Privacy Policy

1. Controller

The party responsible for data processing on langula.app is:
Thomas Harnisch, Königskinderweg 74f, 22457 Hamburg, Germany
Email: info@langula.app

2. Overview

Langula is designed to be data-sparing. You can use the learning content without creating an account; your progress is then stored only locally in your browser. You only need an account if you want to sync your progress across devices.

3. Hosting and server log files

Our website runs on a hosting provider with servers in Germany. When you visit, the server automatically collects information your browser transmits (server log files): browser type and version, operating system, referrer URL, host name of the accessing computer, time of the request and the IP address. This data serves the technical provision, security and stability of the site and is deleted after 7 days at the latest. The legal basis is our legitimate interest in secure operation (Art. 6 (1) (f) GDPR).

Visitor counting without cookies. To know how many people use Langula each day, we count page views on our server. For this we create a non-reversible hash from your IP address, your browser type and a random value that is newly generated every day, and note whether you were signed in that day and used the learning area. We store nothing on your device for this and set no cookie. At the end of the day the values are combined into daily totals and deleted together with the random value; after that no conclusion about you is possible, not even across several days. The legal basis is our legitimate interest in data-sparing audience measurement (Art. 6(1)(f) GDPR).

Anonymous learning statistics. If you learn without an account, we count completed lessons and opened areas of the learning section together with the target language, the source language and, since 27 October 2026, the country that our CDN Cloudflare derives from the IP address. Only the country code is stored, not the IP address; there is no cookie and no identifier, and the events cannot be linked to a person. We publish these figures in aggregated form in the Language Report. The legal basis is our legitimate interest in improving the service and in analyses of language learning (Art. 6(1)(f) GDPR).

German placement test. If you take the placement test without a company link, we store your answers and result without a name to improve the tasks and score bands. If you take it via a company’s link or invitation, we also store your name and, if given, your staff number, and show the result to the company that created the group. That company is then the controller; Langula processes the data on its behalf (Art. 28 GDPR). For email invitations we store the address the company entered. All test data is deleted automatically after 12 months; the company can delete it earlier at any time.

4. Cloudflare (CDN and security)

To deliver, accelerate and protect the site against attacks we use Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA), which processes your IP address among other data. Cloudflare is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). The legal basis is Art. 6 (1) (f) GDPR.

5. SSL/TLS encryption

For security reasons this site uses SSL/TLS encryption (https). Transmitted data cannot be read by third parties.

6. Cookies and consent management

We use technically necessary cookies or local storage (e.g. for sign-in and security), which may be set without consent (§ 25 (2) TDDDG, Art. 6 (1) (f) GDPR).

For everything else we use the consent management platform consentmanager (consentmanager AB, Torsgatan 26, 113 21 Stockholm, Sweden). It works according to the Transparency & Consent Framework (TCF) of IAB Europe. On your first visit you see a message in which you can accept, reject or individually select the purposes and partners (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR). For this, consentmanager processes technical data such as IP address, browser and time. Your choice is stored in your browser and passed on to the partners as a so-called TC string so that they respect it. You can change or withdraw it at any time via the "Cookies" link in the footer. The legal basis for the consent management itself is our obligation to be able to demonstrate consent (Art. 6 (1) (c) in conjunction with Art. 7 (1) GDPR). More information: consentmanager privacy policy.

7. User account and registration

If you create an account, we process the data you provide: your name (freely chosen), your email address and your password (stored only as a hash). The account stores your learning progress on our server so you can use it on several devices. The legal basis is the performance of the usage relationship (Art. 6 (1) (b) GDPR). We keep this data until you delete your account, which you can do at any time in the settings together with all associated data.

8. Sign-in with Google or Apple

Alternatively you can sign in with your Google or Apple account. Data is then transmitted to Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) or Apple Distribution International Ltd. (Hollyhill Industrial Estate, Cork, Ireland); from there we receive your email address and name to create the account. The legal basis is Art. 6 (1) (b) GDPR (registration) and (a) GDPR (your consent at the provider).

9. Email (e.g. password reset)

For necessary account emails (such as resetting your password) we send messages via an email server, processing your email address. The legal basis is Art. 6 (1) (b) GDPR.

10. Learning progress in the browser

Your learning progress is stored in your browser's local storage so you can keep learning even without an account. This data stays on your device and — if you are signed in — is additionally synced with your account. The storage is functionally necessary.

11. Pronunciation practice (microphone)

For pronunciation practice Langula uses your browser's built-in speech recognition (Web Speech API). Your speech is only evaluated after you actively grant microphone access in the browser. We ourselves neither receive, store nor transmit any audio; the comparison with the target word happens in your browser. The speech recognition itself is done by the browser vendor: in Google Chrome and Microsoft Edge your speech is sent to and processed on servers of Google or Microsoft, and other browsers (for example Safari by Apple) may do the same. We have no influence on this; the browser vendor's privacy policy applies. If you do not grant microphone access, you simply cannot use this feature.

12. Tracking, analytics and advertising

Langula is financed through advertising. The ad spaces on our website are marketed by symplr (mso digital GmbH & Co. KG, Große Str. 17–19, 49074 Osnabrück, Germany). For this, symplr embeds a script that fills the spaces via Google Ad Manager (Google Ireland Limited) and other advertising partners; this includes a bar at the bottom of the screen, full-page interstitial ads and video ads. Device and usage data such as IP address, browser, screen size and the page visited are processed, and cookies and similar technologies may be used, for example a pseudonymous identifier that limits how often you see the same ad (Publisher Provided Identifier). Data may be transferred to third countries such as the USA; Google is certified under the EU-US Data Privacy Framework. More information: symplr privacy policy.

To measure how our pages are used, we use Google Analytics 4 (Google Ireland Limited).

With your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG) symplr, Google and the advertising partners listed in the message may show personalised ads and measure their success. Google Analytics is only loaded after your consent. Without consent only ads are shown that use no cookies or identifiers for personalisation. Where partners process data on the basis of legitimate interest, for example to prevent fraud, you can object to this in the message. The complete list of partners and their purposes is available via "Cookies" in the footer. You can withdraw your consent at any time with effect for the future.

Partner advertising (affiliate)

In empty ad slots we show banners from partner programmes and our own notices. These banners are served from our own server; merely viewing them does not connect you to the partner. Some offers are only shown to visitors from certain countries; for this we use the country that our CDN Cloudflare derives from the IP address. It is not stored.

If you click a banner, the link first goes through our address /go/, where we count the click anonymously (day, creative, ad slot and language, without cookies and without IP address; Art. 6 (1) (f) GDPR, our interest being the billing and evaluation of our ad slots). You are then forwarded to the partner network and on to the provider. From this deliberate click they process their own data such as IP address, time and click ID and may set cookies to attribute a later order to our website (commission billing).

13. Fonts

We embed fonts exclusively locally from our own server. There is no connection to third-party servers (such as Google Fonts).

14. Contacting us

If you contact us by email or through the contact form, we process your details to handle the request. To protect the form against abuse we log, for each submission, the time, a non-reversible hash of your IP address, the browser type and your email address; we do not store the IP address itself. The legal basis is Art. 6 (1) (f) or (b) GDPR. The data is deleted once it is no longer required.

Reporting a mistake in the course. In the learning area you can report a word or sentence as wrong. We store the entry, the reason, your optional note and your interface language — without your IP address. If you are signed in, we link the report to your account so we can let you know once the mistake has been corrected: as a message in the learning area and, if you have turned on reminders in the app, as a push notification. We delete this link once the report is closed; the message stays visible in your account until you delete it. If you report without an account, the report remains anonymous. The legal basis is Art. 6 (1) (b) GDPR (use of your account) or (f) (improving the course content).

15. Your rights

You have the right at any time to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). You can withdraw consent once given with effect for the future (Art. 7 (3) GDPR). To do so, contact info@langula.app.

16. Right to complain

You have the right to lodge a complaint with a supervisory authority, in particular the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Straße 22, 20459 Hamburg.

17. Using the mobile app (iOS/Android)

In addition to the website we offer a mobile app. The same principles as above apply; we additionally process the following:

Purchases and subscriptions (Apple / Google)

Purchases and subscriptions (e.g. the supporter subscription) are handled by Apple or Google as payment providers via the App Store or Google Play. From Apple/Google we only receive the status of your purchase (active/expired, expiry date, purchase identifier) — not your payment details. We use this to unlock your supporter benefits on your account. We store the purchase identifier with your account so that a purchase grants the benefits to one account only and cannot be reused. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR). If you delete your account, the purchase record remains for our revenue reporting, without any link to your account data.

Advertising (Google AdMob)

The free app is ad-funded and uses Google AdMob. To serve ads — in particular personalised ads — Google may process an advertising identifier of your device (e.g. IDFA on iOS, Advertising ID on Android) as well as technical device and usage data. On iOS we ask for your permission beforehand via Apple’s App Tracking Transparency (ATT); without your consent only non-personalised ads are shown. You can withdraw your consent at any time in your device settings or the app menu. Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Legal basis: consent (Art. 6(1)(a) GDPR, § 25 TDDDG). More: policies.google.com/privacy.

Push notifications

If you enable learning reminders we process a device/push-specific token (via Apple APNs or the Expo push service) to send you notifications. You can turn notifications off at any time in your device settings or in the app. Legal basis: consent (Art. 6(1)(a) GDPR).

Signing in within the app

Signing in by email, Apple or Google works as on the website and is linked to the same account (matched via the verified email address). Section 8 applies.

Pronunciation audio

Pronunciation is played back on your device (operating-system speech synthesis or pre-generated audio files); no input or content is transmitted to us.

Pronunciation practice (microphone)

For pronunciation practice in the app we use the operating system’s speech recognition (Apple or Google). Once you have granted access to the microphone and to speech recognition, your speech is transmitted to Apple or Google for recognition and processed there; depending on device and language, recognition may also take place offline on the device. We receive no audio, do not store it and do not transmit it to our servers — only the recognised text is evaluated, on your device. You can withdraw the permission at any time in your device settings; without it the feature simply cannot be used.

18. Purchases on the website (Stripe)

If you become a supporter on the website, the payment is processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”). For this we share your email address, your name (if provided) and an internal account ID with Stripe. You enter your payment details (e.g. card number) directly with Stripe; we do not receive them. From Stripe we receive the status of your subscription (active, cancelled, expiry date), the amounts paid and the country of your billing address or card, which we need for VAT purposes. Stripe also processes data for fraud prevention and may transfer it to the USA; Stripe is certified under the EU-US Data Privacy Framework. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and statutory retention obligations (Art. 6(1)(c) GDPR in conjunction with § 147 AO, § 257 HGB). We keep payment records for up to ten years, also after your account is deleted. If you buy without an existing account, we create an account with your email address (steps prior to a contract, Art. 6(1)(b) GDPR) and delete it after 24 hours if the purchase is not completed. For purchases from countries outside the EU, Stripe acts as the seller in its own right; Stripe’s privacy policy (stripe.com/privacy) then applies in addition.

19. Changes to this policy

We adapt this privacy policy whenever the data processing or the legal situation changes. The version available when you access the site applies.