Privacy Policy
Last updated: August 2026
This privacy policy informs you about how we process personal data in connection with the use of the language learning app FlowLingua and its associated website. Processing is carried out in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and all other applicable data protection provisions, in particular the German Telecommunications-Digital-Services-Data-Protection-Act (TDDDG).
Controller
Controller for data processing within the meaning of the GDPR:
Tomas Chladek
Altkönigstr. 20
61169 Friedberg
Germany
Email: support@flowlingua.com
1. Overview and general information
1.1 Purpose of the application. FlowLingua is an application for learning languages. You can import your own content (books, documents, audio files, videos), receive machine-generated word-for-word translations ("de-codings"), sentence translations, dictionary entries and definitions, and manage your learning progress (vocabulary, favorites, bookmarks).
1.2 Personal data. Personal data is any information relating to an identified or identifiable natural person. We process personal data only to the extent necessary for the provision of our services or where a legal basis requires or permits it.
1.3 No advertising, no tracking. FlowLingua contains no advertising, no ad SDKs, no Firebase, no Sentry and no analytics services. There is no tracking of your usage behavior by third parties. Neither the app nor the website sets marketing or tracking cookies.
1.4 Website. The FlowLingua website is a static website. It sets no cookies, uses no analytics tools and stores no visitor data. The fonts used on the website are loaded locally from our own servers — your IP address is not transmitted to third parties (e.g. Google) in this context. A consent banner is therefore not required.
2. Processing of personal data in detail
2.1 Account and registration (email/password)
Data processed: Email address, encrypted (hashed) password, and, where applicable, the user ID created for the account.
Purpose: Registration, authentication, account management, provision of the features available after sign-in, re-authentication.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract; the provision of the data is necessary for the conclusion and performance of the user contract).
Sign-in with email and password is handled by our hosting provider Supabase (see Section 4).
Safety net in case of loss of access: If you no longer have access to your account (e.g. a forgotten password), you can exercise your rights and have your account deleted at any time by email to support@flowlingua.com; we will verify your identity on the basis of the email address stored with us.
2.2 Sign-in with Google (OAuth)
Data processed: Your Google account identifier and the email address stored in your Google account; furthermore, the access token provided by Google in the course of sign-in.
Purpose: Sign-in and authentication via your Google account, enabling you to use FlowLingua without separate password management.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
When signing in with Google, data (including your IP address) is transferred to Google LLC (USA). For details, see Sections 4 and 5.
2.3 Profile data
Data processed: Display name, native language, target language(s) being learned, preferred language settings.
Purpose: Personalization of your account and provision of correct translations and learning content.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
2.4 User content (uploaded books, documents, audio, videos)
Data processed: Content uploaded or imported by you, e.g. documents (PDF, EPUB, DOCX), audio files (MP3, WAV, M4A) as well as YouTube videos or their captions. This also includes the data generated from them: extracted texts, transcripts, word-for-word translations ("de-codings"), sentence translations, dictionary entries and word-level timings.
Purpose: Provision of the core services: importing and processing your content, machine transcription of audio, machine translation, chapter and structure recognition, and interactive learning ("Flow").
Legal basis: Art. 6(1)(b) GDPR (performance of a contract). To the extent that content contains special categories of data within the meaning of Art. 9 GDPR (e.g. information on health, religion or political opinion in texts you have imported), we process such data exclusively for the provision of the service on the basis of Art. 9(2)(e) GDPR (data you have manifestly made public); for a public release we additionally obtain your explicit consent (Art. 9(2)(a) GDPR).
Storage and processing by service providers: Your content is stored with our hosting provider within the European Union (Section 4). For linguistic processing, your content is transferred to processors (Groq, Google Gemini via OpenRouter, DeepSeek) — for details, see Sections 4 and 5.
Public library: To the extent that you release content publicly in the app, it becomes visible to other users (title, author and, where applicable, your display name/uploading person). The legal basis for this is Art. 6(1)(b) GDPR (performance of the library function); insofar as special categories (Art. 9 GDPR) are affected, your explicit consent, which we obtain separately before the public release.
Thumbnails and covers: Cover images and video preview images (thumbnails) are obtained from services such as YouTube and Google Books and displayed in the app. They are only cached on your device and are not re-published on our servers (no re-hosting).
2.5 Usage data and learning progress
Data processed: Vocabulary list, learned words, repetition data, favorites, bookmarks, learning progress, usage counters (e.g. words processed, number of imports, audio minutes used per month).
Purpose: Provision of learning progress and favorites management, implementation of the functional limits of the selected subscription model (Free/Premium tier).
Legal basis: Art. 6(1)(b) GDPR (performance of a contract); insofar as usage counters are required for billing and service limiting, also Art. 6(1)(b) GDPR.
2.6 Purchase and subscription data (RevenueCat / Google Play)
Data processed: Subscription status, selected subscription product, purchase/order history, subscription start and end, and, where applicable, identifiers issued by the subscription service. Not processed are your payment data (card number, bank details) — these are processed exclusively by the payment provider Google (Google Play).
Purpose: Billing, management of your subscription, recognition of entitlements, redemption of the trial period, assignment to the selected price tier.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
Billing is carried out via Google Play Billing (Google Ireland Limited or Google LLC). We use the service RevenueCat as a processor for the management and billing of subscriptions (Section 4).
2.7 Contact requests and email forwarding (Resend)
Data processed: When you contact us: your email address, your name (if provided), and the content of your message. In the case of copyright notices (notice-and-takedown), additionally the information contained in the notice (cf. Terms of Service).
Purpose: Handling your requests, support and legal or copyright infringement notices.
Legal basis: Art. 6(1)(b) or Art. 6(1)(f) GDPR (legitimate interest in processing user requests); in the case of infringement notices, where applicable Art. 6(1)(c) GDPR (legal obligation).
Incoming emails are forwarded to our mailbox via the service Resend (USA) (Section 4).
2.8 Technical information and error logs (UDP logging)
Data processed: In the event of an error, technical information such as error messages, program tags and system information. These logs contain no personal data, no email addresses, no user IDs and no content; they are anonymous.
Purpose: Error detection, troubleshooting and improvement of app stability.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security and functionality of the app).
Important note: This debug logging is active exclusively in development/test builds. In published release builds of the app, it is disabled.
2.9 Security and abuse protection
Data processed: Technical security data (e.g. access and log data of the service); where the sign-in security feature is used, also data processed by a captcha service (hCaptcha) (Section 4).
Purpose: Ensuring the security of the services, protection against abuse, spam and unauthorized access, troubleshooting.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security of our services).
hCaptcha (optional): To protect sign-in against abuse, we may use the hCaptcha service provided by Intuition Machines, Inc. (USA). In the course of the check, your IP address may be transmitted to hCaptcha. This service is currently not yet activated; if it is to be used in the future, we will inform you in this privacy policy before activation. hCaptcha processes data on the basis of Art. 6(1)(f) GDPR (legitimate interest in abuse protection) or, where required, on the basis of separate consent.
3. Disclosure of data to recipients
Personal data is disclosed to the following recipients to the extent necessary for the purposes described above:
- Hosting and database service provider (Supabase) – storage of accounts, content and usage data
- Processors for AI processing (Groq, Google Gemini via OpenRouter, DeepSeek) – machine transcription, translation, de-coding and parsing
- Email service provider (Resend) – forwarding of contact and legal notices
- Subscription and payment services (RevenueCat, Google Play) – subscription and purchase management
- Third-party content providers (YouTube, Google Books) – import functions and thumbnails
- Public caption third-party providers (Invidious instances, Cloudflare) – fallback when fetching captions
- Supervisory authorities, courts and legal advisors – where legally required or for the defense of legal claims
Details on processors and third-country transfers can be found in Sections 4 and 5.
4. Processors
We use the following processors to provide our services. Data processing agreements pursuant to Art. 28 GDPR have been concluded with all processors. Where no adequacy decision of the European Commission exists for the respective recipient country, we have agreed on appropriate safeguards (in particular Standard Contractual Clauses – "SCCs"; for the USA additionally reliance on the EU-US Data Privacy Framework – "DPF").
| Processor | Purpose | Country / processing location | Third-country safeguards |
|---|---|---|---|
| Supabase Inc. | Hosting, authentication, database, file storage, server functions | EU (project region), US parent company | DPA pursuant to Art. 28 GDPR; SCCs; data stored in the EU |
| Groq, Inc. | Whisper transcription of audio files; word de-coding when tapping individual words (model gpt-oss-120b); sentence translations (model gpt-oss-120b); word definitions and alternatives (model gpt-oss-20b); where applicable, chapter/structure recognition for book imports (model gpt-oss-120b) | USA | DPA; SCCs; zero data retention; no training with customer data |
| Google LLC (Gemini API; access via OpenRouter, paid access) | Chapter/structure recognition for book imports (optional provider); fallback for word de-coding | USA | EU-US DPF; SCCs; no training use of your data with paid access |
| DeepSeek (Hangzhou) Technology Co., Ltd. | Translation of isolated individual words (word lists) | China | No adequacy decision for China – see Section 5.2 |
| Resend (Plus Five Five, Inc.) | Email reception and forwarding (support, legal and copyright notices) | USA | DPA; SCCs |
| RevenueCat, Inc. | Subscription and billing management (Google Play Billing) | USA | DPA; SCCs |
| Intuition Machines, Inc. (hCaptcha) – optional, currently inactive | Abuse protection at sign-in | USA | DPA; SCCs; only applicable after activation |
Google Play (Google Ireland Limited / Google LLC) is not a processor, but is itself the controller for the processing of payments and subscription management. When purchasing via Google Play, Google's privacy notices apply.
Public third-party providers (Invidious instances) and Cloudflare: When fetching captions as a fallback, your video selection (video ID) may be transmitted to publicly operated Invidious instances. These are operated by third parties without a data processing agreement; only the YouTube video ID is transmitted, without further user information and without any link to your user account. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the functionality of the caption retrieval as a fallback). We use these services only as a fallback. We process the caption retrieval operated by ourselves (Cloudflare Worker) as our own service.
5. Transfers to third countries
5.1 General. When using our services, data may be transferred to countries outside the European Union or the European Economic Area. Where no adequacy decision of the European Commission exists for the recipient country (a third country in the narrower sense), the transfer is based on appropriate safeguards: Standard Contractual Clauses (Implementing Decision (EU) 2021/914) and/or – for the USA – on the basis of the EU-US Data Privacy Framework. We will provide you with a copy of the safeguards upon request.
5.2 DeepSeek (China) – translation of isolated individual words. For the translation of individual words (word lists without sentence context), the service DeepSeek (DeepSeek (Hangzhou) Technology Co., Ltd., China) may be used.
Important: In this context, exclusively individual, isolated words without sentence context and without any link to your person are transferred (e.g. the words "house", "go", "parameter"). As a rule, no personal data is processed in this processing step (only isolated individual words are transmitted); in particular, neither your email address, nor your user account, nor related text content is transmitted to DeepSeek.
There is no adequacy decision of the European Commission for China. Since no personal data is transferred in this processing, this processing step is not subject to the transfer restrictions of Chapter V GDPR. Should the data category, the processing steps or the legal situation change, we will adjust this privacy policy without undue delay and – where required – obtain separate consent.
5.3 AI training. We ensure that your data – insofar as it is transferred to AI service providers – is not used for training AI models: Groq and Google (paid API access) contractually commit themselves or are bound by their terms of service not to use customer data for training. As described in Section 5.2, DeepSeek receives exclusively isolated individual words without any personal reference.
6. Storage duration and deletion
6.1 Principle. We store personal data only as long as is necessary for the provision of our contractual services or as required by statutory retention obligations.
6.2 Specific retention periods:
- Account data (email, password hash, profile): until your account is deleted; deletion thereafter (statutory retention obligations remain unaffected).
- User content and data derived from it (transcripts, translations, de-codings): until your account is deleted or until you delete the respective content. Temporary files uploaded for processing are deleted immediately after processing has been completed.
- Vocabulary, learning progress, favorites, bookmarks, usage counters: until your account is deleted; usage counters are reset monthly.
- Purchase and subscription data: for as long as the subscription exists and thereafter for the duration of statutory retention obligations (including commercial and tax retention obligations, generally 6–10 years, where applicable).
- Email correspondence: until your request has been fully processed, deletion thereafter; in the case of legal notices, until the matter has been finally resolved.
- Anonymous technical error logs: only on a short-term basis for error analysis.
6.3 Account deletion. You can delete your account at any time in the app. When your account is deleted, your profile data, vocabulary, favorites, bookmarks, uploaded content and data derived from it are permanently removed. Services responsible for deletion and data handling (e.g. the RevenueCat subscription assignment) are instructed accordingly. Irrespective of this, an ongoing subscription via Google Play must be cancelled by you in the Google Play subscription settings (see Terms of Service). Statutory retention obligations remain unaffected. If you no longer have access to your account (e.g. a forgotten password), you can exercise your rights and have your account deleted at any time by email to support@flowlingua.com; we will verify your identity on the basis of the email address stored with us.
7. Your rights as a data subject
Within the scope of the statutory provisions, you have the following rights:
- Right of access (Art. 15 GDPR) – to the personal data we process about you
- Right to rectification (Art. 16 GDPR) – of inaccurate data
- Right to erasure (Art. 17 GDPR) – the "right to be forgotten"
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR) – in a structured, machine-readable format
- Right to object (Art. 21 GDPR) – to processing based on Art. 6(1)(f) GDPR
- Right to withdraw consent (Art. 7(3) GDPR) – with effect for the future
To exercise your rights, please contact us by email at: support@flowlingua.com. We process your request to assert your rights on the basis of Art. 6(1)(c) GDPR.
Please note: Claims for erasure do not exist insofar as statutory retention obligations conflict with them or the processing is necessary for the establishment, exercise or defense of legal claims.
8. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority about our processing of personal data (Art. 77 GDPR).
The authority responsible for us is:
The Hessian Commissioner for Data Protection and Freedom of Information (HBDI)
Gustav-Stresemann-Ring 1
65189 Wiesbaden
Germany
Website: https://datenschutz.hessen.de
9. Automated decision-making / profiling
Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place. Machine translations and de-codings ("AI-generated content") are generated automatically solely for the purpose of providing the service; no legal or similarly significant decisions about you are made on this basis. AI-generated content is labeled accordingly in the app.
10. Minors
FlowLingua is aimed at users aged 16 and over. Use by minors is only permitted with the consent of their parents or legal guardians; consent-based processing is carried out on the basis of Art. 8 GDPR.
11. Security measures
We take technical and organizational measures pursuant to Art. 32 GDPR to protect your data against unauthorized access, loss or manipulation, including:
- TLS encryption of data transmission (transport encryption)
- Encrypted storage of passwords (password hash)
- Access control concept at database and storage level (row-level security)
- Confidentiality obligations and training of persons with access to data
- Regular security reviews
12. Changes to this privacy policy
We reserve the right to adapt this privacy policy to reflect changes in the legal situation, changes to our services or changes in the data processing. We will inform you of material changes within the app. The current version is available in the app under Settings > Privacy and on our website.