Privacy Policy

The data controller within the meaning of the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR) is:

This Privacy Policy is governed by:

• the Swiss Federal Act on Data Protection (FADP)
• the EU General Data Protection Regulation (GDPR), insofar as it applies to users located in the European Union

We only process the data we need to run Zeitlernen. The one thing we require is an email address, everything else is optional.

We process personal data for the following purposes and on the following legal bases:

• Performance of the user agreement (Art. 6(1)(b) GDPR): this means the agreement on the use of Zeitlernen that you enter into when you register and accept the Terms of Use. It exists even though the service is free. On this basis we create and manage your account, provide the learning content, store learning progress, manage child profiles and classes, and answer your enquiries.
• Consent (Art. 6(1)(a) GDPR): for the newsletter and for optional additional details in your profile. You can withdraw your consent at any time with effect for the future.
• Legitimate interests (Art. 6(1)(f) GDPR): security and abuse prevention (such as spam protection at sign-in and detecting unusual access), stability and troubleshooting, and measuring the reach of our newsletters.
• Legal obligations (Art. 6(1)(c) GDPR): where the law requires us to retain data or to provide information to authorities.

We do not use automated decision-making with legal effect, we do not build advertising profiles and we do not sell data. Learning data is never analysed for advertising purposes.

Zeitlernen works without advertising or tracking cookies. What we do store sits in your browser's local storage or, in the app, in the protected storage area the system assigns to the app on your device. It is required for the service to work.

• Necessary storage: your sign-in session, language choice, light or dark mode, your cookie selection, and buffered entries that are submitted later if the connection drops. Legal basis: performance of the user agreement, or legitimate interest.
• Analytics: We do not embed any analytics or statistics services and do not set analytics cookies. Should we introduce an analytics tool in the future, this will only happen with your consent, and we will update this policy beforehand.
• Newsletter reach measurement: our newsletter emails may contain a counting pixel and links redirected through our own domain so that we can measure opens and clicks and improve the content. We store no IP addresses for this, only a salted hash; automated requests by spam filters, link scanners and privacy proxies are filtered out. Legal basis: legitimate interest. You can object at any time by turning the newsletter off in your settings, which ends both sending and measurement.

You can change your choice at any time via the cookie banner in the footer or via your browser settings. The iOS and Android apps show no banner because they load neither third-party cookies nor tracking.

Zeitlernen is made for children, but accounts are created and managed by adults only: by a parent or legal guardian, or by a school.

Children do not have their own account with an email address and password. At home they learn within the adult's profile; at school they sign in with a code issued by the school.

Child profiles deliberately work with a minimum of information: a first name and the year of birth are enough. Guardians can view, change and delete their children's data at any time.

When a school creates classes and pupils, the school remains the controller for that data. We process it on its behalf and on its instructions, which makes us a processor.

Teachers see the learning progress of their classes. One school’s data is not accessible to other schools, and we do not use it for our own purposes. For a teacher’s own account, meaning email address and login credentials, we are the controller rather than the school; this policy applies to that data.

Schools can read the data processing agreement in their school area at any time, conclude it electronically and download it as a PDF. Requests from pupils or their guardians should primarily be addressed to the school; we support the school in handling them.

The sample version of the agreement is publicly available: View the data processing agreement

We only share data with service providers we need in order to operate. All of them are contractually bound to process data only on our instructions. We use:

• Supabase (database, sign-in and server functions). Your account, learning and school data is stored in a data centre in Zurich, Switzerland.
• Cloudflare (delivery of the website and the "Turnstile" spam protection at sign-in). Your device's IP address is processed in the course of this.
• Resend (sending our emails, for example confirmations, password resets and the newsletter). Your email address and the content of the message are transmitted.
• Adobe Fonts and Google Fonts (the website's typefaces). Loading the fonts transmits your device's IP address to those providers.

There is no recipient for the avatar images: they are generated in the avatar generator directly on your device, and nothing is transmitted for this.

You get the apps from Apple's App Store or from Google Play. These stores only distribute the app package; we do not pass any account or learning data to them. Which data Apple and Google collect when you download the app and while operating their stores is their own responsibility under their own privacy policies. The app itself embeds no third-party services beyond our own infrastructure and the spam protection at sign-in: fonts, images and learning content are part of the app and are not loaded from elsewhere.

If you sign in with Google, Apple or Microsoft, that provider learns that you are signing in to Zeitlernen. We receive your email address, your name and, where available, your profile picture from them. You are free to use a password instead.

Beyond this we share data only if you have consented or if we are legally obliged to. We rule out selling data or passing it on for advertising purposes.

Account, learning and school data are held in Switzerland. Some providers process data outside Switzerland: Cloudflare, Resend and Adobe in the USA, Google Fonts in Ireland. For transfers to countries without an adequate level of protection we ensure safeguards:

• EU Standard Contractual Clauses, supplemented by the Swiss amendments recognised by the FDPIC
• Adequacy decisions of the Swiss Federal Council or the EU Commission, where available for the destination country

We retain personal data only for as long as it is necessary for the purposes described in this policy or required by law.

• Account data is kept for as long as your account exists. If you delete it in your settings, your account and the data attached to it, such as child profiles and learning progress, are removed.
• School data is deleted or anonymised when the school deletes it or the collaboration ends, unless the school instructs otherwise. After the collaboration ends, deletion takes place within 30 days; backups are then overwritten in the ordinary cycle.
• If you unsubscribe from the newsletter, we keep your email address on a suppression list. That is the only way to make sure you receive no further newsletters.
• Technical data such as access times, the truncated IP prefix and newsletter metrics is kept only as long as it is needed for security and evaluation.

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or alteration. These include encrypted transmission, access rules enforced directly in the database so that each account sees only its own data, and spam protection at sign-in.

Under the GDPR and the Swiss FADP you have the following rights:

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure of your personal data
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand

You can exercise most of these rights directly in your account settings: change or clear profile details, unsubscribe from the newsletter, and delete your account along with the associated data. For anything else, an email to support@zeitlernen.app is enough.

How to delete your account

You have the right to lodge a complaint with a supervisory authority.

In Switzerland, the Federal Data Protection and Information Commissioner (FDPIC) is responsible.

EU users may contact their local data protection supervisory authority.

We update this Privacy Policy when the service or the legal situation changes. The version published here is the one that applies; the date of the last update appears at the top. In the event of significant changes we will also inform you in the app or by email.

If you have questions about data protection or wish to exercise your rights, contact us at:

support@zeitlernen.app