Introduction

HAN•GL ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains our data practices for the HAN•GL mobile application and website.

By default, HAN•GL works anonymously: you can use the app without creating an account, providing an email, or sharing your name. Cloud backup is optional and user-initiated.

Data Controller

The data controller responsible for processing your data is:

Kevin Myung
c/o COCENTER
Koppoldstr. 1
86551 Aichach, Germany
support@hangl.app

What We Collect

HAN•GL collects the minimum data required to deliver the app and improve it over time. We do not sell data, do not show advertisements, and do not track your location.

Anonymous mode (default):

An anonymous user ID generated by Firebase Authentication. This ID is a random string — not linked to you personally.
A durable install ID, a random string created on first launch and stored on your device (in the iOS keychain, or in Android's backed-up app storage). It is stamped on your progress record and can survive reinstalling the app. That persistence is deliberate: it is what lets us reconnect progress that would otherwise be stranded under an anonymous ID your device no longer has. It carries no information about you or your device.
Your learning progress (chapters completed, vocabulary collected, mastery levels, quiz scores) synced to Firebase Cloud Firestore under this anonymous ID. This enables progress recovery if you reinstall the app.
Anonymized analytics and crash reports (see "Analytics and Usage Data" below).
Anything you choose to send us through the in-app feedback or report forms (see "Feedback and Reports" below).
If you allow notifications, a record for your device so we can send them (see "Notifications" below).

When you link your account (optional):

Your email address, as provided by Apple Sign-In or Google Sign-In. You can hide your real email via Apple's "Hide My Email" feature, in which case we only receive a relay address.
A permanent user ID that replaces your anonymous ID. Your progress is still stored under this ID so it can follow you across devices.

We do NOT collect:

Your name, phone number, or postal address
Your location or GPS coordinates
Photos, contacts, microphone input, or other personal files
Advertising identifiers (we explicitly disable the Android AD_ID permission)

The only contact detail we ever hold is an email address, and only in the two cases you choose: linking your account through Apple or Google Sign-In, or asking us to reply when you send in-app feedback. Neither is required to use the app.

Authentication & Accounts

HAN•GL uses Firebase Authentication (a Google service) to manage user identities.

On first launch, the app signs you in anonymously — no personal data is collected, just a random device-scoped ID. If you choose to link your account via Apple Sign-In or Google Sign-In, Firebase issues a permanent ID tied to your Apple or Google identity, and we receive your email address.

Legal basis: Contract performance (Art. 6(1)(b) GDPR) — anonymous authentication and cloud backup are necessary to deliver the core app service (your progress surviving reinstalls and cross-device sync).

You can review Firebase Authentication's privacy practices at firebase.google.com/support/privacy.

Cloud Sync

Your learning progress is stored locally on your device and synced to Firebase Cloud Firestore under your user ID (anonymous or permanent). This sync enables progress recovery if you reinstall the app and cross-device continuity if you link your account.

What is synced:

Completed chapters, lessons, and tests
Vocabulary collected and mastery levels
App flags (e.g. which intros you've seen)

What is NOT synced: language preference, UI toggles, and other device-local settings stay on your device only.

Legal basis: Contract performance (Art. 6(1)(b) GDPR).

Cloud Functions

HAN•GL uses a small number of Firebase Cloud Functions (server-side code running on Google's infrastructure):

mergeAnonymousProgress — when you sign in to an Apple or Google account that already has HAN•GL progress, this function combines your current device's progress with the existing cloud record so nothing is lost.
reconcileByInstallId — reconnects progress left stranded under an older anonymous ID after a reinstall or a device change. It looks up progress records carrying your install ID and merges them into your current one. It only ever absorbs anonymous records, and never another person's linked account.
deleteAccount — when you delete your account from Settings, this function removes your Firestore progress record, any feedback or reports you submitted, and your Firebase Auth user. No trace is kept on our side.
revenueCatWebhook — receives subscription events from RevenueCat that the app cannot observe on its own, such as a trial converting to paid days after you last opened the app, and forwards them to Firebase Analytics so our subscription reporting is complete. It carries the subscription event and your RevenueCat user ID. It never carries payment details.

The first three run on demand, triggered by your actions, and do not store additional data beyond what is already in Firestore. The fourth is triggered by RevenueCat rather than by you.

Feedback and Reports

The app lets you report a problem with a specific word or lesson, and send general feedback from the menu. Both are optional, and you can use the whole app without ever sending either.

What a submission stores:

Your message, as you wrote it (capped at 200 characters for a content report, 500 for general feedback)
Your user ID, so we can investigate and so the submission is deleted along with your account
What you were looking at: the vocabulary items, chapter, or screen the report came from
App version, platform, operating system version, and device language, so a reported bug is diagnosable without having to come back and ask you
An email address, only if you tick "reply to me" when sending feedback. Leave it unticked and no contact detail is stored.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) in fixing the content and bugs you report. Where you supply a reply address, consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by emailing us.

Retention: Submissions are kept while the issue is open, and afterwards as a record of what was fixed. They are deleted immediately and permanently if you delete your account.

Notifications

If you allow notifications, we store a record for your device so we can send them. This only happens after you grant permission, and you can withdraw it at any time in your device settings or under Settings inside the app.

What that record holds:

Your device's push tokens (the addresses your operating system uses to route a notification to your device) and which platform you are on
Your user ID, so a device can be matched to its account
Targeting details, so a notification is relevant rather than generic: your language and country, app version, when you were first seen and last active, your current chapter and which chapters you have finished, how many words you have collected, your current streak and last practice date, and whether you are on the free tier, a trial, or paid

These decide who a given notification is worth sending to, and nothing else. They are not used for advertising and are not shared.

Legal basis: Consent (Art. 6(1)(a) GDPR), given when you allow notifications and withdrawable at any time by turning them off.

Deletion: This record is filed under your device's token rather than your account, so deleting your account removes the record for the device you delete from. If you have used HAN•GL on more than one device, email support@hangl.app and we will remove the others.

Account Deletion

You can delete your account at any time from the app: Menu → Login / Signup → Delete account. Deletion is immediate and permanent — no grace period. On deletion:

Your Firestore progress record is deleted.
Any feedback or content reports you submitted are deleted.
The notification record for the device you delete from is removed, so a deleted account stops receiving pushes.
Your Firebase Authentication user is deleted.
Analytics data (anonymized and not linked to your identity) continues its normal retention period of 14 months.
Your subscription, if any, is not cancelled — it is managed by Apple or Google outside of our control, and you should cancel it separately via your App Store or Play Store account if desired.

To delete data collected via our waitlist (prior to launch) or any other request, email support@hangl.app.

Analytics and Usage Data

To improve the app experience and fix technical issues, we collect anonymized usage data and crash reports through Firebase Analytics and Firebase Crashlytics (services provided by Google). This data is keyed to your Firebase user ID, which is not linked to your real identity.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) — we have a legitimate interest in understanding how users interact with the app and in maintaining its stability. This processing is minimal, anonymized, and does not override your rights.

What we collect:

App usage patterns (which chapters, lessons, and vocabulary levels you view, quiz scores, time spent in the app)
Crash logs and error reports to help us identify and fix bugs
General device information (device model, operating system version)

How we use this data:

Understand which features users find most helpful
Identify and fix crashes and technical errors
Improve the overall app experience
Make decisions about future content and features

Important: This analytics data is NOT used for advertising, NOT sold to third parties, and NOT linked to your personal identity. It is aggregated and used solely to improve the app.

Retention: Analytics data is retained for 14 months in Firebase and for up to 24 months in our own analytics archive, and is deleted automatically afterwards. Crash reports are retained for 90 days.

Your choice: You can turn analytics collection off at any time in the app under Settings, using the "Share anonymous usage data" toggle. You can also object to this processing under Art. 21 GDPR by emailing support@hangl.app, and you can request erasure of the data held about you (see "Your Rights" below). Analytics has no bearing on your learning progress or its sync. Note that deleting your account removes your progress and any reports you sent, but analytics data is pseudonymous and runs out its normal retention period rather than being deleted with the account.

Purchases and Subscriptions

If you make a purchase or subscribe to HAN•GL, payment processing is handled entirely by Apple (App Store) or Google (Google Play). We do not collect or store your payment information (credit card numbers, billing address, etc.).

We use RevenueCat to manage subscription status across platforms. RevenueCat receives:

A RevenueCat user ID. In anonymous mode this is a device-scoped ID not linked to you. If you link an Apple or Google account, this ID is set to your Firebase user ID so your subscription follows your account across devices and platforms (App Store and Google Play). In neither case is it linked to your name.
Transaction identifiers provided by Apple or Google
Subscription status (active, expired, cancelled)
Product and pricing information for your purchase

Legal basis: Contract performance (Art. 6(1)(b) GDPR) — this processing is necessary to deliver the subscription service you purchased.

RevenueCat acts as a data processor on our behalf. You can review RevenueCat's privacy policy at https://www.revenuecat.com/privacy.

Third-Party Services

HAN•GL uses the following third-party services as data processors:

Firebase (Google):

Firebase Authentication — Anonymous user IDs by default; permanent IDs when you link Apple or Google
Firebase Cloud Firestore — Stores your learning progress so it survives reinstalls
Firebase Cloud Functions — Runs account merge, orphaned-progress reconciliation, account deletion, and the RevenueCat subscription-event bridge on our servers
Firebase Analytics — Tracks anonymous usage patterns and app interactions
Firebase Crashlytics — Monitors app crashes and errors to help us fix bugs

Apple Sign-In (optional):

Provides your email address (or an Apple-relayed email) and a unique identifier. Used only to link your account to your progress.

Google Sign-In (optional):

Provides your email address and a unique identifier. Used only to link your account to your progress.

RevenueCat:

Subscription management — Manages purchase verification and subscription status

Aguamiel (social media management):

Community replies: From September 2026, an external agency manages our Instagram and TikTok accounts and answers comments and direct messages on our behalf. They can see the messages and comments you send to those accounts, along with your public username and profile picture.
Limits on what they may do with it: They act only on our documented instructions, and may not use anything they see for their own purposes. Their access is granted through revocable platform roles, never by sharing our credentials. Where a message needs our direct attention, they forward it to us over a private, end-to-end encrypted WhatsApp channel, limited to the message itself, a link to the post, and your public username where that is needed to reply. Nothing else is copied out of Instagram or TikTok.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) in answering people who contact us on social media. This applies only to the accounts themselves. It has no bearing on the app, and nothing about your learning progress or your account is shared with them.

Data Security: All data transmitted to these services is encrypted in transit. Firebase data is stored on Google's servers subject to Google's security standards. You can learn more at firebase.google.com/support/privacy.

We do not share your data with any advertising networks, data brokers, or other third parties beyond those listed above.

International Transfers

Firebase and RevenueCat process data on servers located in the United States and other regions. Google and RevenueCat rely on Standard Contractual Clauses (SCCs) and other safeguards approved by the European Commission to transfer data out of the EU. Our social media agency is based in Mexico, which has no EU adequacy decision, so that processing is covered by Standard Contractual Clauses signed directly with them. By using the app, you acknowledge that your data may be processed outside your country of residence.

Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights regarding your data:

Right of access — You can request a copy of any data we hold about you
Right to rectification — You can request correction of inaccurate data
Right to erasure — You can delete your account in-app (Menu → Login / Signup → Delete account), or email us
Right to restrict processing — You can request that we limit how we use your data
Right to data portability — You can request your data in a machine-readable format
Right to object — You can object to processing based on legitimate interest

To exercise any of these rights, contact us at support@hangl.app and we will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. The relevant authority for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), based in Ansbach (lda.bayern.de).

Children's Privacy

HAN•GL is suitable for learners of all ages and works anonymously by default — no name, email, or other personal information is collected in anonymous mode.

Account linking is restricted to users aged 16 and over. Linking your progress to an Apple or Google account requires us to receive an email address from the provider. Under Art. 8 GDPR, processing personal data of children under 16 in Germany requires verifiable parental consent, which we do not currently offer. Children under 16 may continue to use HAN•GL in anonymous mode without restriction.

If you become aware that a child under 16 has linked an account, please contact us at support@hangl.app and we will delete the account promptly. Parents may also use the in-app Delete Account flow at any time.

We comply with the Children's Online Privacy Protection Act (COPPA) for users in the United States and equivalent children's privacy laws in other jurisdictions. The anonymized analytics we collect is not linked to any individual user and is used solely to improve the app.

Website

Our website (hangl.app) does not use analytics, tracking pixels, or advertising cookies. No personal data is collected from website visitors. The site is hosted by Netlify, which may process technical request metadata (IP address, user agent, request timestamp) in standard server logs for security and infrastructure purposes.

Waitlist

If you joined our waitlist prior to app launch, we collected your email address, platform preferences, and primary language solely to notify you when HAN•GL became available. This data is stored in a private Google Sheet and is not shared with third parties. You may request deletion of this data at any time by contacting us.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

Contact Us

If you have questions about this Privacy Policy, please contact us at support@hangl.app