Privacy Policy

1. Controller

Responsible for data processing is:

Toba UG (haftungsbeschränkt)
St. Johannerstr. 41-43
66111 Saarbrücken
Germany

Email: support@toba.solutions
Managing Director: Antonio Sanchez

A data protection officer has not been appointed pursuant to Art. 37 GDPR because there is no legal obligation to do so.

2. General information

This privacy policy explains how we process personal data when you use the French: Practice app and related web app. French: Practice is a French learning and practice app with vocabulary review, grammar exercises, progress tracking, and optional mobile subscriptions.

The app is not directed at children under 16 years of age. We do not knowingly process personal data of children.

3. Legal bases

We process personal data on the following legal bases: Art. 6(1)(b) GDPR for providing the app, accounts, synchronization, learning progress, and subscription functionality; Art. 6(1)(f) GDPR for secure and stable operation, abuse prevention, support, and infrastructure reliability; and Art. 6(1)(c) GDPR where legal retention or compliance obligations apply.

4. Web hosting and backend

The web version of French: Practice is hosted via Cloudflare Pages. Cloudflare may process technical access data such as IP addresses, request metadata, browser and device information, timestamps, security events, and log data to deliver and protect the website.

Provider for web hosting, DNS, CDN, and security services: Cloudflare, Inc., USA. Privacy information: https://www.cloudflare.com/privacypolicy/. Cloudflare DPA information: https://www.cloudflare.com/cloudflare-customer-dpa/.

French: Practice uses Supabase for backend hosting, database, authentication, and server-side functions. Supabase provides hosted PostgreSQL, authentication, APIs, and edge functions. We use Supabase instead of Firebase for this app.

During use, technical data may be processed by Supabase, including IP address, request metadata, device/browser information, timestamps, authentication/session data, and the data stored for your account and learning progress.

The production Supabase project should be configured in an EU region where available. Support, security, and operational access by Supabase or its subprocessors from third countries, especially the USA, cannot be fully excluded. Transfers are based on appropriate safeguards such as data processing agreements, Standard Contractual Clauses, and, where applicable, adequacy decisions or certification under the EU-US Data Privacy Framework.

Provider: Supabase, Inc. Privacy information: https://supabase.com/privacy. Supabase DPA information: https://supabase.com/legal/dpa.

5. Authentication and accounts

The app starts with an anonymous account so you can use it without an immediate sign-up wall. You may later add an email address and password, or connect Google or Apple sign-in, to secure your account and sync progress across devices.

If you use Google or Apple sign-in, the respective provider may process authentication data such as your provider account identifier, email address, name or profile information made available by the provider, IP address, device/browser information, and sign-in timestamps. Supabase receives the authentication result and links it to your Supabase user ID.

• Supabase user ID and anonymous session ID
• Email address if you add one
• Google or Apple identity information if you connect one of those providers
• Authentication timestamps and session tokens
• Password hash handled by Supabase Auth; we never store your password in plain text

6. Learning and profile data

To provide the app functionality, we store learning and preference data associated with your Supabase user ID.

• Native language, target level, daily goal, and practice mode
• Vocabulary review cards, repetition state, due dates, ease, interval, and review counts
• Grammar topic progress, exercise attempts, correctness, and accuracy
• Entitlement status such as free or premium

7. Local storage and device technologies

The app uses local device storage and, on the web, browser storage for strictly necessary purposes such as keeping your session active, caching content for offline or faster access, and storing app preferences. We do not use advertising or tracking cookies in this app.

Legal basis: Art. 6(1)(b) GDPR and § 25(2) No. 2 TDDDG, because these technologies are necessary to provide the service you request.

8. Payments and subscriptions

Mobile subscriptions are processed through the Apple App Store or Google Play Store. Financial transactions are processed by the respective store provider. We do not store credit card or bank details.

For the technical management of subscriptions and entitlements, we use RevenueCat. RevenueCat may process a pseudonymous app user ID, purchase status, product identifiers, receipt or purchase token information, device/technical information, and subscription events. The app uses the Supabase user ID as the RevenueCat app user ID so that premium status can be synchronized.

Provider: RevenueCat, Inc., USA. Privacy information: https://www.revenuecat.com/privacy. DPA information: https://www.revenuecat.com/dpa. Legal basis: Art. 6(1)(b) GDPR.

9. Web version, analytics, and error reporting

The web version of French: Practice does not provide in-app purchases. It uses the same free daily practice limit, premium entitlement, and Supabase backend for authentication, content loading, and progress sync as the mobile apps.

For stability and quality, the app and its web version use Sentry for crash and error reporting. We have turned off Sentry's default collection of personal data (the sendDefaultPii option is disabled), so IP addresses and request contents are not transmitted; only your Supabase user ID is attached to error events so that issues can be diagnosed and fixed. Sentry is not used for advertising or behavioural analytics. Provider: Functional Software, Inc. (Sentry), USA; event data is ingested in the EU (Frankfurt region). Privacy information: https://sentry.io/privacy/. DPA information: https://sentry.io/legal/dpa/. Legal basis: Art. 6(1)(f) GDPR for secure, stable, and error-free operation.

For product analytics we use Aptabase, a privacy-focused, EU-hosted analytics service. Aptabase does not use cookies or other persistent device storage for tracking, and collects only anonymous, aggregated data: device type and operating system, app version, and anonymous usage events. No personal data such as your email address, IP address, Supabase user ID, or learning content is collected or transmitted, and the data is not used for advertising or cross-site tracking. Provider: Aptabase; data is hosted in the European Union. Privacy information: https://aptabase.com/legal/privacy. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in understanding usage anonymously to improve the app's stability and features. You can object to this processing at any time by contacting support@toba.solutions.

Our public website at practice-french.com — the marketing, grammar, story, and reference pages, which are separate from the app itself — uses Simple Analytics to measure visits. Simple Analytics is a privacy-first, EU-hosted web analytics service: it sets no cookies, uses no local storage and no device fingerprinting, and does not collect or store IP addresses; a visitor's country is derived from the browser's time zone rather than from an IP address. It records only aggregated, non-personal data: the page path (without query strings), the referring domain, UTM campaign parameters, anonymised browser and operating-system information, screen and viewport size, device language, time on page, and scroll depth. Because no personal data is collected and nothing is stored on your device, this requires neither a cookie banner nor consent. Provider: Simple Analytics, Hooftlaan 4, 1401 ED Bussum, Netherlands (Chamber of Commerce no. 60978856); the servers are located in the Netherlands and the data is not processed outside the EU. Privacy information: https://www.simpleanalytics.com/privacy-policy. DPA information: https://www.simpleanalytics.com/data-processing-agreement. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in understanding how our website is found and used. Simple Analytics runs on the website only; the app and its web version at app.practice-french.com do not load it.

For sending email we use Resend (Resend, Inc., USA). Resend delivers two kinds of message: service email relating to your account, and — only if you have asked for it — our monthly recap and product news. To send marketing email we pass Resend your email address and your subscription status; no learning content, progress data, or Supabase user ID is transmitted. Marketing email is sent only after you confirm your subscription by clicking a link we email you (double opt-in). Legal basis: Art. 6(1)(a) GDPR — your consent, which you may withdraw at any time in the app under "You", or via the unsubscribe link in any email, without affecting the lawfulness of processing carried out before withdrawal. Service email relating to your account rests on Art. 6(1)(b) GDPR. Deleting your account also deletes your address from our mailing list. Provider: Resend, Inc.; data is processed in the USA. Privacy information: https://resend.com/legal/privacy-policy. Transfer to the USA is safeguarded by the EU Standard Contractual Clauses, which are incorporated into our data processing agreement with Resend. Questions: support@toba.solutions.

Aside from Sentry (error reporting), Aptabase (anonymous in-app analytics), Simple Analytics (anonymous website analytics), and Resend (transactional and, with your consent, marketing email), the app and the website do not include advertising tracking, cross-site tracking, behavioural profiling, Tally, or Firebase.

10. Support and contact

If you contact us by email or another support channel, we process the information you provide, such as your email address, message content, and any technical details needed to respond. Legal basis: Art. 6(1)(b) GDPR for contract-related support and Art. 6(1)(f) GDPR for efficient handling of inquiries.

11. Artificial intelligence and content generation

We may use artificial intelligence tools during offline content creation, review, translation, or improvement of learning materials. The app does not send your personal learning activity or account data to AI providers during normal runtime use.

12. Retention and deletion

Account and learning progress data is stored for as long as your account exists or as long as it is needed to provide the app. Anonymous accounts may remain stored unless deleted or unless we perform cleanup of inactive accounts. Support messages are kept as long as necessary to handle the request and for reasonable documentation periods.

Statutory retention obligations, for example commercial or tax retention periods under German law, remain unaffected. You can request deletion of your account and associated data by contacting support@toba.solutions.

13. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection under Art. 15 to 21 GDPR. Where processing is based on consent, you may withdraw consent at any time with effect for the future.

To exercise your rights, contact support@toba.solutions. We may need information to verify your identity before fulfilling a request.

14. Data transfers to third countries

In connection with Cloudflare, Supabase, Sentry, RevenueCat, Apple, Google, and support or infrastructure providers, personal data may be transferred to third countries, especially the USA. Such transfers are based on adequacy decisions, Standard Contractual Clauses, data processing agreements, and/or certification under the EU-US Data Privacy Framework where applicable.

15. Automated decision-making

Automated decision-making including profiling within the meaning of Art. 22 GDPR does not take place.

16. Supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for us is:

Unabhängiges Datenschutzzentrum Saarland
Fritz-Dobisch-Straße 12
66111 Saarbrücken, Germany
Email: poststelle@datenschutz.saarland.de
Website: https://www.datenschutz.saarland.de

17. Updates

We may update this privacy policy when the app, infrastructure, legal requirements, or provider setup changes. For material changes, we will provide appropriate notice in the app or on the website where required.