The short version
- There is no account. I never ask for your name, and the app doesn't need your email address.
- Your learning progress syncs through your own iCloud account. I can't read it.
- The app sends usage statistics to my server — counts such as how many words you reviewed per day — tied to a random installation ID, not to you as a person. Details below.
- This website uses no cookies and stores nothing on your device. It counts visits without being able to recognise you on another day.
- No advertising, no ad networks, no selling or sharing of data with third parties.
Who is responsible
This policy covers the CrewLingo iOS app and this website. The controller within the meaning of Art. 4(7) GDPR is:
Lukas Hummel
Kurmainzer Straße 105
65936 Frankfurt am Main
Germany
Email: crewlingo@hummeldevelopments.de
There is no data protection officer; none is required at this size. Write to the address above with any question about your data.
The app
Your progress
Your words, boxes, streaks and settings are stored on your device and synced between your devices through Apple's iCloud (CloudKit), in your private iCloud database. Apple processes this under its own privacy policy; I have no access to it. Daily reminders are scheduled on your device and never pass through my server.
Usage statistics
To understand how the app is used and to improve it, the app sends a report to my server while it is in use (at most hourly) and when it goes to the background. A report contains:
- Two pseudonymous identifiers: a random installation ID the app creates on first launch (reinstalling creates a new one), and the identifier Apple's CloudKit gives this app for your iCloud account. Neither contains your name, email address or Apple ID, but because they stay attached to one person they still count as pseudonymous personal data (Art. 4(1) GDPR).
- About the install: when the app was first opened, your native-language setting, app version, device model, iOS version, language and region setting, and whether you have Plus.
- Per day and per language you study: cards reviewed and answered correctly, new words met, learned and mastered, sessions started and finished, seconds spent, your daily goal and whether you met it, your streak, and how many words sit in each box.
- Events with their time: app opened (at most once a day), setup finished or skipped, the Plus screen shown and from where, a purchase, trial start or restore, a session finished or abandoned, grammar tips opened.
- Plus subscription transactions as reported by Apple: product, purchase and expiry dates, whether it started a free trial, refunds, and Apple's transaction IDs. No payment details — Apple processes payment as an independent controller and never shares them with me.
It contains nothing you type, no contacts, no location and no advertising identifier. Legal basis: my legitimate interest in understanding and improving the app (Art. 6(1)(f) GDPR). The statistics are kept until you ask me to delete them. You can object at any time: send me your User ID (in the app under Settings → About the App → Your User ID) and I will delete the data for that install and exclude it from future reports.
Card reports and messages
When you report a card or send a message from the app, it is delivered by email to my mailbox. A card report contains the reasons you chose, your comment, the word and language, the box it was in, the app version and the two identifiers above. A message contains its topic and text, the identifiers, app version, device model, and the language you study and your native language. Your email address is included only if you enter one, and is used only to reply. Legal basis: Art. 6(1)(b) and (f) GDPR. I keep these emails as long as needed to deal with them.
Plus grants
The app asks my server whether a free Plus grant exists for your installation or iCloud identifier (for example, for early testers). Only the two identifiers are sent.
Crash reports
If you have chosen to share analytics with app developers in your iOS settings, Apple sends me crash and error reports. They contain technical details about the device and the state of the app when it failed, and reach me in aggregated form through Apple; Apple's privacy policy governs how it collects them.
This website
Hosting and server logs
The site, the app's server and the mailbox that receives card reports and messages run on a server of Contabo GmbH, Aschauer Straße 32a, 81549 Munich, Germany, located in the European Union. Contabo acts as my processor under a data processing agreement (Art. 28 GDPR); its privacy information is at contabo.com/de/legal/privacy. Delivering a page technically requires your IP address. The site's own web server keeps no access log. The reverse proxy in front of it may log requests (IP address, time, address requested, browser) for security; those logs are deleted after 14 days. CrewLingo is run by one person alongside a full-time job, so an attack or fault may only be noticed some days later; the logs are kept long enough to investigate it then. Legal basis: my legitimate interest in the security and stability of the server (Art. 6(1)(f) GDPR).
Everything on the site — text, images, audio, fonts — is served from my own server. No content is loaded from third parties.
Visitor statistics, without cookies
I count visits to see which pages are read and which links bring people here. The site sets no cookies and does not use local storage or any other storage on your device, and it does not fingerprint your browser. When a page loads, or when you tap an App Store badge, play a phrase or open a question, your browser sends a small notice to my server. From it I record:
| Recorded | How |
|---|---|
| Page and action | The address without parameters; for actions, which one (e.g. which badge or phrase) |
| Where you came from | The referring website's domain only, or a campaign name in the link (e.g. ?ct=whatsapp) |
| Device type | Phone, tablet or desktop, from the window width |
| Browser and operating system | Their names (e.g. Safari, iOS), read from your browser's user agent, which is then discarded |
| Country | Looked up from your IP address, which is then discarded |
| Page language | Which language version of the page you read |
| Daily visitor count | A one-way hash of your IP address, user agent and a random value that changes every 24 hours |
Your IP address and user agent are never stored. The random value is deleted when it changes, after which nobody — including me — can connect a hash to an IP address or to the same visitor on another day. These statistics are deleted after 25 months. Legal basis: my legitimate interest in measuring how the site is used (Art. 6(1)(f) GDPR); because nothing is stored on or read from your device, no consent is needed under § 25 TDDDG.
IP geolocation by DB-IP (licensed under CC BY 4.0), looked up on my own server.
Links to the App Store
The App Store badges link to Apple. Once you follow one, Apple's privacy policy applies.
Who receives data
Data goes only to the providers named on this page — Contabo as my processor, and Apple to the extent described — and to authorities where the law requires it. I transfer nothing to countries outside the EU, and no data is ever sold.
Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interest (Art. 21). An informal email to crewlingo@hummeldevelopments.de is enough. Because I hold no name or email address for app users, please include your User ID so I can find, export or delete the data.
You also have the right to complain to a data protection supervisory authority (Art. 77 GDPR). The one responsible for me is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Postfach 3163, 65021 Wiesbaden, Germany.
Data security
All traffic between the app or your browser and my server is encrypted with TLS. Only I have access to the database. I take appropriate technical and organisational measures (Art. 32 GDPR), though no system can be guaranteed to be completely safe from unauthorised access.
Changes
If what the app or the site collects changes, this page changes with it, and the date at the top is updated.