App privacy policy

This is a translation. The German version prevails.

As of November 9, 2026. This policy applies to the Wordspoiler app on Android and iPhone. For the website, the website privacy policy applies.

1. At a glance

• No name, no email address, no password. The app creates an anonymous account on first start.
• Our server is in Germany.
• No ads, no advertising ID, no cookies, no tracking.
• “Delete data” in the profile deletes everything that belongs to you.

2. Controller

Email: michael [æt] schreier.digital. All details are in the legal notice of the app.

3. Beta

Wordspoiler is currently a free test version, without purchases and without a subscription. You get it through a public link: on iPhone through TestFlight, on Android through the open test on Google Play. We do not receive your Apple or Google email address for this. Apple and Google run their test programs under their own terms and privacy policies.

If you send us feedback through TestFlight or Google Play, we receive your text, a screenshot if you attach one, and details about the device. We use this to improve the app (Art. 6(1)(f) GDPR).

4. Your account

The account is a random ID. With it, our server stores:

• your judgments on words, such as “I know it” or “Show me”,
• your podcasts and the episodes you prepare,
• the time you have used for preparations,
• your reports of wrong translations.

The app uses this to put together the words of an episode for you and to sync your progress. The legal basis is Art. 6(1)(b) GDPR.

Like every server, ours logs requests to detect errors and abuse. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is safe, stable operation.

5. Podcasts and episodes

Search: When you search for a podcast, our server queries a public podcast directory. Your account and your IP address are not sent along.

Your own podcasts: When you add a podcast by its feed address, we store the address. Only you can see it. Don’t add private feeds whose address contains a personal access key.

The words of an episode: They are made on our server, with the help of service providers for speech recognition and AI text processing (section 8). These receive only the episode’s audio and text and word lists, never data from your account. The word lists belong to the episode, not to you.

Voices and names in an episode belong to the people in the podcast. We process them only to offer the words of the episode. The legal basis is Art. 6(1)(f) GDPR.

Listening: To listen, the app opens your podcast app. Its privacy policy applies there.

6. Usage statistics and error reports

Without any content, the app reports which parts are used (Plausible, on our server in Germany) and sends a technical report after a crash (Sentry, EU). Both use random IDs, not your account. Legal basis: Art. 6(1)(f) GDPR, a stable app. You can object by email.

7. On your phone

The app keeps practice cards, reviews and settings only on your phone. It stores the IDs and the sign-in key of your account securely on this phone, not in backups. On a new phone or after reinstalling, a new account therefore starts. Only on iPhone can an account survive a reinstall.

8. Recipients

These service providers process data on our behalf (Art. 28 GDPR):

• Hosting: Hetzner Online GmbH, Germany. Our server and the usage statistics run here.
• Service providers for speech recognition and AI text processing: AssemblyAI (USA), Anthropic (USA), Mistral AI (France). They receive only audio and text of podcast episodes and word lists, never data from your account.
• Error reports: Sentry (Functional Software, Inc., USA). The reports are stored in the EU region.
• Usage statistics: Plausible Analytics, self-hosted on our server in Germany.

Where data goes to the USA, the transfer is safeguarded by the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

9. Storage periods and deleting your data

• Your account and its data: until you choose “Delete data”. We delete accounts after 12 months without contact from the app.
• Server logs: 14 days.
• Usage statistics: 24 months.
• Error reports: 90 days.

You find “Delete data” at the bottom of the profile. It deletes your account and everything that belongs to it, on the phone and on our server. What remains has no link to you: the word lists of episodes and the podcasts you added by their feed address. If you only uninstall the app, your account stays on the server until the 12 months are over. So choose “Delete data” first.

10. Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15 to 18 and 20 GDPR). You can object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR).

We know your account only by a random ID. Without a name or email address we cannot identify you (Art. 11 GDPR). “Delete data” lets you delete everything yourself, right away.

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany.

Using the app is voluntary. It does not work without the data in section 4. We do not make automated decisions under Art. 22 GDPR.

11. Contact

Send privacy questions to michael [æt] schreier.digital. In the app you can also use “Help and feedback” in the profile. If you write to us, we use your address and your message to answer you (Art. 6(1)(f) GDPR). We delete them once everything is settled and no legal retention duty applies.