Privacy Policy

Website (derdieoops.com)

This part covers visits to the website derdieoops.com. The mobile app is covered separately below.

Controller

The controller responsible for processing personal data on this website (Art. 4(7) GDPR) is:

Yurii Kuzela
Anzengrubergasse 12/8, 1050 Wien, Österreich
support@derdieoops.com

Hosting and server logs

The website is hosted by Hébergement OVH Inc. (OVHcloud), Montréal, Canada. Server location: Frankfurt am Main, Germany. An adequacy decision of the European Commission exists for Canada (Art. 45 GDPR). The data processing agreement (Art. 28 GDPR) is part of the contract with OVH.

The web server does not store access logs. Only in the event of technical errors can the IP address, time and requested address be written to an error log. It serves solely to fix errors (Art. 6(1)(f) GDPR) and is overwritten automatically.

Cookies and similar technologies

The first two cookies below and the theme setting are strictly necessary to provide the website as you requested it, so under § 165 Abs. 3 TKG 2021 they do not require consent. Google Analytics cookies are set only with your consent.

• i18n_redirected: Stores your selected language. Necessary. Duration: 12 months.
• analytics_consent: Stores your decision in the cookie banner (accepted or declined) so that it can be respected. Necessary. Duration: 183 days (about 6 months), after which the banner asks again.
• _ga, _ga_*: Set by Google Analytics to distinguish visitors and sessions. Only with your consent. Duration: up to 2 years (Google's default); browsers may shorten this, Chrome for example to 400 days and Safari to 7 days. Deleted when you withdraw your consent.
• color-mode: Stored in your browser's local storage, not as a cookie, and only if you switch between light and dark mode. It remains until you clear your browser data.

Google Analytics 4

If you consent, this website uses Google Analytics 4, a web analytics service. For users in the EEA the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may also be processed by its parent company Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

The purpose is to understand how the website is used, so that I can improve it. Google Analytics records, for example, pages viewed, scrolling and clicks on the store buttons, as well as device and browser information and an approximate location, under a pseudonymous ID stored in the cookies listed above. Your IP address is transmitted to Google in the process. According to Google, IP addresses of users in the EU are used to derive the approximate location and dropped before the data is logged.

The legal basis is your consent (Art. 6(1)(a) GDPR and § 165 Abs. 3 TKG 2021). Google Analytics is not loaded until you click “Accept”, and not at all if you click “Decline”. The website works the same either way.

Advertising signals are off: in Google Consent Mode only analytics storage is granted, while ad storage, ad user data and ad personalization stay denied, and Google Signals and ad personalization are disabled. I do not use this data for advertising.

Data may be transferred to the USA. The transfer is based on the European Commission's adequacy decision of 10 July 2023 for the EU-US Data Privacy Framework (Art. 45 GDPR), under which Google LLC is certified.

Google Analytics keeps event-level and user-level data for 2 months.

Server-side events from /app links

Links starting with derdieoops.com/app, for example in my social media profiles, forward you to the App Store or Google Play, or show a page explaining how to open the link in a browser. To count how many visitors arrive through which link, the server sends an event to Google Analytics (Measurement Protocol) for each such visit, also without your consent, because many of these visitors never see the cookie banner. Crawlers and link-preview bots are not counted. The event contains:

• the type of event and its result (for example, forwarded to a store, or “Copy link” tapped);
• the platform (iOS, Android or other) and whether the link was opened in an app's built-in browser;
• the source of the link (for example, “tiktok”) and the language;
• the device category (mobile, tablet or desktop) and the operating system;
• a random ID and a timestamp.

Without your consent, nothing is stored on your device for this purpose, and the server only reads your language and consent cookies, if they exist. The random ID is created for that single page view and kept nowhere, so one visit cannot be connected to another. Your IP address and your browser's user agent are not passed on to Google: the request comes from my server, which uses the user agent only to work out the device category and operating system. Advertising signals are denied.

If you have accepted Google Analytics, the event instead carries the IDs from your _ga and _ga_* cookies, so that it joins your analytics session. The legal basis for this is your consent.

Insofar as personal data is processed at all, the legal basis without consent is my legitimate interest under Art. 6(1)(f) GDPR in measuring which links bring visitors to the app. You may object to this processing (Art. 21 GDPR). What is said above about transfers to the USA also applies here. The App Store and Google Play are responsible for their own data processing once you are forwarded.

Withdrawing your consent

You can withdraw your consent at any time, without giving a reason: open Cookie settings (also at the bottom of every page) and choose “Decline”. Your _ga and _ga_* cookies are then deleted and Google Analytics is no longer loaded.

Withdrawal does not affect the lawfulness of processing before it (Art. 7(3) GDPR). Events that were already queued before you withdrew may still be sent within a few seconds.

Your rights

Under the GDPR you have the right to:

• access your data (Art. 15);
• have inaccurate data rectified (Art. 16);
• have your data erased (Art. 17);
• restrict processing (Art. 18);
• data portability (Art. 20);
• object to processing based on legitimate interest (Art. 21);
• withdraw your consent at any time (Art. 7(3)).

To exercise these rights, contact me at the email address above.

You also have the right to lodge a complaint with a supervisory authority. In Austria this is:

Österreichische Datenschutzbehörde
Barichgasse 40–42, 1030 Wien
www.dsb.gv.at

1. Information We Collect

1.1 Information Stored Locally on Your Device

The App stores the following data locally on your device. This data is never transmitted to our servers unless you explicitly submit a bug report (see Section 1.3).

• User Profile: Your chosen display name, native language, proficiency level, daily learning goal, theme preference, and sound settings.
• Learning Progress: Word learning statuses, training history, accuracy scores, favorite words, and vocabulary progress.
• App Preferences: Notification preferences, energy balance, streak data, and other app settings.

No account or login is required to use the App. All user profile and learning data is stored exclusively on your device and is deleted when you uninstall the App.

1.2 Analytics Data (Collected Automatically)

I use Firebase Analytics, a service provided by Google, to collect pseudonymous usage data. This data helps me understand how the App is used, improve features, and fix issues. Analytics data includes:

• App usage patterns (screens visited, features used)
• Training performance data (accuracy, session duration)
• General user preferences (language, theme, premium status)
• App engagement and retention metrics
• Ad interaction data for free-tier users
• Technical error logs (non-personal)

Analytics data is associated with a pseudonymous device identifier generated by Firebase and is not linked to any personally identifiable information. You may limit analytics data collection by restricting the App's internet access through your device settings.

1.3 Bug Reports (Voluntary, User-Initiated)

If you choose to submit a bug report through the App, the following information is collected and sent to our server located in Frankfurt, Germany (EU):

• Your description of the issue
• Basic user profile data (display name, language, proficiency level)
• Device information (platform, device model, OS version, app version)
• System diagnostics (battery, network, memory status)
• App settings (theme, sound)

Bug reports are submitted voluntarily. Bug report data is retained for 12 months and then deleted.

1.4 Information We Do NOT Collect

• We do not collect your email address, phone number, or real name (unless you choose to enter a name in the App).
• We do not access your location, camera, microphone, contacts, calendar, or photo library.
• We do not collect or store payment information (all purchases are processed by Apple or Google).
• We do not enable user-to-user communication or social features.
• We do not sync your learning data to the cloud.

2. How We Use Your Information

• Providing the Service: To operate the App, save your learning progress, and deliver a personalized learning experience.
• Improving the App: To analyze usage patterns, identify popular features, and prioritize development efforts.
• A/B Testing: To test different versions of features and optimize the user experience.
• Advertising: To display ads to free-tier users through Google AdMob (see Section 3).
• Subscription Management: To verify premium subscription status through RevenueCat (see Section 3).
• Push Notifications: To send daily learning reminders and streak alerts (see Section 5).
• Bug Resolution: To diagnose and fix technical issues reported by users.

3. Third-Party Services

The App uses the following third-party services, each of which may collect data according to their own privacy policies:

• Firebase Analytics (Google) — Pseudonymous usage analytics
• Firebase Cloud Messaging (Google) — Push notification delivery
• Firebase Remote Config (Google) — Feature configuration and A/B testing
• Google AdMob (Google) — Advertising for free-tier users
• RevenueCat — Subscription and in-app purchase management

Google AdMob may use advertising identifiers and device information to serve ads. Premium subscribers do not see ads, and AdMob does not collect data from premium users.

RevenueCat processes subscription transactions and maintains purchase history to verify entitlement status. RevenueCat uses an anonymous app user ID and does not receive your personal information from us.

4. Data Storage and Security

• Local Data: Stored on your device and automatically deleted when you uninstall the App.
• Analytics Data: Processed by Google Firebase on Google's servers in accordance with Google's data retention policies.
• Bug Reports: Transmitted over HTTPS and stored on our server in Frankfurt, Germany (EU). Retained for 12 months, then deleted.
• Subscription Data: Managed by RevenueCat and the respective app stores.

I implement reasonable technical measures to protect the data I process. However, no method of electronic storage or transmission is completely secure, and I cannot guarantee absolute security.

5. Push Notifications

The App may send you push notifications and local notifications to remind you about daily learning goals, streak status, and other App-related information.

How to opt out of notifications:

• In the App: Go to Settings and disable the notifications toggle.
• On iOS: Settings > Notifications > Der Die Oops > toggle off Allow Notifications.
• On Android: Settings > Apps > Der Die Oops > Notifications > toggle off notifications.

6. Data Retention

• Local data (profile, progress, settings): Until you uninstall the App
• Firebase Analytics data: Subject to Google's retention policies
• Bug reports: 12 months from submission
• Subscription data: Managed by RevenueCat and the app stores

7. Children's Privacy

Der Die Oops is an educational app suitable for users of all ages. However, it is not specifically directed at children under the age of 14 (in accordance with GDPR). I do not knowingly collect personal information from children under 14 without parental consent (§ 4 Abs. 4 DSG).

If you are a parent or guardian and believe that your child has provided personal information through a bug report, please contact me at support@derdieoops.com and I will take steps to delete such information.

8. Your Rights

8.1 Rights Under the EU General Data Protection Regulation (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights:

• Right of Access: You may request a copy of the data I hold about you.
• Right to Rectification: You may request that I correct inaccurate data.
• Right to Erasure: You may request that I delete your data. Local data can be deleted by uninstalling the App. Bug report data can be deleted upon request.
• Right to Restriction of Processing: You may request that I restrict certain processing of your data.
• Right to Data Portability: You may request a copy of your data in a structured, machine-readable format.
• Right to Object: You may object to the processing of your data for certain purposes.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time.

Legal Basis for Processing (GDPR):

• Legitimate Interest: Analytics data collection to improve the App and understand usage patterns.
• Contract Performance: Processing necessary to provide the App's features and services.
• Consent: Push notifications and bug reports.

To exercise any of these rights, please contact me at support@derdieoops.com.

8.2 Rights Under the California Consumer Privacy Act (CCPA)

If you are a California resident:

• Right to Know: You may request information about the personal information I have collected.
• Right to Delete: You may request deletion of your personal information.
• Right to Opt-Out of Sale: I do not sell your personal information. The sharing of data with third-party advertising services for the purpose of serving ads may be considered a "sale" under the CCPA. You may opt out of personalized advertising by adjusting your device's ad tracking settings.
• Right to Non-Discrimination: I will not discriminate against you for exercising your CCPA rights.

To exercise your CCPA rights, please contact me at support@derdieoops.com.

8.3 Controlling Your Data

Regardless of your location:

• Delete all local data: Uninstall the App from your device.
• Reset analytics identifiers: Reset your device's advertising identifier through your device settings.
• Disable personalized ads: Adjust your device's privacy settings to limit ad tracking.
• Disable notifications: Turn off notifications in the App settings or your device settings.
• Request deletion of bug reports: Contact me at support@derdieoops.com.

9. International Data Transfers

The App is operated from Austria (EU). Bug report data is stored on servers located in Frankfurt, Germany (EU). Analytics data is processed by Google (Firebase) in accordance with Google's data processing terms, which may involve servers outside the EU. Where data is transferred outside the EU/EEA, appropriate safeguards such as Standard Contractual Clauses are in place.

10. Changes to This Privacy Policy

I may update this Privacy Policy from time to time. I will notify you of any material changes by posting the updated Privacy Policy on the website or within the App. The "Last updated" date at the top indicates when it was last revised.

11. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact me at:

Yurii Kuzela

Email: support@derdieoops.com