# Privacy Policy for Hin und Zurück **Last Updated:** January 20, 2025 ## Introduction Hin und Zurück ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website (collectively, the "Service"). Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the Service. ## Information We Collect ### Personal Information We collect the following personal information when you register for an account: - **Email address**: Used for account authentication and communication - **Name**: Used for personalization within the app - **Password**: Stored securely using industry-standard encryption ### Usage Data We automatically collect certain information when you use our Service: - **Learning Progress**: Exercise completion, lesson progress, and quiz results - **Exercise Attempts**: Your answers and performance on language exercises - **Feedback**: Any feedback you submit through the app - **Exercise Reports**: Reports you submit about problematic exercises ### Technical Data We collect technical information to improve our Service: - **Device Information**: Device type, operating system version - **Log Data**: IP address, access times, app crashes, and errors - **Authentication Tokens**: JWT tokens for secure session management ## How We Use Your Information We use the collected information for the following purposes: 1. **To provide and maintain our Service**: Creating and managing your account, tracking your learning progress 2. **To improve our Service**: Analyzing usage patterns to enhance the learning experience 3. **To communicate with you**: Sending password reset emails and important service notifications 4. **To ensure security**: Protecting against unauthorized access and fraudulent activity 5. **To provide customer support**: Responding to your inquiries and feedback ## Data Storage and Security ### Security Measures We implement industry-standard security measures to protect your data: - All data transmitted between the app and our servers is encrypted using HTTPS/TLS - Passwords are hashed using bcrypt before storage - Authentication uses secure JWT tokens - Rate limiting protects against brute force attacks - Regular security audits and updates ### Data Storage Location Your data is stored on secure servers provided by Railway (https://railway.app) located in the United States. Your data is backed up regularly to prevent data loss. ### Data Retention We retain your personal information for as long as your account is active or as needed to provide you the Service. You may request deletion of your account at any time by contacting us. ## Data Sharing and Disclosure We do NOT sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances: ### Service Providers We use the following third-party services that may have access to your data: - **Railway**: Cloud hosting infrastructure (https://railway.app) - **Resend**: Email delivery service (https://resend.com) These providers are contractually obligated to protect your data and use it only for providing their services to us. ### Legal Requirements We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency). ## Your Data Rights You have the following rights regarding your personal data: ### Access and Portability You can access your personal data and learning progress at any time through the app. ### Correction You can update your name and password through the app settings. ### Deletion You can request deletion of your account by contacting us at cdigentil@gmail.com. Upon deletion: - Your email and name will be permanently deleted - Your learning progress and exercise attempts will be anonymized or deleted - Feedback and exercise reports may be retained in anonymized form for service improvement ### Data Export You can request an export of your data by contacting us at cdigentil@gmail.com. ## Children's Privacy Our Service is designed to be suitable for all ages, including children. However, we require parental consent for users under the age of 13. If you are a parent or guardian and your child under 13 wishes to use our Service, please contact us to set up an account with appropriate parental oversight. **Age Rating**: This app is rated for ages 4+ (suitable for all ages). **For Children Under 13**: We require parental consent and supervision for users under 13. Parents can contact us at cdigentil@gmail.com to set up accounts for their children. ## International Data Transfers If you are accessing our Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States where our servers are located. By using our Service, you consent to this transfer. ### GDPR Compliance (European Users) If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR): **Data Controller**: Hin und Zurück is the data controller for your personal information. You can contact us at cdigentil@gmail.com for any GDPR-related inquiries. **Legal basis for processing**: - **Account data**: Based on your consent when you create an account - **Learning progress**: Based on our legitimate interest in providing the educational service - **Technical data**: Based on our legitimate interest in maintaining and improving the Service **Your GDPR Rights**: - **Right of access**: You can request a copy of all personal data we hold about you - **Right to rectification**: You can request correction of inaccurate personal data - **Right to erasure**: You can request deletion of your personal data - **Right to restrict processing**: You can request that we limit how we use your data - **Right to data portability**: You can request a copy of your data in a machine-readable format - **Right to object**: You may object to our processing of your personal data - **Right to withdraw consent**: You can withdraw consent at any time (where applicable) - **Right to lodge a complaint**: You may lodge a complaint with your local data protection authority **Data Protection Officer**: For GDPR inquiries, contact us at cdigentil@gmail.com ## Cookies and Tracking Technologies ### Web Application Our website uses session cookies to: - Maintain your login session - Remember your preferences You can configure your browser to refuse cookies, but this may limit your ability to use certain features. ### Mobile Application Our mobile app does not use cookies but stores: - Authentication token (locally on your device) - User preferences (locally on your device) We do NOT use tracking technologies for advertising purposes. ## Third-Party Links Our Service may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to read their privacy policies. ## Changes to This Privacy Policy We may update this Privacy Policy from time to time. We will notify you of any changes by: - Updating the "Last Updated" date at the top of this policy - Sending an email notification for significant changes - Displaying a notice in the app Your continued use of the Service after changes are posted constitutes acceptance of the updated policy. ## Contact Us If you have questions or concerns about this Privacy Policy, please contact us: **Email**: cdigentil@gmail.com **Website**: aulasdealemaohuz.com ## Data Processing Summary | Data Type | Purpose | Retention Period | | ------------------ | --------------------- | --------------------------------- | | Email & Name | Account management | Until account deletion | | Password | Authentication | Until changed or account deleted | | Learning Progress | Service functionality | Until account deletion | | Exercise Attempts | Progress tracking | Until account deletion | | Feedback & Reports | Service improvement | Anonymized after account deletion | | Log Data | Security & debugging | 90 days | ## Your Consent By using our Service, you consent to our Privacy Policy and agree to its terms.