Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Michael Konz
Im Dorfe 20
25492 Heist
Germany
Email: support@wordcollector.de

More details are in the legal notice. No data protection officer has been appointed because there is no requirement for one under Section 38 BDSG.

2. Principles

Vocabulary Collector is built so that as little data as possible leaves your device. The app keeps vocabulary, progress, sentences, stories and settings in a database on your device. This is necessary for the app to work (Section 25(2) no. 2 TDDDG). We run no user accounts with name, email address or password.

A server is only contacted when you do something that needs it. The following sections name each of these cases. Where we name legal bases they are Art. 6(1)(a) (consent), (b) (contract, here: the feature you want), (c) (legal obligation) and (f) GDPR (legitimate interest, here: operation, security and troubleshooting).

3. The app in detail

3.1 Data on your device

Vocabulary, translations, forms, examples, your progress (which box a word is in and when it is due again), generated and saved sentences, stories and your settings are stored locally. In addition there is a system log that records technical processes of the last 5 days (requests, counters, error codes). Vocabulary, stories and credentials are not recorded in it. You can view, copy and delete it. It only leaves your device when you upload diagnostic data.

With “Export” you create a file with your data and decide yourself where to pass it on.

3.2 iCloud sync

If iCloud sync is on (default, can be switched off in the settings), the app syncs your vocabulary, progress, sentences, stories and settings through Apple’s CloudKit with your other devices on which you are signed in with the same Apple account. The data is in the private area of your iCloud account. Apple processes it there under the terms of iCloud; we as the developer have no access to it. Excluded are dictionaries and packages, balance and purchases of the AI features and everything that belongs to the device (sound, read-aloud, microphone).

3.3 Downloading dictionaries, vocabulary packages and story packs

The files are on our servers (packs.wordcollector.de, api.wordcollector.de). When loading, the server processes the technically necessary connection data: IP address, time, requested file, status code, amount of data transferred and the app details. No account or device identifiers are transmitted. The data is kept in the server logs for 14 days (operation and security, Art. 6(1)(f) GDPR). The package lists and the list of story topics are loaded without any details about you.

3.4 Look-up: dictionary, online dictionary, translation suggestions

• With an installed dictionary the app looks words up on the device. The word does not leave the device.
• Without a dictionary the app asks the online dictionary, unless you switch that off in the settings. For this it sends the word you typed (with language and, if known, word class) to our server. No account or device identifiers are transmitted with the request. The server answers from the dictionary files and does not store the request beyond the server logs (14 days, see 3.3; the requested word is part of the requested address). The legal basis is Art. 6(1)(b) GDPR.
• Translation suggestions from Apple: The app can use Apple’s translation feature (switch in the settings). It works through the system; we receive no data from it.

3.5 Purchases and subscription

You buy Premium (subscription), story packs and credits through the App Store. Apple handles the payment and is responsible for it; we receive no payment data, no name and no address. Whether you have Premium is checked by the app on the device through StoreKit; you need no account with us for that.

For credits and story packs the app sends the transaction signed by Apple to our server. The server checks Apple’s signature, books the credits or unlocks the pack and stores: transaction identifier, product, environment (production or test), time, number of credits booked, a refund if any, and the raw data signed by Apple. If Apple refunds a purchase it notifies our server, which deducts the credits again (App Store Server Notifications). Legal basis: Art. 6(1)(b) GDPR; we keep the booking records because of legal retention duties (Art. 6(1)(c) GDPR).

3.6 AI features and credits

The AI features are optional: suggesting forms and translations of a word, generating practice sentences from your vocabulary and explaining sentences. Everything else in the app works without them. They are only available in the mode with grammar.

Sign-in without registration

On the first call the app fetches from Apple the signed “app transaction” of your Apple account for this app and sends it to our server. It contains an identifier assigned by Apple (the app transaction ID) that stays the same for your Apple account and this app, also after a reinstall and on other devices. It contains neither your name nor your email address. Our server checks Apple’s signature, creates a technical record under this identifier (not a user account: no name, email address or password), assigns a random internal user identifier and issues a session token that the app sends with every call (only the hash is stored). That way your balance is kept after a reinstall, and the one-time starter balance is not granted several times.

What is sent and stored

• Word forms and translation suggestions: the word, its language and word class, for translations the language pair and details about the word. The server stores results as a cache so that a repeated call costs nothing; for each call the usage (credits, tokens, time) is recorded with your internal user identifier.
• Generating practice sentences: words from your vocabulary with their translations. The server stores the request and the generated sentences.
• Sentence analysis for a sentence from a story: the sentence you have explained. The server stores neither it nor the explanation; it stays on your device. For sentences that the server generated itself, it may cache the explanation so that it does not cost credits again.
• Reports: If you report a mistake in a generated sentence or a form in the app, the sentence or form concerned and your optional comment are stored with your internal user identifier so that we can improve the data.

Permission: Before the app sends words or sentences for the first time it asks for your permission (Art. 6(1)(a) GDPR). There are two switches under Settings › AI features: “Send vocabulary to generate sentences” and “Send sentences for analysis”. You can switch them off at any time; this does not affect the lawfulness of the processing so far. Do not send sentences with personal data.

OpenAI: To process the requests our server forwards them to the interface of OpenAI. According to OpenAI, data sent through the interface is not used to train the models and is kept for up to 30 days to detect abuse (OpenAI’s statements). We send OpenAI neither your internal user identifier nor the Apple identifier.

Deleting your data of the AI features: Under Settings › AI features › “Delete my AI features data” you delete what we have stored about you there: the link to your Apple account (identifier and sessions), the balance and the stored requests, generated sentences and reports. The balance is lost and cannot be restored. Premium and story packs you bought stay with your Apple account and can be restored at any time with “Restore purchases”. The booking records of purchases are kept for bookkeeping reasons (see 3.5 and 7). If the app calls the AI features again afterwards, the server creates a new, empty record; to make sure no second starter balance is granted, it remembers a hash of the Apple identifier (formed with a secret key, no plain text).

3.7 Stories with AI programs of your choice

New stories are written by an AI program of your choice (for example ChatGPT, Claude or Gemini). The app does not ask that program itself: it creates a text (“prompt”) that you copy and paste into the program, and afterwards checks the answer that you paste back. A text of your own that you have translated stays on your device until you paste it into the AI program; only then does its provider receive it, and its privacy policy applies. The list of topics for stories comes from our server; nothing about you is sent with the request. Bought story packs are loaded by the app from our server (see 3.3 and 3.5).

3.8 Contact and feedback

Through Settings › Administration › “Contact and feedback” you write to us directly from the app. Name, email address and message are required; the subject and up to five images are optional. When sending, the following details are sent too, which you see in the form: device model (for example “iPhone17,1”), iOS version, app version with build, whether dark mode is on, and the language; plus a random device identifier that lets us match your messages and diagnostic data. Vocabulary, stories and settings are not sent. The app remembers name and email address only on your device so that you do not have to type them again.

The message goes to our support system (SupportTracker, support.mdksoft.de). We use it to answer your request (Art. 6(1)(b) and (f) GDPR). We send the answer by email. Before attaching images, check that they show nothing we should not see.

3.9 Uploading diagnostic data

If something does not work you can send a copy of the log of the chosen period together with device and app settings to support under Settings › Administration › System log › “Upload”. This only happens when you trigger it. The email address is optional and only serves to assign the data to a support case. The legal basis is your consent by triggering it (Art. 6(1)(a) GDPR) and our interest in troubleshooting (point (f)).

3.10 Speech input, dictation and read-aloud

For speech input in practice the app asks for access to the microphone and speech recognition. Apple does the recognition: depending on device and language it runs on the device or on Apple’s servers; the speech data is then sent to Apple and, according to Apple, also used to improve speech recognition. We do not receive the recordings, only the text the system hands to the app, and it stays on the device. You can withdraw the accesses at any time in the iOS settings. Read-aloud runs on the device.

3.11 Images in the contact form

If you want to send images to support, the app opens the system’s photo picker. The app only receives the images you select, not your whole library.

3.12 Share menu and notifications

A word you send to Vocabulary Collector from another app through the share menu is handed over on the device (through a shared app group) and is not sent anywhere. The app asks for permission for notifications at the first start; it currently sends you no notifications from our servers. For iCloud sync Apple uses its push service so that a device learns that something has changed. That runs between Apple and your device; we receive neither a push token nor any other data.

4. This website

The website is hosted at IONOS. When you visit it, the web server processes technically necessary data and stores it in log files: IP address, date and time, requested page, status code, amount of data transferred, referrer and browser identification (user agent). They serve the secure and stable operation and the defence against abuse (Art. 6(1)(f) GDPR) and are deleted after 14 days.

The website sets no cookies, uses no analytics or advertising services, embeds no content from third-party servers (fonts and images are on our server) and has no contact form. On the “Data packs” page your browser can fetch the current package list (index.json) from packs.wordcollector.de, another server of the same operator; the same log data arise as when you open a page. Links to other websites (for example Apple or Creative Commons) leave our pages; their privacy policies apply. If you write us an email, we process your details to answer it (Art. 6(1)(b) and (f) GDPR).

5. Recipients and service providers

We pass personal data on only to the following recipients, as far as necessary for the purposes described. We have contracts for processing on our behalf (Art. 28 GDPR) with service providers who process in our name.

6. Transfers to third countries

Some recipients are based in the USA or process data there (Apple, OpenAI). The transfer relies on the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the recipient is certified, and otherwise on standard contractual clauses under Art. 46(2)(c) GDPR. You receive a copy of the safeguards on request. With your consent to the AI features you also consent to the transfer involved (Art. 49(1)(a) GDPR) as far as it is not secured in another way.

7. Retention

We store data only as long as necessary for the respective purpose or as required by law.

8. Your rights

You have the following rights towards us as the controller:

• Access to the data stored about you (Art. 15 GDPR),
• Rectification of inaccurate data (Art. 16),
• Erasure (Art. 17) and restriction of processing (Art. 18),
• Data portability (Art. 20): you can export your vocabulary as a file in the app at any time,
• Objection to processing based on legitimate interests (Art. 21). You may object at any time on grounds relating to your particular situation,
• Withdrawal of a consent with effect for the future (Art. 7(3)), for example the permissions of the AI features in the settings of the app.

Because we usually do not know who you are (there is no user account with a name, and the records of the AI features contain no details about your person), we cannot simply assign them to you (Art. 11 GDPR). Where possible you can do a lot yourself: delete data in the app, switch off iCloud sync, take back permissions and delete your data of the AI features (identifier, sessions, balance and stored requests; see 3.6 and 7). For anything else write to us through Support & contact.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one where you live or the one responsible for us: Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel.

Providing your data is neither required by law nor by contract. Without certain details a feature cannot be used, though (for example support cannot answer without an email address). There is no automated decision-making including profiling under Art. 22 GDPR.

9. Children and teenagers

Vocabulary Collector is not aimed at children. Teenagers may use the app to learn languages. If you are under 16 you use the app with your parents’ consent, in particular for purchases and consents.

10. Security

All connections between the app, this website and our servers are encrypted with HTTPS (TLS). We store session tokens only as hashes. Purchase receipts are only accepted once Apple’s signature has been verified. The database is backed up daily. Still: no transmission path and no storage is completely safe.

11. Changes to this policy

We adapt this policy when the app, our services or the legal situation change. The version published here applies; it is at wordcollector.de/en/privacy/. The German original is at /datenschutz/; if they differ, the German version applies.

As of: 27 October 2026