (Art. 7(3) GDPR)

To exercise your rights, please contact us using the email address listed for the relevant app or website in Section 2 above.

8. Children's Privacy

The app is not directed at children under the age of 13, and we do not knowingly collect personal data from children under 13. In the Painfree German / DER DIE DAS app, advertisements served via Google AdMob to users who are known to be children are limited to non-personalized ads, in accordance with Google's Families Policy requirements.

If you believe a child has provided us with personal data, please contact us using the email address listed for the relevant app or website in Section 2 above so we can delete it.

9. Changes to This Privacy Policy

This privacy policy may be updated if the scope of data processing changes. The current version will always be available within the app or on the website.