VocaPurr
English
Get the app

Privacy Policy

Last updated: October 2026. This privacy policy applies to the website vocapurr.eu, to the mobile app “VocaPurr” for Android and to the web app “VocaPurr” that runs in the browser (including on iPhone and iPad). The Android app and the web app are together called the “app”; where they differ, this is stated expressly. This is a translation for convenience; the legally binding version is the German Datenschutzerklärung.

1. Controller

The controller for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

Christian Staehler
Wendelsweg 60
60599 Frankfurt am Main
Germany
Email: info@vokakitty.nl

As matters currently stand there is no statutory obligation to appoint a data protection officer, and none has been appointed.

2. Principles

We process personal data only to the extent necessary to provide a functioning service and the features you ask for. VocaPurr is built for data minimisation: there is no analysis of your usage behaviour beyond the one-time measurement described in 4.12, no personalised advertising and no collection of location data. The only third-party analytics SDK used by the Android app is Google Analytics for Firebase, and only for a single event (see 4.12); no crash-reporting SDKs are included. No automated decision-making with legal effect within the meaning of Art. 22 GDPR takes place.

You can initially use the app as a guest without registering; for this we collect neither your name, nor your email address, nor your date of birth (see 4.2).

3. Visiting this website

3.1 Server log files

When you open the web app or the app sends requests to the app server, the hosting provider automatically stores information transmitted by your browser or the app in server log files: IP address, date and time of access, the URL requested, the volume of data transferred, the referrer URL, browser type and operating system. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in technical operation and IT security). These access logs are deleted or anonymised after roughly eight weeks (IONOS standard retention).

When you access the website, our web server processes your IP address and the details named above only to deliver the pages; it does not store access logs. Technical error messages from the server may contain the IP address; they are kept in the system log for no more than 14 days. The legal basis is also Art. 6(1)(f) GDPR.

3.2 Hosting

The website runs on a virtual server managed by us at netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany; the server is located in a data centre in Germany. A data processing agreement under Art. 28 GDPR is in place with netcup (netcup DPA version 7, as of 07/2026). netcup belongs to the Anexia group and engages Anexia Holding GmbH and Anexia Cloud Solutions GmbH (Klagenfurt, Austria, and Karlsruhe, Germany) as sub-processors, so processing stays within the EU. netcup is certified to ISO 27001.

The web app and the app’s server component are operated at IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. The provider processes the data named above exclusively on our behalf; a data processing agreement under Art. 28 GDPR is in place with IONOS (IONOS DPA version 1.3, as of 03/2026). Processing takes place in a member state of the EU or the EEA; transfers to third countries occur only where necessary to provide the service, and then under the conditions of Art. 44 et seq. GDPR. IONOS is certified to ISO 27001 and engages sub-processors on the basis of a general authorisation with a right to object.

3.3 Cookies

As delivered, the website sets only technically necessary cookies (for example for the comment function or when signing in to the WordPress backend). No cookies are set for analytics or marketing purposes. The legal basis for technically necessary cookies is section 25(2) TDDDG in conjunction with Art. 6(1)(f) GDPR.

4. Using the “VocaPurr” app

4.1 Account and registration

An account is required to use the app. On first launch, at your request (“Let’s go”), we create a guest account without any personal details (see 4.2). You can upgrade it to a full account at any time (“Secure your account”); it remains the same account with all of your learning data. When upgrading the guest account or at registration, we process: username, email address, password (stored only as a cryptographic hash), date of birth and the language you select, together with the version of the terms you accepted. Alternatively you can sign in via Google (Android app and web app) or Apple (Android app only) (OAuth); in that case we receive an ID from those providers along with the profile details you have released.

The date of birth is collected when upgrading the guest account or at registration and serves to verify the minimum age (see 4.3). We do not collect a country of origin and do not carry out IP geolocation.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract); with respect to the age information, additionally Art. 6(1)(c) in conjunction with Art. 8 GDPR.

4.2 Guest account (use without registration)

If you tap “Let’s go” on first launch, our server creates a guest account. It contains no email address, no password, no name and no date of birth. The server assigns a random username of the form “gast-xxxxxxx”, visible only to you, and an internal user ID. We also store the selected language, the version of the terms accepted and the time of last use. Your word lists, learning progress, streak and coins are stored under this pseudonymous user ID, as with any other account (see 4.4).

Recovery after reinstalling or changing device: when the account is created, the server generates a random string (recovery secret); we keep only a hash of it. The Android app stores the secret in Google Block Store on your device. If Google backup is switched on for your device, Google backs it up in encrypted form to your Google account and restores it on a new device; Google cannot associate it with any VocaPurr account, and we get no access to your Google account. In addition, when the account is created the Android app transmits a device key: the Android ID, which Android assigns separately for each app and which survives a reinstall on the same device. We store only an HMAC hash of it and use it solely to restore the guest account once after a reinstall on the same device – not for advertising, tracking or matching with other services. The web app instead stores the secret in your browser’s localStorage (see 4.11). When you upgrade to a full account, we delete the hash of the secret and the device key on the server.

Restricted range of features: because we do not know the age of guests, the most restrictive settings apply to guest accounts under data protection by default (Art. 25 GDPR) – as for minors without parental consent: the friends function, sharing pools, the online challenge and the related push notifications are blocked, and for age-dependent content the account is treated as a minor’s. The app shows reminders to secure the account inside the app; as a notification, at most every three days and only if you have allowed notifications anyway.

Deletion: you can delete the guest account at any time under Profile → Settings → Delete guest account; deletion is immediate and final. Guest accounts that have not been used for 90 days are deleted automatically and permanently. If, as a guest, you sign in with an existing account and confirm the switch shown, we also delete the guest account.

Abuse protection: to prevent the automated mass creation of accounts, guest account creation is limited to 5 per hour and 20 per day per IP address. For this the server keeps a counter in which the IP address appears only as a hash and which expires with the relevant time window (24 hours at most); the IP address is not linked to the guest account.

Legal basis: Art. 6(1)(b) GDPR (providing the learning features you requested, including recovery); for the automatic deletion after 90 days and the abuse protection, Art. 6(1)(f) GDPR (legitimate interest in data minimisation and operational security).

4.3 Minimum age and children

A full account can be created from age 6. The date of birth collected when upgrading the guest account or at registration serves to verify age; if it is below the minimum age, no full account is created, no details are stored and an existing guest account remains unchanged. Guest accounts do not collect a date of birth and are therefore treated like accounts of minors without consent (see 4.2). For users under 16, the social and online features – the friends function, sharing pools and the online challenge – are blocked until consent from a parent or guardian under Art. 8 GDPR has been given. Unlocking is controlled by the server through so-called capabilities; the date of birth itself does not drive the interface. Learning with your own word lists is usable independently of this.

If we become aware that the social features have been unlocked for a person under 16 without the required consent, we will block them without delay and delete the data arising from that use. Please send any such information to info@vokakitty.nl.

4.4 Learning content and progress

We process the word lists (pools) and words you create, your learning progress (flashcard box positions, due dates, answer results), your learning settings and game elements such as the streak counter and coins. This data is stored locally – in the Android app in an encrypted database, in the web app in your browser’s storage (see 4.11) – and synchronised with the server so that it is available across several devices and is not lost. Legal basis: Art. 6(1)(b) GDPR.

4.5 Friends and sharing

For the friends function we process your friend code, incoming and outgoing friend requests, your friends list and your block list. Other users are shown only your user ID and username – never your email address, date of birth, coins, streak or settings. Legal basis: Art. 6(1)(b) GDPR.

4.6 Online challenge

In the online challenge we process match data (participants, rounds, results, scores). It is visible to both participants together with the match history. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). The app does not offer a chat or messaging function.

4.7 Push notifications (Firebase Cloud Messaging, Android app only)

For push notifications (challenge invitations, social events, shared pools, optional learning reminders) we use Firebase Cloud Messaging (FCM) from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. A device token is transmitted to Google and stored there. The content of the notifications is minimised (only the event type, the ID concerned and the username of the account that triggered it) – no vocabulary content, pool names, email addresses or scores. Transfer to the USA cannot be ruled out; Google relies on the EU standard contractual clauses or the EU-US Data Privacy Framework.

The legal basis for transaction-related notifications is Art. 6(1)(b) GDPR. Learning and streak reminders are expressly opt-in (Art. 6(1)(a) GDPR) and can be switched off at any time in the app settings. You can also disable push notifications entirely at operating system level. The web app does not use Firebase Cloud Messaging (see 4.11).

4.8 AI features

Some optional features use an external language model: AI cloze texts in practice mode D (single sentences and short stories), translation suggestions, detection of a word’s language, additional information on words, and the import of word lists from pasted text, from files and from photos. The provider is configured by the server at runtime; currently this is OpenAI, L.L.C. (3180 18th Street, San Francisco, CA 94110, USA). The provider may change – for instance to an OpenAI-compatible provider or to Anthropic; the current details are maintained at this point in the text.

Only what the feature in question needs is transmitted to the provider: the words or word pairs and languages concerned, for stories also the interests you may optionally have entered, and for the import the text you pasted or the photos you selected. Not transmitted are username, user ID, email address, date of birth, pool name, device ID or location. Please note: photos and pasted texts are transmitted as you select them. If they contain names or other personal details (for example on a worksheet), these also reach the provider – crop such parts out beforehand.

The requests run through our own server: the app sends them to the VocaPurr backend, which passes them on to the provider. The provider therefore learns our server’s IP address, not yours, and the access key for the provider never leaves our server. Neither the Android app nor the web app contacts the provider directly. The providers are based in the USA; the transfer is based on the EU standard contractual clauses or – where the recipient is certified – on the EU-US Data Privacy Framework. If you do not use any of these features, no transfer to the provider takes place. Legal basis: Art. 6(1)(b) GDPR (providing the feature you requested).

4.9 Media

Short reward clips (cat videos) are served statically from the web space and cached on the device or in the browser. This involves only the technically necessary connection to the web server (see 3.1).

4.10 Storage on the device (Android app)

Access and refresh tokens are stored in the Android keystore or in encrypted storage, and the local learning database is encrypted with SQLCipher. The database and tokens are excluded from automatic device backup. The exception is the recovery secret of a guest account, which is deliberately stored in Google Block Store (see 4.2).

4.11 Special features of the web app

The web app is loaded as program files from our server at IONOS and then runs in your browser. Loading it produces the server log files described in 3.1. The web app integrates no analytics, advertising or tracking services and sets no cookies for such purposes.

Storage in your browser: so that the web app also works offline, it stores in your browser: the learning database (pools, words, learning progress, settings) in IndexedDB; access and refresh tokens, the recovery secret for guest accounts (see 4.2), a randomly generated device ID and device settings (for example language) in localStorage; and the program files and reward clips in the cache of a service worker. Unlike in the Android app, this data is not additionally encrypted; the browser and operating system shield it from other websites. We do not gain access to any other data in your browser. The legal basis for storing and reading it is section 25(2) no. 2 TDDDG (strictly necessary for the service you requested) in conjunction with Art. 6(1)(b) GDPR.

When you sign out, the access tokens are removed. You remove the remaining locally stored data completely by deleting the web app’s website data in your browser (on iPhone and iPad: Settings → Apps → Safari → Advanced → Website Data). Changes not yet synchronised are lost in the process. On shared devices you should sign out after use and delete the website data.

Signing in with Google: when you tap “Sign in with Google” in the web app, your browser loads a script from Google (accounts.google.com) only at that moment. In doing so, Google Ireland Limited receives your IP address and technical browser data; the sign-in itself is governed by Google’s terms. A transfer to the USA cannot be ruled out (see 6). Without this tap, no Google script is loaded. Signing in with Apple is not available in the web app.

Reminders instead of push: the web app does not send push messages via Google or Apple. It shows learning reminders – only if you allow this in the browser – as a local notification while the web app is open. No data is transmitted to third parties in the process.

Camera and photos: the web app accesses the camera or photo library only when you yourself take or select a photo while importing word lists; for further processing see 4.8. Inviting friends: if you share your friend code, the web app uses your operating system’s share function; we do not learn which route you choose. When someone opens an invitation link, the web app reads the friend code it contains from the address.

4.12 Usage measurement (Google Analytics for Firebase and OpenAI, Android app only)

To find out which advertising for VocaPurr actually brings learners (and not just installs), the Android app measures a single event: that the first learning round has been completed on this device. For this we use Google Analytics for Firebase from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes a random, pseudonymous app instance ID, the time of the event and of the installation, technical device data (for example device model, Android version, app version, language), the approximate country derived from the IP address and, where applicable, the information about which Google ad the app was installed through. Google Ads uses this information to count how many users acquired through an ad complete their first learning round.

The following are not processed: advertising ID (AAID), Android ID, username, user ID, email address, date of birth or learning content. We do not use the measurement for personalised advertising or remarketing and do not record any further screens or actions. The web app contains no usage measurement (see 4.11).

Ads in ChatGPT: If the app was installed through an ad in ChatGPT, we additionally report the installation and the first completed learning round to OpenAI, L.L.C. (3180 18th Street, San Francisco, CA 94110, USA). For this, our server forwards the click on the ad to the Google Play Store without setting a cookie and passes a click reference issued by OpenAI (“oppref”) on to Google Play. The app reads this reference once from the Google Play install referrer and reports the two events, with their time and a random installation identifier, to our server. Our server transmits to OpenAI only the type of event, its time, the click reference and an event identifier that cannot be traced back to you – no advertising ID, Android ID, username, email address or IP address – and marks the report so that OpenAI may not use it for personalisation. OpenAI uses this information to count how many users acquired through a ChatGPT ad complete their first learning round, and to align the delivery of our ads with it. On our server the reports are stored without being linked to your account and are deleted after 30 days. For installations that did not come through a ChatGPT ad, nothing is reported to OpenAI.

In the EU, the EEA, the United Kingdom and Switzerland (and where the device’s country cannot be determined), the app measures only if you consent in a dialog on first launch. The legal basis is your consent under Art. 6(1)(a) GDPR and section 25(1) TDDDG. In all other countries the measurement is on by default; the legal basis is our legitimate interest in measuring the effectiveness of our advertising (Art. 6(1)(f) GDPR). In both cases you can switch the measurement off at any time under Settings → Usage measurement; the measurement data still stored on the device and the app instance ID are then deleted as well. A transfer to the USA cannot be ruled out (see 6). This also applies to the reports to OpenAI; when you switch the measurement off, a stored click reference and reports not yet sent to OpenAI are deleted as well.

5. Recipients and processors

  • netcup GmbH, Karlsruhe – hosting of the website (processing on our behalf, EU/Germany; sub-processors: Anexia group, Austria/Germany).
  • IONOS SE, Montabaur – operation of the web app, the app server and the former website address vokakitty.nl, as well as mailboxes and mail delivery for system and confirmation emails (processing on our behalf, EU/Germany).
  • Google Ireland Limited – push notifications via Firebase Cloud Messaging (Android app only).
  • Google Ireland Limited – usage measurement via Google Analytics for Firebase and conversion counting in Google Ads (Android app only, see 4.12).
  • Google Ireland Limited – Google Block Store and Google backup for the recovery secret of guest accounts (Android app only; it reaches your Google account only if you use Google backup).
  • Google Ireland Limited / Apple Inc. – when signing in via “Sign in with Google” (Android app and web app) or “Sign in with Apple” (Android app only).
  • OpenAI, L.L.C. (USA) – when using the AI features (see 4.8), exclusively through our server, never directly from your device. The language model provider may be changed.
  • OpenAI, L.L.C. (USA) – conversion counting for ads in ChatGPT (Android app only, and only for installations through such an ad, see 4.12), exclusively through our server.

6. Transfers to third countries

Transfers to the USA (including Google, OpenAI and – when signing in via Apple – Apple) take place on the basis of the EU standard contractual clauses under Art. 46(2)(c) GDPR and, where the recipients are certified, the EU-US Data Privacy Framework under Art. 45 GDPR. A copy of the safeguards is available from the controller.

7. Retention periods

  • Account and learning data: until the account is deleted.
  • After account deletion: hard deletion of identifying data, irreversible anonymisation of content; then final deletion after the stated period.
  • Match data: for as long as the accounts involved exist; on account deletion, as above.
  • Guest accounts: until you delete them or upgrade them to a full account, at the latest 90 days after last use; then final deletion of all data of the account.
  • Recovery secret and device key (hashes, server): until the guest account is deleted or upgraded.
  • Abuse-protection counter (IP hash): 24 hours at most.
  • Server log files: roughly eight weeks.
  • Usage measurement (Google Analytics for Firebase): event data for at most 2 months at Google; once the measurement is switched off, the data on the device is deleted immediately.
  • Reports on ads in ChatGPT (server): 30 days; on the device only until they are reported or the measurement is switched off.
  • Data in the browser (web app): until you delete the website data in the browser; access tokens at most until you sign out.
  • Access tokens: 30 days, refresh tokens: 180 days (automatically invalid thereafter).

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You may withdraw consent you have given at any time with effect for the future.

You can exercise your right to erasure directly in the app: the entire account via Profile → Delete account (instructions under delete your account), and individual words, pools or learning progress directly in the “Pools” area (instructions under delete words and pools). You delete a guest account immediately and permanently via Profile → Settings → Delete guest account. Because a guest account contains no details that identify you, outside the app we can recognise you as its holder only to a limited extent (Art. 11 GDPR); in that case, tell us your guest username. For anything else, please contact info@vokakitty.nl.

You have the right to lodge a complaint with a supervisory authority. The competent authority is the data protection authority of your place of residence, or the authority responsible for the controller:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI)
Postfach 31 63, 65021 Wiesbaden, Germany
Phone: +49 611 1408-0  ·  Email: poststelle@datenschutz.hessen.de

9. Obligation to provide data

No details are required from you for a guest account. Username, email address, password and date of birth are required only for a full account, that is, to secure the account, for the social features and for signing in on several devices.

10. Changes to this privacy policy

We adapt this privacy policy when the data processing changes or legal requirements make it necessary. The current version is always available on this page.