Effective date: 2026-04-26
Version: 1.0.1 (beta)
1. Who we are
DeutschFit (the “app”) is operated by Jordan Moyo (a natural person), working under the unregistered trade names DeutschFit and SmartlyDataSense. The data controller is:
Jordan Moyo
Douala, Cameroon
Email: support@deutschfit.app
Although the data controller is established outside the EU, this policy is written to comply with the EU General Data Protection Regulation (GDPR), which applies extraterritorially under Article 3(2) because the service is offered to data subjects in the EU.
2. What we collect
- Account data: email address (for sign-in), a hashed password (dev/preview only) or one-time code (production).
- Exam preferences: chosen exam board (Goethe / TELC / ÖSD / TestDaF / ECL / Pflege / Beruf Tourismus) and CEFR level (A1-C2).
- Learning activity: exercise attempts, scores, time on task, and progress per CEFR competence (Lesen, Hören, Schreiben, Sprechen, Grammar, Landeskunde).
- Graded work: your Schreiben text submissions and Sprechen audio recordings, used to produce feedback.
- Device diagnostics: crash reports and anonymous performance metrics (via Expo Updates) to improve stability.
3. How we use it
- To provide AI-generated feedback on your writing and speaking (via OpenAI, our sole AI provider for v1.0).
- To track your progress and personalise the Coach weekly plan.
- To fix bugs and improve the app.
- To communicate with you about the service (account, support).
4. AI processing
Your Schreiben text submissions and Sprechen audio recordings are sent to OpenAI for grading. OpenAI does not use your data to train its models (as per the API data-usage policy). We do not send your identity to OpenAI — submissions are keyed by an opaque ID.
5. Data storage
Account and learning data live in Supabase (Postgres + Storage) hosted in the EU. Audio files are stored encrypted at rest.
6. Data retention
- Graded submissions: retained while your account is active.
- Raw audio recordings: deleted 90 days after grading.
- Account data: deleted immediately when you delete your account from inside the mobile app (Settings → Delete account) or from the website (deutschfit.app/account → Delete account). The deletion is processed synchronously and is irreversible. An immutable audit record of the deletion (your user ID, email, timestamp, and source) is retained for 12 months as evidence under GDPR Art. 30 record-of-processing requirements; it is never used for any other purpose and is accessible only to the data controller.
- Graded submissions and audio recordings: deleted in the same transaction as your account.
7. Your rights (GDPR)
You can request access to, correction of, or deletion of your data at any time by emailing support@deutschfit.app. You also have the right to lodge a complaint with your local data-protection authority (e.g. the BfDI in Germany, the CNIL in France).
8. Sharing
We do not sell your data. We share data only with the processors listed above (Supabase, OpenAI, Expo) strictly to run the service.
9. Children
DeutschFit is not directed at children under 13. If you believe a child under 13 has provided us with personal data, contact us and we will delete it.
10. Changes
We will post any changes to this policy here and bump the version number. Material changes will be notified in-app.