Legal

1. Controller & Contact

Thuc Hien Nguyen
Eisvogel 8
78224 Singen (Hohentwiel), Germany
Email: privacy@worio.app

Legal contact: legal@worio.app

2. What We Collect

• Server Logs: When you visit worio.app, our host (Firebase Hosting) automatically processes your IP address, the date and time, the page requested, your browser and operating system, and the referring page, to deliver the website and keep it secure.
• Account Data: Email address, name, profile information
• Usage Data: Words saved, practice sessions, progress metrics
• Learning Signals: When you use our text analysis features, we record which German words the analysis offered you and which of them you saved, together with the length and word count of the text you provided. The text you paste is never stored. We use this to understand which words are new to you and to improve what we suggest.
• Diagnostic Data: Device type, operating system, app version, and crash reports for debugging
• Analytics Data: Aggregated, anonymized usage patterns (page views, feature interactions) collected via Google Analytics (gtag.js) to improve our service
• Push Notification Tokens: If you enable push notifications, a device notification token is processed to deliver notifications. You can disable notifications in your device settings at any time.
• Browser Extension (Save to Worio): If you install our browser extension and connect it to your account, it sends us a word only when you select it on a web page and choose "Save to Worio", together with the sentence it appears in (up to 300 characters). It does not send the address of the page, your browsing history, or anything from pages where you do not use it. To connect the extension, we store a label for the browser (for example "Chrome on Mac"), a hashed connection token, and when the connection was created and last used. On your computer, the extension keeps the connection token and your last 10 saved words in the browser's local storage. Words saved this way are handled like any other word you add in the app (see Usage Data and AI Processing).
• Optional Data: Profile pictures, preferences, language goals
• Newsletter: your email address, only if you subscribe on worio.app.

3. Lawful Bases & Purposes

• Contract Performance: To provide learning services and sync progress
• Legitimate Interest: App improvement, security, fraud prevention
• Browser Extension: to save the words you choose to your library (Art. 6(1)(b) GDPR, contract performance).
• Website Hosting: our legitimate interest in delivering a secure, working website (Art. 6(1)(f) GDPR).
• Google Analytics: your consent through the cookie banner (Art. 6(1)(a) GDPR and § 25(1) TDDDG). You can withdraw it at any time on our Cookies page.
• Consent: Marketing emails (you can withdraw anytime)
• Newsletter: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with the unsubscribe link in every email.

4. Data Retention

Account data: Retained while your account is active, plus 90 days after a deletion request.
Aggregated, anonymized usage data: Kept indefinitely for product improvement.
Learning signals: Deleted when you delete your account or reset your learning data.
Browser extension connection: kept until you delete your account. Disconnecting a computer in the app or in the extension ends its access immediately. The data the extension stores on your computer is removed when you uninstall it.
Newsletter email address: until you unsubscribe.
Server logs: kept by Google only as long as needed to deliver and secure the website. We do not use them to identify you.
Google Analytics data: up to 14 months, then deleted automatically.
Legal obligations: Some data may be retained longer if required by law.

5. Your Rights

Under GDPR, you have the right to:

• Access your personal data
• Request corrections or deletion
• Object to processing or request restriction
• Data portability (receive your data in machine-readable format)
• Withdraw consent for marketing communications
• Lodge a complaint with a data protection authority. The authority responsible for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

Right to object (Art. 21 GDPR): Where we process your data on the basis of our legitimate interest, you can object at any time on grounds relating to your particular situation. We will then stop processing it unless we can show compelling legitimate grounds. Where you have given consent, you can withdraw it at any time with effect for the future.

Contact us at privacy@worio.app to exercise your rights.

6. Sub-processors & Transfers

We use the following service providers:

• Supabase: Database, authentication, and backend infrastructure for storing account and app data (EU region).
• Firebase Hosting (Google Ireland Ltd.): hosts the worio.app website. Processes your IP address and browser data in server logs to deliver the site.
• Sentry (Functional Software, Inc.): crash and error reports from the mobile app, including device information and, where attached, your user ID.
• PostHog (PostHog, Inc.): product analytics in the mobile app, such as which features are used.
• Expo (650 Industries, Inc.): delivers push notifications to the mobile app through Apple and Google push services. We store your device push token with your user ID.
• Google Sign-In (Google): if you choose to sign in with Google, Google shares your name, email address and account ID with us.
• Google Analytics (gtag.js): Anonymized, aggregated website usage analytics. No advertising profiles are created. Provided by Google Ireland Ltd.; data may be transferred to Google LLC in the USA.
• Brevo (Sendinblue SAS, France): stores newsletter subscriber email addresses and sends the newsletter. You are added only after you tick the consent box and confirm the link in our confirmation email (double opt-in). Data is processed in the EU. Brevo records whether a newsletter is opened and which links are clicked, to measure reach. Unsubscribing stops this.
• OpenAI: Personalized story generation (with a data processing agreement)

Some providers (Google, Sentry, PostHog, Expo, OpenAI) are based in the USA or may process data there. These transfers rely on the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR) where the provider is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

7. Security Measures

We implement industry-standard encryption (TLS/SSL), access controls, regular security audits, and staff training to protect your data from unauthorized access or breaches.

8. AI Processing

Worio uses OpenAI's API (operated by OpenAI, L.P.) to generate personalized learning content, including word definitions, example sentences, and interactive stories. When generating this content, anonymized vocabulary data (German words and learning context) may be processed by OpenAI's servers in the United States.

We do NOT send your name, email address, device identifier, or any personally identifiable information to OpenAI. You can disable AI features at any time in Settings → AI Features. Disabling AI features removes the ability to use Discovery extraction, interactive story generation, and double-tap definition lookup, but does not affect your saved words or other features.

For more information, see OpenAI's Privacy Policy.

9. Automated Decisions and Required Data

We do not use automated decision-making, including profiling, that has legal or similarly significant effects on you (Art. 22 GDPR). You are not legally required to give us personal data. To create an account we need your email address; without it you cannot use the app's account features. Using the website and subscribing to the newsletter are optional.