Privacy Policy
Last updated: 26 May 2026 · Version 1.0 · App: com.mendzyy.germanvault
This Privacy Policy describes how Hyb-Falcon Digital / Chirag Mendapara ("we", "us") collects, uses and shares information when you use the GermanVault Android app, and explains your rights under GDPR, UK GDPR and CCPA.
Contents
- Who we are
- Data we collect
- How we use your data
- Third-party services
- Advertising & consent
- Push notifications
- AI quiz feature
- Data we do not collect
- Data retention
- Your rights (EU / UK — GDPR)
- Your rights (California — CCPA)
- Account deletion
- Children's privacy
- Security
- International transfers
- Policy changes
- Contact
1. Who we are
The data controller for GermanVault is Hyb-Falcon Digital / Chirag Mendapara. Email: support@germanvault.app. App: GermanVault (com.mendzyy.germanvault). Platform: Google Play Store (Android).
2. Data we collect
We collect only what is necessary to run the app: email address (authentication), display name (personalisation), Firebase UID (data linking), learning progress (dashboard sync), quiz preferences (settings restore), app settings (theme, notifications), ad consent choice (stored on-device only), anonymous device ID (Favourites without account), FCM push token (notifications, with consent), Google Advertising ID (AdMob ads, with consent only).
3. How we use your data
To create and manage your account. To sync learning progress and mastery scores. To personalise the app experience. To generate AI-powered quiz questions (topic data only — no personal data sent to OpenAI). To deliver optional daily push notifications. To display advertisements funding the free app. To comply with legal obligations.
4. Third-party services
Google Firebase (Authentication, Firestore, Cloud Messaging) — firebase.google.com/support/privacy. Google AdMob (advertising, with your consent) — policies.google.com/privacy. OpenAI (quiz generation — no personal data included) — openai.com/policies/privacy-policy. Google Play Services (distribution). We do not sell personal data.
5. Advertising & consent
On first launch you choose: Accept all (personalised ads using your Advertising ID, legal basis: consent) or Essential only (contextual ads, no profiling, legal basis: legitimate interest). Change your choice anytime in Settings → Advertising Preferences.
6. Push notifications
Daily word notifications are entirely optional. On Android 13+ you must actively grant POST_NOTIFICATIONS. Your FCM token is stored only for routing — never used for advertising. Disable in Settings → Daily Notifications.
7. AI quiz feature
The quiz feature sends a topic name and vocabulary items to OpenAI via a Firebase Cloud Function. Your name, email, UID, progress and device ID are never included. The OpenAI API key is server-side only.
8. Data we do not collect
We do not collect passwords, location data, contacts, camera, microphone, storage access, financial data, or special category data. We do not build advertising profiles ourselves.
9. Data retention
Account data and progress: retained for the lifetime of your account, deleted immediately on account deletion. Push tokens: removed when you disable notifications or delete your account. Ad consent: stored on-device only.
10. Your rights (EU / UK — GDPR)
Access (Art. 15), Rectification (Art. 16), Erasure (Art. 17), Restriction (Art. 18), Portability (Art. 20), Object (Art. 21), Withdraw consent (Art. 7(3)), Complain to supervisory authority (Art. 77). Email support@germanvault.app with subject "Data Rights Request". We respond within one calendar month.
11. Your rights (California — CCPA)
Right to know, right to delete (in-app account deletion fulfils this), right to opt out of sharing (choose "Essential only" in ad preferences), right to correct, right to non-discrimination. Email support@germanvault.app with subject "California Privacy Request". Response within 45 days.
12. Account deletion
Delete your account in-app: open side menu → Settings → Account → Delete Account → Confirm. This permanently deletes all Firebase Auth, Firestore and push token data. If you cannot access the app, email support@germanvault.app — we process deletion requests within 30 days.
13. Children's privacy
GermanVault is not directed at children under 13 (or 16 in the EEA/UK). If you believe a child has created an account, contact support@germanvault.app and we will delete the data promptly.
14. Security
All data in transit is encrypted via TLS 1.2+. Firebase Security Rules prevent cross-user data access. Firebase App Check prevents unauthorised API access. The OpenAI API key is server-side only.
15. International transfers
Our service providers (Google LLC, OpenAI) are US-based. Transfers from the EEA/UK are protected by EU Standard Contractual Clauses (SCCs) and UK IDTAs.
16. Policy changes
We update the "Last updated" date for minor changes. For material changes we notify you via an in-app notice before they take effect. Continued use does not constitute consent to material changes requiring it.
17. Contact
Hyb-Falcon Digital / Chirag Mendapara. Email: support@germanvault.app. Subject: "Data Rights Request".
This policy applies exclusively to the GermanVault Android app (com.mendzyy.germanvault) on Google Play. · Version 1.0 · © 2026 GermanVault