Privacy policy
This English version is a courtesy translation. If there is any difference, the German version is legally binding.
1. Responsible party
Manuel Killert, Geschwister-Scholl-Straße 27, 49610 Quakenbrück, Germany. Email: lernen@davaigo.de. We have not appointed a data protection officer; we are not required to do so.
2. What Davaigo processes from you
Without an account
You can view the homepage and go through the introductory questionnaire without creating an account. We do not store any personal data on our servers. Your answers and the chosen starter package are stored only on your device until you sign up.
With an account
For an account, we need your email address and a password; optionally, you can provide a display name. Additionally, while learning, the following are generated: your collected vocabulary with learning progress, completed lessons, points, levels and daily streak, saved videos and songs, and – with Premium – generated e-books.
The legal basis is Art. 6 para. 1 lit. b GDPR: Without this data, the service cannot be provided, as this is its essence.
Server logs
Technical log data (IP address, time, accessed address, browser type) is generated upon access. This data is used for secure operation and is deleted shortly thereafter. The legal basis is Art. 6 para. 1 lit. f GDPR – our legitimate interest in a functioning, secure service.
3. To whom data is disclosed
This list is complete and derived from the program code. Only what is necessary for the stated purpose is disclosed.
Supabase
- Purpose
- Account, registration, and storage of your learning progress
- Submitted data
- Email address, password (encrypted), display name, vocabulary, lesson progress, points, subscription status
- Provider / Location
- Supabase Inc., San Francisco, USA – Data storage in the EU
- Legal basis
- Art. 6 para. 1 lit. b GDPR (Contract), Data processing agreement under Art. 28
Hetzner Online GmbH
- Purpose
- Operation of website and application server
- Submitted data
- All requests to davaigo.de, technical log data
- Provider / Location
- Hetzner Online GmbH, Gunzenhausen, Germany – Data center Falkenstein
- Legal basis
- Art. 6 para. 1 lit. b and f GDPR, Data processing agreement under Art. 28
OpenAI
- Purpose
- Generating vocabulary lists and additional grammar exercises, translating words and subtitles
- Submitted data
- The text to be translated or the chosen topic and – to avoid repetitions – a list of already learned words. No email address, no account ID.
- Provider / Location
- OpenAI Ireland Ltd., Dublin, Ireland
- Legal basis
- Art. 6 para. 1 lit. b GDPR
- Third country
- Processing may occur in the USA; secured via standard contractual clauses.
OpenAI (Sprach-Trainer)
- Purpose
- Speaking trainer: holding the voice conversation, converting speech to text and analysing the conversation. Only after you agree before your first call.
- Submitted data
- Your voice during the call, the conversation text, your chosen level, your learning profile, summaries of earlier calls and your learning progress. No email address and no name from your account.
- Provider / Location
- OpenAI Ireland Ltd., Dublin, Ireland
- Legal basis
- Art. 6(1)(a) GDPR
- Third country
- Processing may occur in the USA; secured via standard contractual clauses.
Anthropic (Premium only)
- Purpose
- Generating bilingual e-books on your chosen topic
- Submitted data
- The topic you specify and your level. No email address, no account ID.
- Provider / Location
- Anthropic PBC, San Francisco, USA
- Legal basis
- Art. 6 para. 1 lit. b GDPR
- Third country
- USA, secured via standard contractual clauses.
Google / YouTube
- Purpose
- Embedded learning videos, preview images, and video search
- Submitted data
- When playing a video: IP address and device information to YouTube. When searching: your search term. We embed videos in enhanced privacy mode (youtube-nocookie), yet YouTube establishes a connection when playing.
- Provider / Location
- Google Ireland Ltd., Dublin, Ireland
- Legal basis
- Art. 6 para. 1 lit. b GDPR
- Third country
- USA, secured via standard contractual clauses.
Google Analytics
- Purpose
- Anonymous reach measurement – how many people use Davaigo and through which channels they arrive
- Submitted data
- Truncated IP address, page views, device type, referrer page. Cookies named _ga and _ga_*. No vocabulary, no account ID, no email address.
- Provider / Location
- Google Ireland Ltd., Dublin, Ireland
- Legal basis
- Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG – solely with your consent. Without consent, no script is loaded and no cookie is set. You can withdraw consent at any time under 'More → Measurement'.
- Third country
- USA, secured via standard contractual clauses.
Google Fonts
- Purpose
- Loading of the Nunito font, which the app is set in
- Submitted data
- When the page is accessed, your browser retrieves the font file from Google and transmits your IP address.
- Provider / Location
- Google Ireland Ltd., Dublin, Ireland
- Legal basis
- Art. 6 para. 1 lit. f GDPR – legitimate interest in a uniform presentation
- Third country
- USA, secured via standard contractual clauses.
Stripe
- Purpose
- Processing of Premium payment
- Submitted data
- Email address and an ID of your account. You enter your payment details directly with Stripe; we do not see or store them.
- Provider / Location
- Stripe Payments Europe Ltd., Dublin, Ireland
- Legal basis
- Art. 6 para. 1 lit. b GDPR
RevenueCat (only for purchases in the app)
- Purpose
- Managing subscriptions you take out in the app through Apple or Google
- Submitted data
- An identifier of your account, purchase details such as product, date and term, and technical details about your device and the app. You enter your payment details directly with Apple or Google; we neither see nor store them.
- Provider / Location
- RevenueCat, Inc., San Francisco, USA
- Legal basis
- Art. 6 para. 1 lit. b GDPR
- Third country
- USA, secured via standard contractual clauses.
All-Inkl (feedback form only)
- Purpose
- Delivering your message to us by email
- Submitted data
- Your message, your email address if provided, your account identifier, language and device details of the browser or app
- Provider / Location
- ALL-INKL.COM – Neue Medien Münnich, Friedersdorf, Germany
- Legal basis
- Art. 6 Abs. 1 lit. f DSGVO
Spotify (only if you connect it)
- Purpose
- Song suggestions based on your music taste
- Submitted data
- After your approval, Davaigo reads your saved tracks, private playlists, and most-listened artists (permissions: user-library-read, playlist-read-private, user-top-read). You can disconnect at any time.
- Provider / Location
- Spotify AB, Stockholm, Sweden
- Legal basis
- Art. 6 para. 1 lit. a GDPR – only with your explicit approval
TubeAlfred
- Purpose
- Retrieval of video subtitles if our server cannot load them itself
- Submitted data
- The video ID. No personal data.
- Provider / Location
- TubeAlfred, EU
- Legal basis
- Art. 6 para. 1 lit. b GDPR
ALL-INKL.COM – Neue Medien Münnich
- Purpose
- Sending of confirmation and password emails
- Submitted data
- Your email address and the content of the respective message
- Provider / Location
- Neue Medien Münnich, Friedersdorf, Germany
- Legal basis
- Art. 6 para. 1 lit. b GDPR, processing on behalf according to Art. 28
Not on this list – and why: The audio recordings in the course were created once in advance with a speech service and have since been stored as finished audio files on our storage. Nothing is transmitted to this service during learning.
What the speaking trainer stores
We do not store your voice. We store the conversation as text, a summary, detected mistakes and new words, and a learning profile with your goals, interests, estimated level and progress. This lets the trainer refer to earlier calls and lets you read them again. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by deleting individual conversations or the whole memory on the trainer page and no longer using the trainer. This data is also deleted with your account. We keep the start and duration of each call to calculate your minutes. The analysis is automated and may contain errors. It has no legal effect on you.
4. Cookies and storage on your device
Davaigo stores your learning progress in your browser's local storage so the app works offline and starts quickly. This is technically necessary (§ 25 para. 2 no. 2 TDDDG) and does not require consent. Supabase sets a login cookie as long as you are logged in.
Cookies for reach measurement (Google Analytics) are set only with your consent via the notice on your first visit. Until you click there, no Google script is loaded and no cookie is set. You can change your decision at any time under 'More → Measurement'; upon withdrawal, the cookies are deleted.
No advertising networks, tracking pixels, or resale of your data take place.
5. How long we store
We store account data and learning progress as long as your account exists. If you delete your account under 'More → Delete account', all associated data will be irretrievably removed. We retain billing data for ten years due to tax obligations (§ 147 AO).
6. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21 GDPR). You can withdraw any consent given at any time with future effect.
For access and erasure, simply send an email to lernen@davaigo.de. You can also download your entire learning progress at any time as a file under 'More → Create backup'.
You can lodge a complaint with a supervisory authority. The competent authority for us is the State Commissioner for Data Protection Lower Saxony, Prinzenstraße 5, 30159 Hannover.
7. Changes
If Davaigo changes, this statement changes with it. The version published here applies.
Status: August 23, 2026