Privacy Policy
Last updated: July 4, 2026 · Deutsche Fassung (the German version is authoritative)
This policy explains what personal data the StkAufnahme mobile app (iOS and Android) processes, why, and what rights you have.
1. Controller
Bohdan Pavliuk
Südliche Ringstraße 25
63225 Langen (Hessen)
Germany
Email: piuspavliuk@gmail.com
2. Data we process
- Account data: email address and password (stored only as a cryptographic hash), or your Apple / Google sign-in identity, and a display name.
- Profile and learning data: your chosen city, Studienkolleg, course type (T/M/W/G), language level, exam date, app language, learning progress (completed exercises, answers, scores, streaks), and vocabulary lists.
- Subscription data: subscription status and purchase receipts, keyed by a pseudonymous user ID. Payments are handled entirely by Apple or Google — we never see your payment details.
- Exercise answers for AI grading: the text of your free-form answers for certain exercise types (see section 6).
The app shows no ads and uses no advertising trackers and no third-party analytics services (see section 7 for our own, first-party usage statistics).
3. Account and authentication
You create an account via email/password, Sign in with Apple, or Sign in with Google. Authentication and storage of account, profile, and learning data are provided by our processor Supabase (Supabase, Inc., Singapore). Legal basis: Art. 6(1)(b) GDPR (performance of contract).
4. Profile and learning data
Your onboarding choices and learning progress are stored so the app can show you the right exercise content and keep your progress in sync across devices. Legal basis: Art. 6(1)(b) GDPR.
5. Subscriptions and purchases
Subscriptions are purchased and billed through the Apple App Store or Google Play. We use RevenueCat (RevenueCat, Inc., Oakland, CA, USA) to manage subscription status. RevenueCat receives a pseudonymous user ID and purchase receipts, but no name and no payment details. Legal basis: Art. 6(1)(b) GDPR. Transfers to the USA are covered by EU Standard Contractual Clauses; RevenueCat is also certified under the EU-U.S. Data Privacy Framework.
6. AI-assisted grading of exercise answers
For certain exercise types (e.g. sentence transformations), the text of your answer is sent to OpenRouter (OpenRouter, Inc., USA) and processed by an AI language model to grade it and explain mistakes. Only the exercise and answer text is transmitted — no names, email addresses, or identifiers that directly identify you. Answers are not used to train models. Legal basis: Art. 6(1)(b) GDPR (grading is part of the learning service). Transfers to the USA are covered by EU Standard Contractual Clauses.
7. Product improvement (first-party analytics)
To improve the app, we log a small number of pseudonymous usage events (e.g. “welcome screen viewed”, “purchase completed”) in our own database (Supabase). These events are keyed to a random installation ID — not to your name, email address, or account. No third-party analytics services are used, and there is no tracking across other apps or websites. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving the app).
8. Notifications
Study reminders are local notifications scheduled on your device. No data is sent to our servers for this. You can turn reminders off at any time in the app or in your system settings.
9. Retention and deletion
Your data is kept for as long as your account exists. You can delete your account directly in the app (Profile → “Delete account”). This immediately and permanently deletes your account and all associated profile and learning data from our database. Purchase records held by Apple/Google are subject to their own retention rules; statutory retention obligations remain unaffected.
10. Recipients and international transfers
| Provider | Purpose | Location / transfer safeguard |
|---|---|---|
| Supabase, Inc. | Database, authentication, hosting | Singapore / EU SCCs |
| RevenueCat, Inc. | Subscription management | USA / SCCs + EU-U.S. DPF |
| OpenRouter, Inc. | AI grading of exercise answers | USA / SCCs |
| Apple Inc. / Google LLC | App distribution, payment processing | USA / independent controllers, DPF |
11. Your rights
Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17 — also available directly in the app), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing based on legitimate interests (Art. 21). To exercise any of these rights, email piuspavliuk@gmail.com.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), e.g. the Hessian Commissioner for Data Protection and Freedom of Information, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.
12. Changes
We update this policy when the app or the legal situation changes. The current version is always available at this address; the date above indicates the revision.