Legal

1. Controller & Contact

Thuc Hien Nguyen
Eisvogel 8
78224 Singen (Hohentwiel), Germany
Email: privacy@worio.app

Legal contact: legal@worio.app

2. What We Collect

• Account Data: Email address, name, profile information
• Usage Data: Words saved, practice sessions, progress metrics
• Diagnostic Data: Device type, operating system, app version, and crash reports for debugging
• Analytics Data: Aggregated, anonymized usage patterns (page views, feature interactions) collected via Google Analytics (gtag.js) to improve our service
• Push Notification Tokens: If you enable push notifications, a device notification token is processed to deliver notifications. You can disable notifications in your device settings at any time.
• Optional Data: Profile pictures, preferences, language goals

3. Lawful Bases & Purposes

• Contract Performance: To provide learning services and sync progress
• Legitimate Interest: App improvement, security, fraud prevention
• Consent: Marketing emails (you can withdraw anytime)

4. Data Retention

Account data: Retained while your account is active, plus 90 days after a deletion request.
Aggregated, anonymized usage data: Kept indefinitely for product improvement.
Legal obligations: Some data may be retained longer if required by law.

5. Your Rights

Under GDPR, you have the right to:

• Access your personal data
• Request corrections or deletion
• Object to processing or request restriction
• Data portability (receive your data in machine-readable format)
• Withdraw consent for marketing communications
• Lodge a complaint with your local data protection authority

Contact us at privacy@worio.app to exercise your rights.

6. Sub-processors & Transfers

We use the following service providers:

• Supabase: Database, authentication, and backend infrastructure for storing account and app data (EU region).
• Firebase (Google): Crash reporting and diagnostics for the mobile app (EU region where available).
• Google Analytics (gtag.js): Anonymized, aggregated website usage analytics. No advertising profiles are created.
• OpenAI: Personalized story generation (with a data processing agreement)

International transfers to non-EU countries are protected by Standard Contractual Clauses (SCCs) and adequacy decisions.

7. Security Measures

We implement industry-standard encryption (TLS/SSL), access controls, regular security audits, and staff training to protect your data from unauthorized access or breaches.

8. AI Processing

Worio uses OpenAI's API (operated by OpenAI, L.P.) to generate personalized learning content, including word definitions, example sentences, and interactive stories. When generating this content, anonymized vocabulary data (German words and learning context) may be processed by OpenAI's servers in the United States.

We do NOT send your name, email address, device identifier, or any personally identifiable information to OpenAI. You can disable AI features at any time in Settings → AI Features. Disabling AI features removes the ability to use Discovery extraction, interactive story generation, and double-tap definition lookup, but does not affect your saved words or other features.

For more information, see OpenAI's Privacy Policy.

8a. KI-Verarbeitung

Worio verwendet die OpenAI API (betrieben von OpenAI, L.P.), um personalisierte Lerninhalte zu generieren, darunter Wortdefinitionen, Beispielsätze und interaktive Geschichten. Bei der Generierung können anonymisierte Vokabeldaten (deutsche Wörter und Lernkontext) auf Servern von OpenAI in den USA verarbeitet werden.

Wir senden NICHT Ihren Namen, Ihre E-Mail-Adresse, Gerätekennung oder andere personenbezogene Daten an OpenAI. Sie können KI-Funktionen jederzeit unter Einstellungen → KI-Funktionen deaktivieren.

Weitere Informationen finden Sie in der OpenAI Datenschutzerklärung.