Last Updated: 15.09.2026
This Privacy Policy explains the processing of personal data when using our iOS app "wortspatz" (the "App") and its online features.
Ibach Innovation UG
Bei der Apostelkirche 15
20257 Hamburg
Germany
Email: wortspatz@andgineering.com
Your personal vocabulary collection, learning progress, levels, and streaks are stored locally on your device. Device registration and the online features described below also process data on external systems. Your entire learning progress is not automatically synchronised with our backend.
To secure our API (the interface between the App and our backend), the App registers a technical device identifier with our backend. We use this identifier and technical security checks to restrict protected API access to requests from the App and help prevent unauthorised access. Registration stores a randomly generated device identifier and the registration time; it does not require a personal user account.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is operating the App securely and protecting our API against unauthorised access and abuse. Protected online features cannot be used without the required security checks.
When you use translation, your entered text and language settings are sent to our backend. If a matching translation has not already been stored, we send this information to DeepL SE, Maarweg 165, 50825 Cologne, Germany, to produce the translation.
We store the source text, translation, and language information on our backend so that the translation can be reused for subsequent matching requests.
Legal basis: Art. 6(1)(b) GDPR for the requested translation; Art. 6(1)(f) GDPR for reusing stored translations. Our legitimate interest is providing fast translations while conserving resources.
More information: DeepL privacy information.
When you start AI photo import, we send your selected images and language and processing settings through our backend to Amazon Web Services (AWS), using Amazon Bedrock. The service recognises vocabulary and any translations in the images or generates translations when requested. Images may also contain personal information visible in them. Please select only content needed for your import.
We use the Amazon Bedrock regional endpoint in Frankfurt, Germany (eu-central-1). The regional endpoint alone does not determine an exclusive processing location for every model: when cross-region inference is used, processing follows the selected model profile. See section 5 for information about possible international transfers.
Our backend processes uploaded images in memory and does not store them permanently. Results are returned to the App for review and addition to your local vocabulary collection. Any retention by AWS, particularly for abuse detection, depends on the applicable model terms and settings; this does not constitute an unconditional guarantee of zero retention by AWS.
Legal basis: Art. 6(1)(b) GDPR (providing the feature you requested). AI photo import cannot operate without transmitting the selected image.
More information: AWS privacy information and Amazon Bedrock data retention.
When you share vocabulary, we store the selected content, title, description, language information, and, where supplied, the device identifier and original collection identifier on our backend. People with the link can access the shared learning content; they can forward the link or import content into their own collections.
Legal basis: Art. 6(1)(b) GDPR (providing the sharing feature you requested).
When you submit a collection to the community, we store the submitted learning content, title, description, language and category information, and any email address and device identifier supplied. This serves to process and provide your contribution. Published learning content can be found and imported by other users. The email address supplied as contact information and the device identifier are not part of the published learning content.
Legal basis: Art. 6(1)(b) GDPR (processing and providing the community contribution you submitted).
We use RevenueCat, Inc., USA, to manage in-app purchases, check Pro access, and restore previous purchases. In supported iOS versions, RevenueCat is integrated when the App starts and contacted again when the App returns to the foreground to refresh offerings and purchase entitlements, even if you do not make a new purchase.
RevenueCat processes a pseudonymous app user identifier generated by the service, purchase and transaction information including purchase receipts and unlocked entitlements, and technical information about the App and device. This identifier is separate from our device identifier used for API security. Payments are handled by the Apple App Store; this does not give us complete payment details such as credit card numbers.
Legal basis: Art. 6(1)(b) GDPR for carrying out and restoring requested purchases and providing purchased features. Checking existing entitlements and providing current offerings at App startup is based on Art. 6(1)(f) GDPR; our legitimate interest is reliably managing and displaying available Pro access.
RevenueCat operates the systems that store this data. We do not have direct control over its internal technical storage or retention required by RevenueCat's own legal obligations. Where RevenueCat processes data on our behalf, we remain responsible for that processing and can submit instructions and correction or deletion requests under the applicable contractual and legal provisions. This does not limit your privacy rights; please use the contact details in section 1 to exercise them.
More information: RevenueCat privacy information and RevenueCat Data Processing Addendum.
Our backend and its stored data are hosted on a server in Germany by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. For translation and AI photo import, the service providers named in section 4 receive the data described there.
RevenueCat processes the data described in section 4 e on infrastructure in the USA. Its Data Processing Addendum provides for EU Standard Contractual Clauses for applicable transfers from the EEA.
A server location in the EU does not exclude all processing outside the EU or EEA, for example within international service provider structures. Such transfers are permitted only under the conditions of Art. 44 et seq. GDPR, for example an applicable adequacy decision or appropriate safeguards such as EU Standard Contractual Clauses. You can request information about the recipients, processing locations, and any safeguards applicable to your processing using the contact details in section 1.
Uninstalling the App does not automatically delete data from our backend. Your statutory erasure rights remain unaffected.
Subject to the applicable legal conditions, you have rights of access, rectification, erasure, restriction of processing, and data portability. Where we process data based on legitimate interests, you may object under Art. 21 GDPR on grounds relating to your particular situation. Where processing is based on your consent, you may withdraw it at any time with effect for the future.
To exercise your rights, contact us at the email address in section 1. Where available, include the relevant device identifier or collection link to help us locate server-side data.
You also have the right to complain to a data protection supervisory authority, particularly in the place of your habitual residence, your workplace, or the alleged infringement.
We implement technical and organisational measures to protect your data. Transfers between the App, our backend, and integrated online services are encrypted using TLS.
We update this Privacy Policy when processing or legal requirements change and make the current version available in the App.