Privacy Policy

1. What information do we collect?

Personal information you disclose to us

We collect personal information that you voluntarily provide to us when you register, when you use the app to learn a language, when you buy a subscription, or when you contact us.

Account information. Your email address. If you register with an email address and a password, the password is set and stored by Google Firebase Authentication — we never see it. If you sign in with Google or Apple, we receive your email address from that provider (Apple lets you hide it behind a private relay address).

Learning content you create. This is the bulk of what we store, and it is stored under your account so you can pick up where you left off:

• the messages you write to your AI chat partners, and the replies they give
• audio recorded from your microphone during speaking practice, and its transcript
• the words you look up and save, your own vocabulary lists and notes
• the articles you open, your reading position, your exercise answers and results
• your progress statistics (words written, minutes practised, streaks)
• your settings: target language, interface language, level, voice and text preferences
• a learning profile derived from the above, which we use to tailor exercises and feedback to you — see section 3

Bug reports. If you send a bug report from inside the app, we receive your description, your email address, the app version, your device platform, your language settings and a recent excerpt of the app's own diagnostic log.

Purchases. We never receive your card or bank details. Subscriptions are sold and charged by Apple or Google in the apps and by Paddle on our website; we receive your subscription status through RevenueCat, which identifies your account by your email address.

The app asks for access to your microphone (for speaking practice) and may ask for permission to send notifications. You can change both in your device settings at any time.

Information automatically collected

We automatically collect certain information when you use the services. This information does not by itself reveal your identity, but may include device and usage information, such as your IP address, device characteristics, operating system, language preferences, country (derived from your IP address), information about how and when you use our services, and other technical information.

If the app crashes or hits an error, Google Firebase Crashlytics collects a diagnostic report: the error, a stack trace, device and app version data, and a short trail of breadcrumbs describing what the app was doing. This information is primarily needed to maintain the security and operation of our services and to fix defects.

Our website

This subsection is about blablapal.com itself rather than the app. Our hosting provider, manitu GmbH (St. Wendel, Germany), processes the server log data that every request produces (IP address, time, page requested, referring page, browser and operating system) in order to deliver the site and keep it secure.

We measure reach with Umami, a cookieless analytics service. It records which page was visited, the referring site, an approximate country, and the type of device and browser. According to the provider, IP addresses are not stored but converted into an anonymous daily hash. No cookies are set, and visitors are not tracked across sites or devices. The legal basis is our legitimate interest in understanding which pages are used (Art. 6(1)(f) GDPR).

Access to your device (§ 25 TDDDG). The pages of blablapal.com themselves store nothing on your device: no cookies, no local storage. Our web app page remembers whether you chose the light or the dark theme, and the app — in the browser as on your phone — keeps your login session, your settings and a local cache of your learning content on your device so that it works quickly and stays signed in. All of that is strictly necessary to provide the service you asked for and is therefore permitted under § 25(2) No. 2 TDDDG without your consent. We store nothing on your device for advertising or for tracking you across sites.

Fonts are served from our own server, and the browser version of BlablaPal embedded on our web app page loads its program libraries from our server too, so no third party receives your IP address for them. Only when text contains characters that none of the app's own fonts cover does the browser fetch a substitute font from Google (fonts.gstatic.com). Everything this notice says about the app applies to the browser version as well.

2. How do we process your information?

We process your information for the following purposes:

• To facilitate account creation, authentication, and account management
• To deliver the services: to generate chats, articles, exercises and translations for you, to read text aloud, and to transcribe what you say in speaking practice
• To save your learning progress across your devices and to show you your statistics
• To tailor the content you are offered to your language, level and learning history
• To manage your subscription and the limits of the free tier
• To respond to user inquiries, handle bug reports, and offer support
• To send administrative information to you about our products, services, and policy changes
• To keep the services secure, prevent abuse of our AI features, and protect against fraud
• To comply with our legal obligations

We do not sell your personal information, we do not use your learning content for advertising, and we do not use it to train AI models — neither our own nor those of the AI providers we commission (see section 3, which also explains the one exception, the speech recognition built into your device).

3. AI-generated content and automated processing

BlablaPal is built on AI. Nearly everything you read, hear and practise in the app is generated by AI services, and to generate it, what you type or say has to be sent to those services.

What is generated by AI: the articles and their exercises, the replies of every chat partner and of the tutor, your personalised exercises and corrections, the translations, and the spoken voices. The people you chat with are not real people.

What we send, and to whom: only the content needed to answer the request — for example your chat message and the recent conversation, the sentence you want translated, the word you looked up, the text to be read aloud, or the audio recorded during speaking practice — together with context such as your target language and level. We do not send your email address or your account identifier to these AI providers. The providers are listed in section 5; they process this content on our behalf as processors under our instructions.

Your learning profile. We derive a profile of your learning from your activity in the app — recurring mistakes, topics you practise, your level — and use it to choose what to offer you next. This is profiling within the meaning of Art. 4(4) GDPR. It only shapes the learning content you are offered; we do not take any decision about you that produces legal effects or similarly significantly affects you by automated means (Art. 22 GDPR). You can object to it at any time (see section 10); deleting your account deletes the profile.

No training on your content. Your inputs are sent to the AI providers only to generate the answer you asked for. We have contractually excluded, with every AI provider we commission — Google, Mistral AI, Anthropic, Cartesia, ElevenLabs and DeepL, all listed in section 5 — that your content is used to train, fine-tune or otherwise improve their models, and we do not train models on it ourselves. What we do evaluate is anonymous, aggregated usage data — how often a feature is opened, how long a session lasts — which contains no content and does not identify you.

One exception, which we would rather state openly. Where speaking practice uses the speech recognition built into your device's operating system, that processing follows Apple's own terms and not an agreement we could negotiate. We therefore cannot rule out that Apple uses this audio to improve its own speech recognition. Where the recognition runs on your device, the recording never leaves it and the question does not arise. On Android and on the web, transcription runs at Google Cloud Speech-to-Text and is covered by the exclusion above.

If you tell an AI chat partner something sensitive. We never ask for special categories of data under Art. 9 GDPR, and no feature is designed to collect them. But a free conversation is a free conversation: you may mention an illness, a religion or a political opinion on your own initiative. Such a statement is stored as part of that chat and is sent to the AI provider in order to generate the reply, exactly like any other message. We do not evaluate it, do not add it to your learning profile beyond the language patterns it contains, and do not pass it on to anyone else. You can delete the chat in the app at any time, which removes it from our systems. If you would rather not have this happen, do not enter such details in the first place.

AI output can be wrong. Wherever we can, we have generated content checked by further AI models before it reaches you, but mistakes still get through. Do not rely on AI-generated content for anything beyond language practice — see section 2 of our Terms of Service.

4. What legal bases do we rely on to process your information?

We only process your personal information when we have a valid legal reason to do so under applicable law.

For EU/UK users:

• Performance of a contract (Art. 6(1)(b) GDPR) for everything needed to run the service you signed up for: your account, your learning content, generating and voicing that content, saving your progress, and managing your subscription.
• Consent (Art. 6(1)(a) GDPR) for access to your microphone and for push notifications, which you grant on your device and can withdraw there at any time.
• Legitimate interests (Art. 6(1)(f) GDPR) for keeping the service secure and free of abuse, diagnosing crashes and defects, and improving the app.
• Legal obligations (Art. 6(1)(c) GDPR) where we must retain or disclose information by law.

For Canadian users: Processing occurs with express or implied consent, with exceptions for fraud prevention, business transactions, and legal compliance requirements.

5. When and with whom do we share your personal information?

We share information with the service providers below, each for the purpose stated. Unless stated otherwise, they act as processors on our behalf and we have data processing agreements in place with them. Apple, Google Play and Paddle are the exception: as sellers of record for purchases, and Apple also for the speech recognition built into iOS, they act as independent controllers under their own privacy policies rather than on our instructions.

• Google (Firebase): Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, App Check and Crashlytics. Your account and all of your learning content are stored here, and every AI request in the app passes through our Cloud Functions.
• Google (Gemini API): generates chats, articles, exercises, corrections and word analyses. Receives the content of the request.
• Google (Cloud Speech-to-Text): transcribes speaking practice on Android and on the web. Receives the audio recorded from your microphone.
• Apple: on iOS, speaking practice uses the operating system's own speech recognition. Depending on your device and your iOS version, the recording is either processed entirely on your device or transmitted to Apple for processing. Apple also acts as seller of record for in-app purchases made on iOS.
• Google Play: seller of record for in-app purchases made on Android.
• Paddle (United Kingdom): seller of record (Merchant of Record) for subscriptions bought on our website. To process your order, Paddle collects your email address, your payment details, your billing country and address, and technical data such as your IP address for tax and fraud checks, as described in its privacy policy. Your email address is passed along with the checkout so that the purchase can be assigned to your account.
• Google (Cloud Text-to-Speech), Cartesia (USA) and ElevenLabs (USA): generate the spoken voices. Receive the text to be read aloud, which can include text you wrote yourself.
• Mistral AI (France) and Anthropic (USA): alternative language models that remain available as a fallback for individual features. They receive the same kind of request content as the Gemini API.
• DeepL SE (Germany): translates words and sentences. Receives the text you asked to have translated.
• Umami Software, Inc. (USA): cookieless reach measurement for our website, as described in section 1.
• RevenueCat (USA): manages subscriptions and entitlements. Receives your email address as your user identifier, together with your purchase and subscription status from Apple, Google or Paddle.

We may also disclose information where we are legally required to do so, or in connection with a merger, sale or other business transfer, in which case we will notify you.

6. Is your information transferred internationally?

Yes. Our servers and Cloud Functions run in Google Cloud's us-central1 region in the United States, and several of the providers listed above (Anthropic, Cartesia, ElevenLabs, RevenueCat, Umami, and parts of Google's and Apple's infrastructure) process data in the United States or in other countries outside the European Economic Area. Paddle is based in the United Kingdom, for which the European Commission has adopted an adequacy decision.

For those transfers we rely on the European Commission's Standard Contractual Clauses and, where the provider is certified under it, the EU–US Data Privacy Framework, together with the additional safeguards agreed in our contracts with these providers. You can request a copy of the relevant safeguards from us at legal@blablapal.com.

7. How do we handle third-party sign-in?

You can create an account with an email address and password, or sign in with Google or Apple. We do not offer sign-in through any other network.

When you sign in with Google or Apple, we receive your email address and basic profile information from that provider, and use it only to create and identify your account. Sign in with Apple lets you hide your address behind a private relay address, which works with BlablaPal. We do not receive contact lists, friends or posts. We do not control how your sign-in provider processes your data — please review their privacy policies.

8. How long do we keep your information?

We keep your account and your learning content for as long as your account exists, because that content is the service: your chats, vocabulary and progress are there for you to come back to. You can delete individual chats and vocabulary items in the app at any time.

When you delete your account, we delete your account data and your learning content from our systems. Residual copies may remain in encrypted backups for a limited period before they expire. Crash diagnostics collected by Crashlytics are retained according to Google's retention period for that service and are not linked to your learning content. Bug reports are kept until the problem is resolved and no longer needed for support purposes. We may retain information for longer where the law requires it.

9. Do we collect information from minors?

The services are intended for users aged 16 and older, and we do not knowingly solicit data from or market to children under 16. By using the services, you represent that you are at least 16 years old. We do not ask for your date of birth and therefore cannot verify your age. If we become aware that an account belongs to a child under 16, we will deactivate it and take reasonable measures to delete the data belonging to it without undue delay. If you believe a child under 16 has given us personal data, write to legal@blablapal.com.

10. What are your privacy rights?

In some regions (such as the European Economic Area, United Kingdom, Switzerland, and Canada), you have rights that allow you greater access to and control over your personal information, including:

• The right to request access to and obtain a copy of your personal information
• The right to request rectification or erasure
• The right to restrict the processing of your personal information
• If applicable, the right to data portability
• The right to object to processing based on our legitimate interests, including the profiling described in section 3

You may withdraw your consent at any time. To make a request, contact us at legal@blablapal.com. We may retain some information in our files to prevent fraud, troubleshoot problems, assist with investigations, enforce our legal terms, and/or comply with applicable legal requirements.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Wiesbaden, Germany; EEA and UK residents may instead contact their own local data protection authority.

11. Controls for Do-Not-Track features

Most web browsers and some mobile operating systems and applications include a Do-Not-Track ('DNT') feature or setting you can activate to signal your privacy preference. No uniform technology standard for recognising and implementing DNT signals has been finalised. As such, we do not currently respond to DNT browser signals. If a standard for online tracking is adopted that we must follow, we will update this notice accordingly.

12. Do United States residents have specific privacy rights?

If you are a resident of California, you are granted specific rights regarding access to your personal information under the California Consumer Privacy Act (CCPA).

In the past 12 months we have collected the following categories of personal information:

• Category A (Identifiers): email address, IP address, device identifiers. Collected: Yes
• Category D (Commercial information): your subscription and purchase history. Collected: Yes
• Category F (Internet or network activity): how you use the app. Collected: Yes
• Category G (Geolocation data): approximate location derived from your IP address. Collected: Yes
• Category H (Audio, electronic, visual information): audio recorded during speaking practice. Collected: Yes
• Category K (Inferences): the learning profile described in section 3. Collected: Yes
• All other standard CCPA categories: Not collected

We do not sell or share personal information as those terms are defined by the CCPA. Your rights under CCPA include: the right to request deletion of your data, the right to know what data we have collected, the right against discrimination for exercising your privacy rights, and the right to opt out of any future selling or sharing of your data.

To exercise your rights, contact us at legal@blablapal.com.

13. Do we make updates to this notice?

Yes, we will update this notice as necessary to stay compliant with relevant laws. When we make material changes, we will notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this privacy notice frequently to stay informed.

14. How can you contact us about this notice?

If you have questions or comments about this notice, you may contact us at:

Blabytes UG (haftungsbeschränkt)
Königsberger Straße 18
65830 Kriftel, Germany
Phone: +49 1579 2516027
Email: legal@blablapal.com

15. How can you review, update, or delete the data we collect from you?

You can review and change most of your information directly in the app, and you can delete your account and the data belonging to it under Account → Delete account. If you no longer have the app installed, you can request deletion on our account deletion page or by writing to legal@blablapal.com. Depending on the applicable laws of your country, you may also have the right to request access to the personal information we hold about you, or to have it corrected.