Privacy policy

This is a translation for convenience. The German version applies.

Last updated: 1 November 2026

Here you can read which data we process when you visit our website, join the waiting list or use the ydyom app. We follow the General Data Protection Regulation (GDPR) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

1. Who is responsible?

Houssein Ben Amor
Sedanstr. 41, 12167 Berlin, Germany
Email: [email protected]

This is also the contact for all questions about data protection.

2. The website

Hosting and server logs

The website is hosted by Cloudflare (Cloudflare, Inc., USA, with servers in Europe and worldwide). When you open the page, Cloudflare processes technically necessary data, for example your IP address, date and time, the page you opened and details about your browser. We need this to deliver the page and run it securely (Art. 6(1)(f) GDPR, our legitimate interest in a secure and stable website).

Cookies and browser storage

We use no analytics, tracking or advertising services and no cookies of our own. The page stores only one value in your browser until you close the tab: whether you closed the yellow notice at the top. This is needed so that the page does what you want (§ 25(2) no. 2 TDDDG). It is not personal data.

Protection against bots

The waiting-list form is protected by Cloudflare Turnstile. It checks in the background whether a person is filling in the form. For this, your browser sends technical data, for example your IP address, to Cloudflare. The legal basis is our legitimate interest in protecting the website from abuse (Art. 6(1)(f) GDPR).

Contact by email

If you write to us, we store your message and your email address in order to reply (Art. 6(1)(b) or (f) GDPR). We delete them when the matter is settled and no legal duty requires us to keep them.

Link to LinkedIn

We link to our LinkedIn page. It is only a link, not a plug-in: LinkedIn processes data about you only when you click. LinkedIn itself is responsible for that. See LinkedIn's privacy policy.

3. The waiting list

When you sign up, we store your email address and, if you give them, the courses you are interested in, your country and how you heard of ydyom. We also store which consent text you confirmed, when, and from which page.

• Purpose: We write to you before the launch and plan our courses.
• Legal basis: your consent (Art. 6(1)(a) GDPR).
• Confirmation (double opt-in): You first get an email with a link. Only when you click it are you added to the list. We keep the confirmation as proof.
• Service provider: The list is kept by Brevo (Sendinblue SAS, Paris, France). Brevo also sends the emails.
• Our server: Your sign-up goes through our own server (the ydyom API). It is run by Railway (USA) in data centres in the Netherlands. It passes your details on to Brevo and does not store the sign-up. Railway's technical logs may hold your IP address for a short time.
• Protection against abuse: So that one address cannot trigger any number of confirmation emails, we keep a counter with Upstash (data centre in the EU). The key is a hash of the address, not the address itself, and it is deleted after 24 hours (Art. 6(1)(f) GDPR).
• Error reports: If our server has a technical error while handling a sign-up, a short error report goes to Sentry (EU data centre). We filter it before it is sent: it contains no email address and none of the other details you entered (Art. 6(1)(f) GDPR, our interest in finding and fixing errors).
• How long: until you unsubscribe or withdraw your consent.
• Withdrawal: at any time with effect for the future, by email to [email protected]. We then delete your details.

4. The app

If you use the app with an account, we process:

• Account data: email address and an internal identifier.
• Learning data: your answers, the time you took, and simple daily totals (words read, seconds heard and spoken). We use them to calculate your progress.
• Settings and devices: for example help language and daily goal, plus a random device identifier, the type of device and the app version. No device names and no advertising identifiers.
• Reports: if you report a problem ("Problem melden"): the kind of problem, your text if you write one, and where you were in the app (screen, unit, word, exercise). The app adds technical details: the operating system and its version, the device model, whether the phone was online, and the app version. Without an account, the report cannot be linked to any person.
• Screenshot with a report, only if you send it: when you open "Problem melden", the app takes a picture of the app screen you are on. It shows only the app, never other apps or your photos. You see the picture before you send the report. It is sent only if "Bildschirmfoto mitschicken" (send screenshot) is switched on, and you can switch it off. In the public app it is off until you switch it on; in test versions it starts switched on. The picture shows whatever was on that app screen, for example your email address on the profile page. We keep it in a private storage area in the EU (Cloudflare R2). Only our team can open it, to understand the problem.
• Purchases: order number, product, price and date, which we receive from Google Play.
• Technical data: such as the IP address when our interface is called. To protect against abuse, we count requests for one hour at most.
• Error reports: If our server has a technical error, a short report goes to Sentry (EU data centre): the error, the address that was called and the time. It contains no account data, no email address and no learning data. We filter them out before it is sent.

The legal basis is the contract for using the app (Art. 6(1)(b) GDPR). For reports (with a screenshot if you choose to send one), error reports and protection against abuse it is our legitimate interest (point (f)), for purchase records our legal obligation (point (c)). The app contains no advertising services. It uses the microphone only when you tap "Sprechen" (speak).

Usage statistics

From your learning data. If you have an account, we also count how the app is used, as numbers without names or email addresses: for example how many learners were active on a day, how many came back after a week and which app versions are in use. Nothing new is collected for this. The legal basis is our legitimate interest in understanding and improving the app (Art. 6(1)(f) GDPR). You can object (see 8).

Analytics in the app, only if you agree. Near the end of the first-use introduction, the app asks whether we may count anonymously how it is used. Without your "yes", nothing is collected and nothing is sent. If you say yes, the app uses Google Analytics for Firebase (Google Ireland Limited, which acts on our behalf). It records a few events: which steps of the first-use introduction you reached and that you finished it; how long a lesson took and how many tasks it had, and that you left one early (with the kind of lesson); which unit you finished; that you played a conversation to its end; that you switched the daily reminder on or off; which course you asked to be told about; and the kind of problem you reported and the screen it was on, never your text. It also records your help language, your course and your daily goal. Google adds technical data: a random identifier of the app on your device, the device model, the version of the operating system and of the app, the language and the country. The country is worked out from your IP address, which is not stored. We never send your answers, texts, name or email address. We do not use advertising identifiers, Google signals or advertising personalisation.

• Legal basis: your consent (Art. 6(1)(a) GDPR, and § 25(1) TDDDG for storing and reading information on your device).
• Withdraw it: at any time in the app under Profile → "Nutzung anonym zählen". Switching it off stops collecting and resets the identifier. "Lernstand löschen" does the same.
• Deleted after: 2 months.

Learning tips and offers by email

When you sign in or create an account, you can tick a box: "Schick mir Lerntipps und Angebote per E-Mail" (send me learning tips and offers by email). The box is never ticked for you. Only if you tick it do we send you emails with learning tips, news about ydyom and offers, for example for a plan. Emails we need for your account (the sign-in code, messages about your account or a purchase) come either way.

• What we store: your email address (already in your account), that you agreed, the version of the text you saw and the time. If you later stop the emails, we store that too.
• Confirmation: you agree after entering the code we sent to your address, so we know the address is yours.
• Legal basis: your consent (Art. 6(1)(a) GDPR, and § 7(2) no. 2 UWG for advertising by email).
• Service provider: the emails are sent by Brevo (Sendinblue SAS, Paris, France). It receives your email address and, so that you get the right language, your help language.
• Stop them: at any time, in the app under Profile → "Tipps und Angebote per E-Mail", through the unsubscribe link in every email, or by email to [email protected].

5. Who we pass data to

We pass data only to service providers who work on our behalf. We have data processing agreements with them under Art. 28 GDPR. They are providers for hosting and security of the website, for running our server (Railway) and a counter against abuse (Upstash), for storing screenshots sent with reports (Cloudflare), for error reports (Sentry), for usage analytics, if you agree (Google), for the database and running of the app, for emails (waiting list, sign-in and, if you agree, tips and offers) and for payments through Google Play. The app data is stored in data centres in the EU. We never sell your data.

6. Transfers to countries outside the EU

Google, which provides the usage analytics, may process data in the USA as well. Some service providers are US companies. We secure a transfer there through the European Commission's adequacy decision on the EU–US Data Privacy Framework, where the company is certified, and otherwise through the EU's standard contractual clauses (Art. 44 et seq. GDPR).

7. How long we keep data

• Account and learning data, settings, reports with an account: until you delete your account. They are then gone immediately.
• Backups: a deleted account may remain in encrypted database backups for up to 30 days. After that it is gone there too.
• Purchase records: 8 years, because tax law requires it. They are then no longer linked to you: no name, no email address, no progress.
• Reports without an account: they cannot be linked to any person and are kept as long as we need them to improve the content.
• Screenshots sent with a report: 90 days after we receive them, then deleted automatically. If the report or your account is deleted earlier, the screenshot is deleted within a few hours.
• Tips and offers by email (only with your consent): until you stop them or delete your account. The record that you agreed or stopped stays with your account, as proof.
• Usage analytics (only with your consent): events for 2 months. The random identifier stays until you switch the analytics off or reset it.
• Server logs: at our service providers, according to their usual short periods.

8. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR).

• Delete your account: in the app under Profile → "Konto löschen", or without the app: see Delete account.
• Access and data portability: write to [email protected]. We send you your data in a common file format.
• Withdraw consent: at any time, with effect for the future. Processing before that stays lawful (Art. 7(3) GDPR). For the usage analytics, switch it off in the app under Profile → "Nutzung anonym zählen"; for tips and offers by email, under Profile → "Tipps und Angebote per E-Mail" or with the link in any of those emails.
• Objection: if we process data on the basis of our legitimate interest (Art. 6(1)(f)), you can object on grounds relating to your particular situation.
• Complaint: you can complain to a data protection supervisory authority, for example in the country where you live or work (Art. 77 GDPR).

9. Do you have to give us data?

No. Without an email address, however, you cannot join the waiting list, and without an account you can only learn the first unit and cannot use your progress on several devices. No automated decision that has legal effect on you takes place.

10. Changes

If our services or the law change, we adapt this policy. The version published here applies.