Privacy Policy

1. Controller

The controller for the processing of personal data on this website and in the Vocado application is:

For any question about data protection and to exercise your rights, reach us at the email address above.

No data protection officer has been appointed; the legal conditions requiring one are not met.

2. Principle

We process as little personal data as possible. We use no analytics or tracking tools, we build no user profiles for advertising, and we pass no data to third parties for advertising.

3. Hosting

This website and the application run at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in the European Union.

Hetzner processes the data solely on our behalf and on our instructions. We have concluded a data processing agreement with Hetzner pursuant to Art. 28 GDPR.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is the secure and reliable operation of our service.

4. Server log files

When you open our pages, information your browser transmits is recorded automatically. This is:

• IP address
• date and time of access
• the address requested and the amount of data transferred
• HTTP status code
• referrer URL
• browser type and operating system

This data is technically necessary to deliver the page and serves operational security and error analysis. It is not combined with other data sources.

The legal basis is Art. 6 (1) (f) GDPR. The log files are capped in size and continuously overwritten; as a rule they are fully displaced after a few days. There is no permanent storage.

5. User account

An account is required to use the learning application. For it we process:

• your email address
• your password, exclusively as a cryptographic hash; we never know the password in plain text
• a display name, if you choose to give one
• your time zone as reported by your browser, so that day boundaries and reminders match your local time

The legal basis is Art. 6 (1) (b) GDPR. The processing is necessary to perform the contract of use.

6. Learning data

So that the application can serve its purpose, we store against your account:

• the target language you chose and your native language
• which decks or books you have activated
• for each card, its learning state and the date it is next due
• your streak and the timestamps of your study sessions

This data is the basis of the spaced repetition algorithm and of the progress shown to you. Without it the application cannot be used.

The legal basis is Art. 6 (1) (b) GDPR.

7. Push notifications

You can have yourself reminded of your daily session. These reminders are voluntary and off by default. If you turn them on, we store against your account:

• the push address (endpoint) your browser issues for this device
• the two keys used to encrypt the message for this device
• a short device label such as “Chrome on macOS”, so several devices can be told apart

For technical reasons delivery runs through the push service of your browser vendor (for example Google, Mozilla, Microsoft or Apple). That server receives your device’s push address; the content of the message is encrypted from it. Depending on the vendor, this server may be located outside the European Union.

The legal basis is your consent under Art. 6 (1) (a) GDPR, given when you grant the permission in your browser. You may withdraw it at any time by turning reminders off in your profile or revoking the permission in your browser. We then delete the associated data; the withdrawal does not affect processing carried out beforehand.

8. Cookies and local storage

We use a single cookie:

The cookie is technically necessary to keep you signed in. Consent is not required for it under § 25 (2) no. 2 TDDDG. We use no cookies for analytics, marketing or tracking.

If you install the application on your device (Progressive Web App), your browser stores program files locally so the application loads faster. This data stays on your device and is not transmitted to us. You can delete it at any time in your browser settings.

9. Fonts

The fonts we use are served from our own server. No connection to third-party servers is established, in particular not to Google Fonts.

10. Payments

Payments are currently handled outside this website. No payment or bank details are collected or processed through this website.

11. Retention

We store your account and learning data for as long as your account exists. After an account is deleted, the associated data is removed, unless statutory retention obligations require otherwise.

12. Recipients

Apart from the hosting provider named in section 3 and — if you have turned reminders on — the push service of your browser vendor named in section 7, we pass your data to no third party. Beyond that, no transfer to countries outside the European Union takes place.

13. Your rights

You have the right at any time to:

• access the data stored about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure of your data (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability in a common format (Art. 20 GDPR)
• object to processing based on legitimate interests (Art. 21 GDPR)

An informal email to info@vocado.org is enough to exercise them. Deletion of your account is arranged the same way.

Independently of this, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (ldi.nrw.de).

14. Minimum age

Our service is aimed at people aged 16 and over. We do not knowingly collect data from children and young people under 16. Should such data come to our attention, we delete it.

15. Changes

We update this privacy policy when the processing described here changes. The version published on this page is the one that applies.