Privacy Policy

1. Controller
Responsible for data processing is:

Toba UG (Haftungsbeschränkt)
St. Johannerstr. 41-43
66111 Saarbrücken
Germany

Email: support@kasusknacker.com
Managing Director: Antonio Sanchez

A Data Protection Officer is not appointed pursuant to Art. 37 GDPR, as there is no legal obligation to do so.

2. General
This privacy policy clarifies the nature, scope, and purpose of the collection and use of personal data within the "KasusKnacker" application. We take the protection of your personal data very seriously.
This app is not directed at children under 16 years of age. We do not knowingly process personal data of children.

2a. SSL or TLS Encryption
For security reasons and to protect the transmission of confidential content, such as inquiries you send to us as the site operator, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the change in the browser's address line from "http://" to "https://" and by the lock symbol in your browser line.

3. Legal Bases for Processing
The processing of personal data is based on the following legal grounds:
- Art. 6(1)(b) GDPR (Contract performance): For providing app functionality, account management, synchronization of learning progress, and payment processing.
- Art. 6(1)(f) GDPR (Legitimate interest): For anonymous analytics to improve app quality and user experience, as well as for the security and stability of the infrastructure.

4. Hosting & Server Log Files
This app is currently hosted on Google Firebase. The provider automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:
- Browser type and browser version
- Operating system used
- Referrer URL
- Hostname of the accessing computer
- Time of the server request
- IP address

Primary data storage takes place in data centers within the European Union (Frankfurt region). Processing by Google Ireland Limited as well as for support and security measures in third countries (particularly the USA) cannot be entirely excluded. Google is certified under the EU-US Data Privacy Framework. Transfers are also based on Standard Contractual Clauses.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the technically error-free presentation and optimization of our website – the server log files must be recorded for this purpose).

We have a Data Processing Agreement (DPA) with the provider pursuant to Art. 28 GDPR. If the hosting provider changes, the purpose and legal bases of processing remain unchanged.

5. Firebase Authentication
For authentication, we use Firebase Authentication (Google Ireland Limited). The following data is processed:
- User ID (unique identifier)
- Email address
- Account creation timestamp
- Last sign-in timestamp
- Authentication provider information (Google, Apple, or Email)
- Password hash (for email sign-in, never stored in plain text)

Primary data storage takes place in the EU (Frankfurt region). Processing for support and security measures in third countries cannot be entirely excluded.
Legal basis: Art. 6(1)(b) GDPR (contract performance)

5a. App and Device Integrity (Firebase App Check)
To protect accounts, app functions, and our backend from abuse and unauthorized access, we use Firebase App Check. On Android, App Check uses Google Play Integrity; on iOS, Apple App Attest (or DeviceCheck on older devices). In the web app, App Check uses Google reCAPTCHA v3 – only once you open the email sign-in or sign-up form, and while you are signed in. If you use the web app without an account, reCAPTCHA is not loaded at all. The following data may be processed for this purpose:
- App metadata, such as package name, app version, and signing information
- General device metadata, such as operating system, model, brand, and form factor
- Integrity and attestation tokens, including device-attestation and license-status information
- For reCAPTCHA in the web app: IP address, browser and device information, and interaction signals while the sign-in form is open or you are signed in. For this, reCAPTCHA may set a cookie (“_GRECAPTCHA”) on google.com and store an entry in your browser’s local storage

The data is used only to verify that requests originate from an authentic app or a genuine browser session and to prevent fraud and misuse. It is not used for advertising or user tracking.
Providers: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (App Check, Play Integrity, reCAPTCHA); Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA (App Attest). reCAPTCHA data may also be processed by Google LLC in the USA; see section 12.
reCAPTCHA privacy policy: policies.google.com/privacy
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in securing accounts, the app, and the backend infrastructure). Storing and accessing information on your device for reCAPTCHA is strictly necessary to provide the account you request (§ 25(2) No. 2 TDDDG).

5b. Email Delivery (Resend)
We use the service Resend (Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) to deliver emails. Via Resend we send:
- Transactional account emails, e.g. the confirmation of your email address during registration
- Opt-in confirmations and – only with your explicit consent – learning reminders and news

For this purpose, your email address, the email content, and technical delivery data (e.g. delivery, bounce, and complaint events) are processed. You can unsubscribe from consent-based emails at any time via the unsubscribe link in every email or in the app settings; you may withdraw your consent at any time with effect for the future.
We have concluded a data processing agreement (DPA) with the provider pursuant to Art. 28 GDPR. Resend is certified under the EU-US Data Privacy Framework (EU-US DPF) and the UK Extension to the EU-US DPF; transfers to the USA are additionally based on Standard Contractual Clauses (Art. 46(2)(c) GDPR).
Legal basis: Art. 6(1)(b) GDPR (transactional account emails) and Art. 6(1)(a) GDPR (consent for reminders and news)

6. Analytics (Aptabase)
To understand usage patterns and improve the app, we use Aptabase, a privacy-focused analytics service. Aptabase does not use cookies, advertising identifiers, fingerprinting, or persistent device identifiers. We transmit anonymous event data such as:
- App version, platform, locale, device type, and operating system
- Use of app features, screens, learning modes, and purchase or paywall flows
- For Stories: catalog story identifiers, CEFR level, selected mode, completion, result totals, accuracy, and whether a translation was used
- For Schreibcheck: correction mode, German variety, a text-length range, the number of corrections, a processing-time range, and ratings (never the text itself)
- Campaign parameters contained in the current URL, such as source, medium, campaign, content, landing path, and referring hostname

Aptabase assigns a short-lived, random session value in memory so that events from one app session can be grouped. It is not saved on the device and cannot be used to recognize a user across sessions.
We do not transmit names, email addresses, Firebase user IDs, advertising IDs, user-entered answers or texts, or full referrer URLs to Aptabase. Event records are not linked to an account or identifiable individual.
Provider: Aptabase. Data is hosted in the European Union.
Privacy Policy: aptabase.com/legal/privacy
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving our app)
Our legitimate interest lies in the anonymous analysis of usage to improve stability and functionality. Users may object to this processing at any time (Art. 21 GDPR) by contacting us.

6a. Error Monitoring (Sentry)
For detecting and fixing technical errors, we use Sentry, an error monitoring service. When an error occurs, the following data is collected:
- Error reports and stack traces
- Device type, operating system, and app version
- Performance and diagnostic information related to the error
- Timestamp of the error
- For signed-in users, the Firebase user ID, so recurring account-specific errors can be diagnosed

Independently of errors, Sentry also receives performance data for a sample of sessions (about 20 %), such as page-load and navigation timings and the duration of requests to our backend. In the iOS and Android apps, for a small share of errors (about 10 %), a replay of the screen in the moments before the error may be transmitted, with all text masked and media blocked; the web app does not record replays.
Sentry is configured not to attach email addresses or the user's IP address to events by default. As with every internet connection, the receiving infrastructure temporarily processes the connection IP address to transmit and secure the request. We do not intentionally send learning content or user-entered answers to Sentry.
Data is used exclusively for error resolution and automatically deleted after 90 days.
Provider: Functional Software, Inc. (Sentry), USA. Primary data processing takes place in the EU (Frankfurt). Access by the provider in the context of support and security measures as well as processing in third countries (particularly the USA) cannot be entirely excluded. Transfers are based on Standard Contractual Clauses and, where applicable, adequacy decisions.
Privacy Policy: sentry.io/privacy
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in app security and stability)
Our legitimate interest lies in the early detection and resolution of errors to ensure stable app operation.

6b. Contact form (Tally)
For our contact form, we use Tally, a privacy-friendly form service based in Belgium (EU).

Data processed:
- Data you enter (name, email address, message)
- IP address
- Browser and device information
- Time of submission

Tally uses only essential cookies required for the form to function. No advertising or tracking cookies are used.
Data is hosted and processed in the European Union.
Provider: Tally NV, Belgium.
Privacy policy: tally.so/help/privacy-policy
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in processing contact enquiries).

6c. Aggregate Product and Retention Analysis
We use the account creation date and the dates recorded in a registered user's activity history to calculate aggregate signup cohorts and D1, D7, and D30 retention. The analysis reads only the fields required for these calculations. Reports contain cohort totals and percentages, not names, email addresses, or user IDs. No individual profile or automated decision is created from this analysis.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding and improving the app)
Registered users may object to this processing at any time under Art. 21 GDPR by contacting us.

7. What data we process
a) When visiting the app (Guest Mode):
Your learning progress (XP, Hearts, Streak) is stored locally on your device (LocalStorage). No transfer to our servers takes place unless you sign in.

b) When signing in (Registered User):
If you sign in via Google Sign-In or Apple Sign-In, we process the following data to sync your progress:
- Email address (for identification)
- Provider User ID (unique identifier)
- Your chosen nickname/username
- Learning progress data (XP, Level, Mistake rates, Streak)
- If you use Schreibcheck: your submitted texts, the corrections, and your history (see section 13a)
This data is stored in the Firebase Cloud Firestore database.
Legal basis: Art. 6(1)(b) GDPR (contract performance)

c) Google Sign-In:
For authentication, we use Google Sign-In. Data is exchanged with Google Ireland Limited. Google Privacy Policy: policies.google.com/privacy

d) Apple Sign-In:
For authentication on iOS devices, we also offer Apple Sign-In. The following data is processed:
- Apple User ID (unique identifier)
- Email address (if you allow sharing; with “Hide My Email” we receive an anonymized relay address)
Provider: Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA.
Privacy Policy: apple.com/legal/privacy
Data transfer note: Apple is certified under the EU-US Data Privacy Framework.

e) Email Sign-In:
You can also register directly with your email address and a password. The following data is processed:
- Email address (for identification and communication)
- Password (stored encrypted)
Authentication is handled via Firebase Authentication. Your password is never stored in plain text.

8. Purpose of Processing
We process account and learning-progress data to provide app functionality, synchronize learning status across devices, check and correct texts you submit to Schreibcheck, secure the service, administer subscriptions, resolve technical errors, and create aggregate statistics that help us improve the app.

9. Data Retention
- Account data: Your data is stored until you delete your account, or 3 years after your last activity (in case of inactivity).
- Analytics data (Aptabase): Anonymous event data is retained for no longer than 24 months and is then deleted.
- Website analytics data (Simple Analytics): Anonymous page-view and event statistics are retained for no longer than 24 months and are then deleted.
- Aggregate retention reports: Reports contain no account identifiers and may be retained for long-term product comparisons. The underlying account data follows the account-data retention period above.
- Payment data (RevenueCat): According to RevenueCat's retention policy.
- Error monitoring (Sentry): 90 days.
- Schreibcheck history: Stored in your account until you delete individual entries or your whole history, or until you delete your account. We keep at most your 100 most recent checks; older checks are deleted automatically.
- Schreibcheck at Google (Gemini API): Google stores submitted texts and responses for 55 days solely to detect and prevent abuse, and then deletes them.
- Contact form (Tally): Your enquiry is stored for as long as necessary to process it, but no longer than 6 months after the communication is concluded.

Statutory retention periods: Statutory retention periods (e.g., tax or commercial retention periods under § 147 AO or § 257 HGB) remain unaffected (legal basis: Art. 6(1)(c) GDPR). In these cases, data is deleted after the expiry of these periods.

10. Your Rights & Deletion
You have the right to access, rectification, and deletion of your data at any time. You can irrevocably delete your account and all associated data yourself at any time using the “Delete Account” function in the profile menu.

Your rights at a glance:
- Right to access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object (Art. 21 GDPR)
- Right to withdraw consent (Art. 7(3) GDPR): If you have given us consent to process your data, you may withdraw it at any time with effect for the future. The lawfulness of processing carried out prior to the withdrawal remains unaffected.

Objection to processing based on legitimate interests (Art. 21 GDPR):
Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR) — in particular for analytics via Aptabase, Sentry, or Simple Analytics — you have the right to object to this processing at any time. We will then cease the processing unless we can demonstrate compelling legitimate grounds.

Exercising your rights:
To exercise your rights, please contact us by email at support@kasusknacker.com. We will process your request without undue delay, at the latest within one month.

11. Payment Processing & Subscriptions
For processing in-app purchases and subscriptions, we use the payment services of the respective app stores (Apple App Store, Google Play Store). Financial transactions are processed exclusively through these services. We do not store any credit card or banking information ourselves.

For the technical management of subscriptions and purchases, we use the service RevenueCat (RevenueCat, Inc., USA). Pseudonymized App User IDs and purchase status information are transmitted to provide your premium content across devices. RevenueCat processes data exclusively on our behalf based on a Data Processing Agreement (Art. 28 GDPR).
RevenueCat Privacy Policy: revenuecat.com/privacy
Legal basis: Art. 6(1)(b) GDPR (contract performance)

11a. Payments in the browser (Paddle)
If you buy Premium on our website, the purchase is made through Paddle (Paddle.com Market Limited, Judd House, 18-29 Mora Street, London EC1V 8BT, United Kingdom). Paddle acts as the merchant of record: Paddle is your contracting party for the purchase, issues the invoice, calculates and remits VAT or sales tax, and processes the payment. For this Paddle processes your email address, your country or postcode, your payment details and your IP address. We never receive card details; from Paddle, via RevenueCat (section 11), we receive the status of your subscription to unlock Premium, and we use your email address to open subscription management (cancellation, payment method) in the Paddle customer portal for you. Paddle is an independent controller for this processing. The United Kingdom is covered by an EU adequacy decision.
Paddle privacy policy: paddle.com/legal/privacy
Legal basis: Art. 6(1)(b) GDPR (contract performance)

12. Data Transfers to Third Countries
In connection with the use of our app and website, personal data may be transferred to third countries (particularly the USA). Such transfers are based on adequacy decisions (Art. 45 GDPR), Standard Contractual Clauses (Art. 46(2)(c) GDPR), and/or certification under the EU-US Data Privacy Framework.

Affected services and providers:
- Google / Firebase (Google Ireland Limited): Hosting, authentication, database, app integrity (App Check, reCAPTCHA). Primary data storage in the EU (Frankfurt). Access from third countries possible for support/security measures. Google is certified under the EU-US Data Privacy Framework.
- Apple (Apple Inc., USA): Apple Sign-In, App Attest (iOS). Apple is certified under the EU-US Data Privacy Framework.
- RevenueCat (RevenueCat, Inc., USA): Subscription management. RevenueCat is certified under the EU-US Data Privacy Framework. More information: revenuecat.com/dpa
- Sentry (Functional Software, Inc., USA): Error monitoring. Primary data processing in the EU (Frankfurt). Access from third countries possible for support/security measures. Transfers based on Standard Contractual Clauses.
- Resend (Resend, Inc., USA): Email delivery (transactional account emails and consent-based reminders and news). Resend is certified under the EU-US Data Privacy Framework; transfers additionally based on Standard Contractual Clauses.
- Google Gemini API (Google): Text correction in Schreibcheck. The texts you submit may be processed in any country in which Google or its agents maintain facilities, including the USA. Google is certified under the EU-US Data Privacy Framework; transfers are additionally based on Standard Contractual Clauses.
- Tally (Tally NV, Belgium): Contact form. Data is processed exclusively in the EU.

13. Automated Decision-Making
Automated decision-making including profiling pursuant to Art. 22 GDPR does not take place.

13a. Artificial Intelligence (AI) and Schreibcheck
a) Creating learning content: We use artificial intelligence technologies (e.g., language models) to generate and optimize learning content, example sentences, and translations within the app. During this content creation, no personal user data is transmitted to or processed by the AI providers.

b) Schreibcheck (writing check): Signed-in users can have German texts they write checked and corrected. For this purpose, the text you enter is sent via our server (Google Cloud Functions, EU region Frankfurt) to the Gemini API of Google, which returns a corrected version with explanations. The following data is transmitted to Google:
- The text you entered
- The settings of the check (correction mode, explanation language, and German variety)
We do not transmit your name, email address, or user ID to Google.

We use the Gemini API as a paid service. Google processes the texts as our processor on the basis of a Data Processing Agreement (Art. 28 GDPR) and does not use them to train or improve its models. Google stores texts and responses for 55 days solely to detect and prevent abuse. The data may be processed in any country in which Google or its agents maintain facilities, including the USA (see section 12).
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Gemini API terms: ai.google.dev/gemini-api/terms

Please do not enter names, addresses, or other personal data about yourself or others, and in particular no sensitive data (e.g., about health, religion, or political opinions). Replace such details with placeholders before checking a text.

Your history: So that you can review your corrections later, we store the following in your account (Firebase Cloud Firestore, EU region Frankfurt): your original text, the corrected version and explanations, the settings of the check, technical information (the AI model used, processing time, and usage volume), and, if you give it, your rating of the result with an optional comment. We keep at most your 100 most recent checks. You can delete individual entries or your whole history in the app at any time; everything is deleted when you delete your account. We also store a counter of your checks per day to enforce the daily limit. Our server logs record your user ID and technical information such as the length of the text, but not the text itself.

Corrections are generated automatically and may contain mistakes. They are learning aids only and are not a decision with legal effect on you within the meaning of Art. 22 GDPR.
Legal basis: Art. 6(1)(b) GDPR (contract performance: providing the Schreibcheck you request and your history). For evaluating your ratings to improve the quality of the corrections: Art. 6(1)(f) GDPR (legitimate interest in improving the app).

13b. Chrome extension “KasusKnacker Schreibcheck”
The extension connects to your KasusKnacker account once. Our server issues a short-lived sign-in token that is handed only to the extension; the extension then stores your session locally in your browser.
The extension reads page content only when you hand selected text to it through the context menu or its icon. It does not read pages in the background and injects nothing into websites.
Only the text you submit is checked. It is processed exactly as in the app's Schreibcheck and stored in your history (see section 13a). Locally, the extension stores your settings (mode, language variety, explanation language), your consent to AI processing, only briefly until the side panel has taken it over the text you selected, and your unsent draft, which is kept only in the browser's session memory until you close the browser or have the text checked. The extension contains no analytics or advertising services.

14. Cookies & Local Storage
We do not use any advertising or tracking cookies, and we do not show a cookie banner. The app and the website store only the following information on your device:
- Sign-in (Firebase Authentication): your sign-in session is kept in the browser’s local storage (IndexedDB), not in a cookie, so that you stay signed in. Strictly necessary.
- Learning progress and settings: progress, streaks, saved exercises, offline content, and your preferences are stored locally in the app (see section 7). Strictly necessary.
- App Check / reCAPTCHA (web app only): a cookie on google.com and an entry in local storage, only once you open the email sign-in form or while you are signed in (see section 5a). Strictly necessary for the security of your account.
- Payments: Paddle (section 11a) and RevenueCat set the cookies required for the checkout only on their own checkout pages once you start a purchase. Strictly necessary for the transaction.
- Contact form (Tally): essential cookies only, if any, within the embedded form (section 6b).
- Website (kasusknacker.com): Simple Analytics sets no cookies (section 16). If you dismiss the “Get the app” banner, that choice is remembered in local storage for 30 days. Where you arrived from (for example “search engine” or the campaign parameters of the link you clicked) is kept in session storage for the duration of your visit and handed to the web app when you open it, so that we can see which channels bring learners to KasusKnacker. This value contains no identifier and is deleted when you close the tab.
The storage marked as strictly necessary does not require consent (§ 25(2) No. 2 TDDDG; Art. 6(1)(b) and (f) GDPR). The remaining entries contain no personal data.

15. Web Fonts
This app uses so-called Web Fonts for the uniform representation of fonts. These are provided locally by our server. When you open the app, your browser loads the required web fonts into its browser cache. For this purpose, the browser does not establish a connection to Google servers. No data is transmitted to Google Fonts.

16. Website Analytics (Simple Analytics)
For our website (kasusknacker.com), we use Simple Analytics, a privacy-first analytics service. Simple Analytics does not use cookies, does not track visitors across websites, and does not collect any personal data. We collect aggregated, anonymous page-view statistics such as page views and referrer information. We also count clicks on links leading to the web app, Apple App Store, or Google Play Store. These click events can include the destination, page, placement of the link, and page language. They do not contain a visitor or device identifier.
We respect the "Do Not Track" browser setting—if enabled, no data is collected at all.
Provider: Simple Analytics B.V., The Netherlands.
Privacy Policy: simpleanalytics.com/privacy-policy
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in analyzing website usage)
Our legitimate interest lies in analyzing aggregated usage data to improve our website. Users may object to this processing (Art. 21 GDPR) by enabling the “Do Not Track” setting or by contacting us.

17. Social Media Presence
We maintain profiles on Instagram, Facebook, Pinterest, X, and Reddit. When you visit these profiles, the respective platforms process personal data under their own responsibility. We only receive aggregated statistics (e.g., reach or engagement) and no personal data unless you contact us directly via these platforms. In that case, we process the data you provide to respond to your request.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in communication and outreach)

18. Right to Lodge a Complaint with a Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data.

Competent supervisory authority:
Unabhängiges Datenschutzzentrum Saarland
Fritz-Dobisch-Straße 12
66111 Saarbrücken, Germany
Email: poststelle@datenschutz.saarland.de
Website: datenschutz.saarland.de

19. Updates to this Privacy Policy
This privacy policy is currently valid as of: September 24, 2026.
Due to the continued development of our app or changes in legal or regulatory requirements, it may become necessary to update this privacy policy. If we materially change how we process data we already process about you, or make a change that affects your rights, we will inform you in advance within the app or on the website (e.g., via a notice or banner). New optional features that process additional data are described in this privacy policy and on the screen where you use them; data is only processed once you choose to use such a feature. Where consent is legally required, we will obtain it.