Privacy Policy

This Privacy Policy (the "Policy") explains how personal data is processed when you use the onemoreword and Medical English mobile apps, the onemoreword browser extension, and the web pages available under the domain name "onemoreword.app" (collectively, the "Services").

1. Terms and Definitions

1.1. The following terms are used in this Policy:

Website means the website available under the domain name "onemoreword.app".

You (User) means any individual who uses the Services.

We (Controller) means Petr Lukovkin, Goethestraße 23, 90409 Nürnberg, Germany.

Services means the onemoreword and Medical English mobile apps, the onemoreword browser extension, and the web pages available under the domain name "onemoreword.app".

2. Scope

2.1. This Policy applies to any interaction between us and users regarding personal data when using the Services.

2.2. This Policy does not regulate or establish the rights and obligations of third parties. It also does not apply to third-party applications or software that users may integrate with the Services. If you connect third-party services to our Services, we cannot control how those third parties process your personal data.

3. Controller

3.1. The controller responsible for processing personal data in connection with the Services within the meaning of the EU General Data Protection Regulation (GDPR) is:

• Petr Lukovkin
• Goethestraße 23, 90409 Nürnberg, Germany
• Email: support [at] onemoreword [dot] app

3.2. We are not required by law to appoint a data protection officer. Further information about us is available in our Legal Notice (Impressum).

4. What Data We Process and Why

4.1. We do not require an account and do not ask for your name, email address, or phone number to use the Apps. The Apps work with a random identifier generated on your device (for example, user_1712345678_x7k2p), which does not reveal who you are.

4.2. Data stored only on your device. Your learning progress, study history, selected categories, settings, and daily reminder time are stored in the local storage of your device or browser. This data is not transmitted to us. Reminders are scheduled locally by your device; you can turn them off in the app settings or in your device settings. If you delete the App, this data is deleted with it.

4.3. Loading learning content. The Apps download words, examples, images, and content updates from Google Firebase (Cloud Firestore, Cloud Storage, Firebase Hosting). When doing so, your device transmits technical data that is necessary for any internet connection: IP address, date and time of the request, and the requested file.

• Purpose: delivering the content of the Apps.
• Legal basis: performance of the contract with you under our Terms of Service (Art. 6(1)(b) GDPR).
• Retention: we do not keep logs of these requests ourselves; Google processes technical logs on our behalf for a short period for the operation and security of its services.

4.4. Usage statistics (Mixpanel). To understand how the Apps are used and to improve them, we send usage events to Mixpanel:

• Data: the random identifier from section 4.1; events in the App (for example, app launch, screens opened, study sessions started and completed, card answers, changes of word status, taps on buttons including the Premium screen, changes of settings, errors); device model, operating system and app version, device language and locale, platform; approximate location (country, region, city) that Mixpanel derives from your IP address. Mixpanel does not store the IP address itself.
• We do not record your screen: session recording is disabled.
• Purpose: analysing how learning features are used, finding problems, and improving the Apps.
• Legal basis: our legitimate interest in understanding and improving our product (Art. 6(1)(f) GDPR). The data is pseudonymous and is not linked to your name or contact details.
• Retention: events are deleted automatically after 2 years. The pseudonymous profile (identifier, first launch date, platform, app version) is kept until you switch off statistics or ask us to delete it.
• Your choice: you can switch off statistics at any time in the App under Settings → Privacy → Share usage statistics. Collection then stops and your profile in Mixpanel is deleted.

4.5. Crash reports (Firebase Crashlytics). If the App crashes, a crash report is sent to Google Firebase Crashlytics.

• Data: technical details of the error (stack trace), device model, operating system and app version, and the Firebase installation identifier.
• Purpose: finding and fixing errors.
• Legal basis: our legitimate interest in stable and error-free Apps (Art. 6(1)(f) GDPR).
• Retention: 90 days.

4.6. Purchases. Paid features (the Advanced Plan) are purchased exclusively through Google Play or the App Store. The payment is processed by Google or Apple under their own terms and privacy policies; we do not receive your card details, name, or billing address. To check whether you have access to paid features, we use RevenueCat.

• Data: the random identifier from section 4.1 or an anonymous RevenueCat identifier, the purchased product, purchase and expiry dates, price, currency, country, and subscription status. In addition, Google and Apple provide us with sales reports (order number, product, amount, country).
• Purpose: providing access to paid features; bookkeeping and tax obligations.
• Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legal obligations (Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB).
• Retention: as long as needed to provide your purchased access, and afterwards for the statutory retention periods of up to 10 years.

4.7. App ratings. If you rate the App through the in-app rating prompt, the rating is sent directly to Google Play or the App Store and is processed under their privacy policies. The fact that the rating dialog was shown and the number of stars you selected are recorded as usage events (section 4.4).

4.8. Contacting support. If you write to us, for example from the App settings or after a rating, we process your email address, your message, and the technical details that the App adds to the email (app version and build, installed content version, Premium status, and study streak).

• Purpose: answering your request.
• Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering requests (Art. 6(1)(f) GDPR).
• Retention: until your request is resolved; we delete correspondence at the latest 2 years after the last contact unless statutory retention obligations apply.

4.9. Browser extension. The onemoreword browser extension stores your learning data locally in your browser and downloads learning content as described in section 4.3. It does not send usage statistics or crash reports.

4.10. We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).

5. Recipients and International Transfers

5.1. We use the following service providers. They process data on our behalf and under our instructions (Art. 28 GDPR), unless stated otherwise:

• Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland — Firebase (Cloud Firestore, Cloud Storage, Hosting, Crashlytics). Firebase privacy information.
• Mixpanel, Inc., 1 Front Street, Suite 2800, San Francisco, CA 94111, USA — usage statistics. Data is sent to Mixpanel's EU data residency (api-eu.mixpanel.com). Mixpanel Privacy Policy.
• RevenueCat, Inc., 633 Taraval Street, Suite 101, San Francisco, CA 94116, USA — management of purchases and subscriptions. RevenueCat Privacy Policy.
• Our email hosting provider — processing of support correspondence.

5.2. Google and Apple operate Google Play and the App Store as independent controllers. When you download the Apps, make purchases, or submit ratings, their own terms and privacy policies apply.

5.3. Some of the above providers are located in the USA or may access data from there. Transfers to the USA are based on the EU–U.S. Data Privacy Framework adequacy decision (Art. 45 GDPR) where the recipient is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

5.4. We disclose personal data to public authorities only where we are legally obliged to do so.

5.5. We do not sell your personal data and do not use it for advertising.

6. Your Rights

6.1. Under the GDPR you have the right to access your data (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), and to data portability (Art. 20).

6.2. Right to object (Art. 21 GDPR). Where we process data on the basis of legitimate interest (sections 4.4, 4.5, and 4.8), you may object at any time on grounds relating to your particular situation. You can object to usage statistics directly in the App under Settings → Privacy.

6.3. To exercise your rights, write to support [at] onemoreword [dot] app. We will respond within one month; for complex requests this period may be extended by two further months, in which case we will let you know within the first month. Because the Apps work without an account, we may not be able to link a request to data held about you unless you provide information that allows us to identify it (Art. 11 GDPR).

6.4. Right to lodge a complaint. You may lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence or place of work. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

7. Children

7.1. The Apps are not directed at children under 13. If you are under 16, please use the Apps only with the consent of a parent or guardian. If we learn that we have received personal data from a child under 13 without such consent, we will delete it.

8. Security

8.1. Data is transmitted in encrypted form (TLS). We collect only the data described in this Policy and use service providers that apply appropriate technical and organisational security measures. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. Changes to This Policy

9.1. We update this Policy when our Services or the law change. The current version is always available on this page with the date of the last update. We will inform you about significant changes in the App.