1. Controller and contact
The controller under the General Data Protection Regulation (GDPR) is the owner of Linota, a sole proprietorship (Einzelunternehmen), named with full contact details in the Legal notice.
Langer Anger 18169115 HeidelbergGermanyEmail: help@linota.de · Data-protection contact: privacy@linota.de
2. The short version
- Linota saves text only when you deliberately select, type, or import it.
- The Linota extension for Chrome does not collect page content in the background. It sends only text you choose to save. Language Radar scans visible text on your device only when you start it.
- AI providers receive learning text only when an AI feature needs it and you request that feature.
- Linota does not sell personal data, build advertising profiles, or use private learning data for advertising.
- You can export eligible data, delete individual items, disconnect browsers, choose automatic learning-data deletion, or permanently delete your account.
3. Processing activities and legal bases
| Data | Purpose and legal basis | Typical retention |
|---|---|---|
| Email address, account ID, optional name/username, session and preferences | Create, authenticate, secure, and personalise your account; perform the user agreement (Art. 6(1)(b) GDPR). | Until account deletion, except records that must be retained by law or briefly remain in provider backups. |
| Weekly learning summary (Basic and Pro): email address, optional name, last week’s counts of saved words, study notes, reviews and learned items, and your five oldest words still in learning with their saved meanings | Send the weekly summary included in paid plans. It is on by default for Basic and Pro; you can turn it off at any time in Settings or with the one-click unsubscribe link in every summary, at no cost other than basic transmission costs (Art. 6(1)(b) GDPR; for any promotional element, § 7(3) UWG and Art. 6(1)(f) GDPR). Delivered by the email provider listed under Recipients, without open or click tracking. | The email content is not stored by Linota. A delivery record (week, status, provider message ID) is kept until account deletion to prevent duplicate sends; your opt-out and its date are kept as long as your account exists. |
| Selected or typed text, optional context/source, imported translations and notes, study notes, cards, review history, grammar favorites, writing responses and reports, custom-reading topics, vocabulary snapshots, saved articles, listening episodes (transcripts, timings, their audio files, and which saved words each episode used), and missions (the game prepared for you, the replies you wrote or spoke as text, their grading, and the characters' voiced lines) | Provide Knowledge, AI study notes, Practice, personalised readings, writing feedback, exports, and synchronization; perform the user agreement (Art. 6(1)(b)). | Until you delete it, delete the account, or your 30/90/365-day automatic-retention setting removes eligible learning data. “Never” keeps it until deletion. |
| Prepare a situation: the ready-made situation you chose, the level, the preparation written for it and, in its With your words part, which of your saved words fit the situation and a sentence for each. Preparations requested before October 2026 may also hold a description you wrote then, or only a one-way fingerprint of it where it was classified as health or legal. | Write the preparation you request (Art. 6(1)(b)). For a description written before October 2026 that held health or other special-category details: the explicit consent you gave when you sent it (Art. 9(2)(a)); you can delete those preparations at any time, or contact us to withdraw consent. Withdrawal does not affect earlier lawful processing. | Until you delete the preparation, delete all learning data or the account, or your automatic-retention setting removes it. |
| Sharing a word collection with a friend (Pro): the collection, its words and meanings, who added each word, your display name and how many of its words each of you has learned; a game you play together in it (Blitz or Quick quiz: who invited whom, when each of you joined, the words it used, and both results with the words each of you missed); an invitation (Share link: a link whose one-way hash is kept; Send invite: the account it was sent to, or a keyed one-way hash of the email address you typed, never the address itself) | Let you and the friend you invite learn the same words together (Art. 6(1)(b) GDPR for you; for the person you invite, Art. 6(1)(f): delivering the invitation you asked us to send). When you send an invitation to an email address, Linota uses the address once to find the Linota account it belongs to: that person then finds the invitation in the app, with a notification if they turned that on. If the address has no Linota account, Linota sends it one invitation email through Resend, at most once per address and collection. You are always told the same, so you never learn whether an address has a Linota account. The friend sees your display name; you see theirs. If you report a shared collection or block someone, Linota keeps the report (the reason, your note, both accounts and a copy of the collection's name and words at that moment) for 12 months to review it and act on it (Art. 6(1)(f) GDPR: keeping shared content safe), without telling the other person who reported it; a block is kept until you undo it or either account is deleted, and a deleted account's link to a report is removed. | An invitation works for 7 days; one that is declined is deleted at once, one that nobody accepted 30 days after it ran out, with its hashed address. The shared collection: until it is deleted, or until the friend leaves or is removed (the words they added leave with them). A game played together: 90 days, or until the collection or either account is deleted. |
| Notifications on your iPhone, only if you turn them on in the app: a push address for this device (an Expo push token), the platform, your app language, your phone's time zone, your daily reminder time and which notifications you chose (invitations and shared collections, review cards due, when something is ready) | Send the notifications you chose (Art. 6(1)(b) GDPR): an invitation to a shared collection or to a game in one, a friend's result in a game you had left, and the news that a friend learned all the words of a collection you share; the daily review reminder with the number of cards due; and a note that an episode, a reading, a word pack, a preparation or several study notes you asked for are ready. A notification carries only its text and which screen to open; work about your health or a legal matter is announced without its title. Notifications are sent through Expo and Apple's push service (section 6). The app asks before it turns them on, and you can turn them off at any time in Settings in the app or in your iPhone's settings. | Until you turn notifications off, sign out or delete the account, or Apple says the address is no longer valid. Which day's review reminder was sent: three days. Finished AI work is noted for one day, so the app can still show it if it was closed while waiting. |
| For plans bought in the iPhone app: the App Store transaction IDs, product, environment, subscription status, renewal setting and the dates the paid period and any grace period end | Provide the plan bought in the app and keep it in step with Apple's records (Art. 6(1)(b)). When you buy, the app passes Apple your internal Linota account ID so Apple's records name your account; Linota receives no payment details. Apple processes the purchase and payment as an independent controller under its own privacy policy. After the account is deleted, the transaction IDs are kept so that one purchase cannot add its credits to a second account (Art. 6(1)(f) GDPR: preventing abuse of paid credits). | For the account lifetime. Deleting the Linota account removes these records, except each purchase's transaction ID with, for a subscription, the month whose credits the account had and whether they were the free trial's; these name no account and are kept. Deleting the account does not cancel the subscription, which only you can cancel in your Apple account settings. |
| Cancellation and withdrawal declarations: name, email, contract, type, reason or note, requested end date, time received, and what was done (for example a refund) | Receive, carry out and confirm your declaration, and be able to prove it (Art. 6(1)(c) with § 312k and § 356a BGB; Art. 6(1)(f): establishing and defending legal claims). | Three years after receipt, then deleted automatically. |
| Contact form: your name if you give it, email address, the topic you chose and your message; your IP address for rate limiting | Answer your request (Art. 6(1)(b) GDPR for a question about your contract or before entering one; otherwise Art. 6(1)(f): answering the people who write to us). The IP address protects the form from abuse (Art. 6(1)(f)). The message is sent to Linota's mailbox as an email through Resend and is not stored in Linota's database. | Kept in the mailbox as long as needed to answer your request, and longer only where business letters must be kept by law (up to six years under § 257 HGB and § 147 AO). The rate-limit identifier is HMAC-hashed and expires with its security window. |
| Report a problem in the iPhone app: your message, a screenshot if you add one, the technical details shown before you send (app version and build, the app update running, device type, iOS version, app language, plan and the screen you came from), your account ID and the email address of your account | Find and fix the problem and answer you (Art. 6(1)(b) GDPR for a problem with the service you use; otherwise Art. 6(1)(f): a working service and answering the people who write to us). The report is sent to Linota's mailbox as an email through Resend, with your account's email address to reply to, and is not stored in the app's database. | Kept in the mailbox as long as needed to fix the problem and answer you, and longer only where business letters must be kept by law (up to six years under § 257 HGB and § 147 AO). The rate-limit identifier is HMAC-hashed and expires with its security window. |
| Connected extension device: the browser's name (such as Chrome on macOS), a hashed device token, when it was connected and last active; the one-time connection code, stored only as a hash | Connect the Linota extension for Chrome to your account and keep that connection secure (Art. 6(1)(b), and Art. 6(1)(f): preventing unauthorized access). You create the code in the iPhone app; it works once and expires after 10 minutes. The extension keeps the device token in its own storage on your computer; the token does not expire, and disconnecting the browser in the app (Settings, Browser extension) or deleting the account revokes it at once. | Until you disconnect the browser or delete the account; expired connection codes are removed regularly. |
| Radar match identifier, website domain, match count/date, optional recognised status | Show reading progress after an explicit Radar scan (Art. 6(1)(b)). Full URLs, page titles, unmatched words, and the complete page text are not stored by Linota for Radar. | Until the related saved item or account is deleted, or an automatic-retention setting removes it. |
| Free starter credits and sign-up checks: a keyed one-way hash (HMAC) of your email address in a standard form (for example without dots or a "+" part in a Gmail address), never the address itself; the domain of the address you sign up with | Give the Free plan's starter credits once per mailbox and prevent their abuse with many accounts (Art. 6(1)(f) GDPR: preventing abuse of a free offer). A new account whose mailbox already had them starts with no starter credits. Addresses from temporary inbox services cannot be used to create an account; the domain is checked against a list when you ask for a sign-in code and is not stored for this. | The hash is kept for 12 months after the account is deleted, so the starter credits are not given again within that time, and is then deleted; it does not reveal the address. |
| Request/IP-derived abuse signals, rate-limit buckets, error and security logs | Protect accounts, diagnose failures, enforce limits, and defend legal claims (Art. 6(1)(f): secure and sustainable operation). | Rate-limit identifiers are HMAC-hashed and expire with their short security window; hosting and security logs are kept by the hosting providers for their standard retention periods. |
| Public-page visit data: requested public path, referrer, approximate region, browser/device class and timestamp | Measure whether public product information is useful (Art. 6(1)(f): privacy-minimized audience measurement). Vercel Web Analytics is restricted to a fixed list of public pages; query strings, account pages, sign-in, callbacks, saved words, notes, Practice, settings and admin pages are excluded. | Aggregated under Vercel's privacy-preserving analytics process. Linota does not set advertising or analytics cookies for this measurement. |
| Crash reports from the iPhone app: the error and where in the code it happened, the app and system version, the device model, and the screens and server requests just before it (addresses without their query) | Find and fix crashes (Art. 6(1)(f): a working, secure service). Sent to Sentry, Linota's crash-reporting provider (see Service providers). No account, name, email, IP address, typed or saved text, or screenshots are included. | Kept by Sentry for 30 days, then deleted. |
| Feature usage of a signed-in account: which screens, pages and games are opened, a round's score, whether the guided tour was finished, a purchase sheet opened, the platform (iPhone or web) and the app version; when you try to open a website that Linota's browser does not open, that website's domain (never the page address) | Learn which features learners use so they can be improved, simplified or removed. Collected only if you turn on Share feature usage in Settings (consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG); until then nothing is collected. Kept in Linota's own database only; never shared, sold or used for advertising, and never containing text you typed or saved. You can withdraw your consent at any time in Settings, which also deletes what was kept. | 13 months, then deleted automatically; deleted with the account. |
| Anonymous feature totals: one count per day for each feature used (for example a study note created or a mission started) and the platform it was used on (iPhone app, website or other) | Know which features are used, so they can be maintained and improved. The count is added on our server inside the request your device already sends for the feature; nothing is read from or stored on your device for it. Only the daily totals are kept, without any account, user ID, IP address, device identifier or time of day, so they cannot be linked to you or your device. To the extent they are personal data at all, the basis is our legitimate interest (Art. 6(1)(f) GDPR). | Kept as totals, since nothing in them relates to a person. |
| Report a mistake: which study note, reading, episode, preparation, writing feedback or mission you reported, the reason you chose and the comment you wrote, if any, and the platform | Check and correct AI content and remove anything offensive; notes and readings, many of which are shared between learners (Art. 6(1)(f): accurate learning content). Reports are read by Linota only and are never shown to other learners. | Until the account is deleted. |
4. AI-generated learning help
This section explains which learning features use automated generation. The iPhone app asks for your permission before these features first send anything to OpenAI, and you can change your answer at any time in Settings in the app (Profile, Settings, Privacy and data); without it, nothing is sent to OpenAI and these features stay unavailable, while dictionary meanings, review cards, games and reading keep working. When you request a full study note, the selected text and the minimum useful context are sent to OpenAI. When you request an addition to a note, we send the selected text, the relevant note details, and the type of addition you chose. When you request a writing task, relevant saved-word targets are sent; your response is sent only when you request a report. For Custom reading, we send the ready-made topic you chose, reading level, and up to 40 saved vocabulary items with their meanings to OpenAI, without your account identity, source URLs, surrounding page text, or personal-note fields. The generated article and vocabulary snapshot are saved privately, not added to a global shared cache. Reopening a reading and playing its word-finding game do not call OpenAI. When you choose to create Situations, we send up to 300 saved words or short expressions, their base forms and meanings to OpenAI, without your account identity, source URLs, surrounding page text, or personal notes. The first time you open a situation, we send its title and description with up to 24 of its words, base forms and meanings, in the same limited way, to create example sentences. The groups and sentences are saved privately; reopening them does not call OpenAI. For Listening episodes (Pro), we send the chosen interest with a script idea from Linota’s own library, the level and up to 10 saved words or short expressions with their meanings to OpenAI to write the script, without your account identity, source URLs, surrounding page text or personal notes. Each line of the finished script is then sent to OpenAI’s text-to-speech service to create the audio. When you start a mission, up to twenty of your saved words with their meanings and your chosen level are sent to OpenAI to prepare the game. Each German reply you send in a mission is sent to OpenAI with the current scene to be graded, and the characters’ lines are sent to OpenAI’s text-to-speech service to create their AI-generated voices. If you answer by speaking, your browser’s own speech recognition turns your voice into text; Linota does not receive the audio. The example mission calls no AI while you play: its lines are fixed and its voices were generated with AI in advance, nothing you choose is sent to OpenAI, and its progress is stored only in your browser. The voices are AI-generated, not recordings of real people; this is shown in the player and written into the audio file’s metadata. The transcript, timings and audio are saved privately in Linota’s database and private file storage; replaying an episode does not call OpenAI. To space out repetition, Linota records which saved words each episode used and when. When you tap Prepare me in Prepare a situation, you choose one of Linota's ready-made everyday situations and a level; you do not write a description of your own. A preparation has a shared part and a personal part. For the shared part, the situation's text (Linota's own) and the level are sent to OpenAI to write the preparation, without your account identity. Because the ready-made situations are the same for everyone, the shared part written for one of them at a level is reused for other learners who choose the same situation and level, without a new request to OpenAI; it contains nothing about you. For the personal part, With your words, a separate request sends up to 40 of your saved words or short expressions with their meanings, the situation's text and the level to OpenAI, without your account identity, source URLs, surrounding page text or personal notes, so it can choose the few that fit the situation, often none, and write a sentence for each; if you have no saved words, nothing is sent for this part. The personal part is saved only with your own copy: it is never added to the shared part or shown to anyone else. Your copy is saved privately in your account. Reopening a preparation does not call OpenAI. You can delete a preparation on its own; deleting all learning data, your automatic-retention setting or deleting the account also removes eligible preparation records, including records of failed attempts. Custom readings and listening episodes are written for the ready-made topics you choose. Writing a situation or topic of your own is not offered to learners, so that these requests never carry health, legal or other sensitive details about you or other people. The provider processes submitted content under the applicable service and data-processing terms. Outputs can be wrong and are not used to make legal or similarly significant decisions about you.
For individual words, Linota first checks its shared language cache. A reusable cache entry contains standard language facts and a de-identified learning note, not your identity, email, source page, private surrounding context, or private note. This avoids repeated AI processing. Do not enter health details, other special-category personal data, confidential material or another person's data in any text you send for feedback, such as mission replies or writing practice answers.
5. Recommendations, community information, and external sources
Your Next Read sends a small number of globally recognised dictionary words (not your identity, private notes, page history, or original context) to Wikimedia services to find a suitable article. When you tap a noun or a name, Linota’s server may ask German Wikipedia and Wikidata (Wikimedia) whether there is an article about it, to offer a link; only that word is sent, never your text, your saved words or your identity. Reading room uses Linota’s prepared library of short readings; displaying one does not send your vocabulary to Wikimedia. Opening an external article sends your browser to that provider under its own privacy terms.
Community Pulse uses aggregate counts for recognised dictionary entries. It does not reveal who saved a word. We suppress or avoid personal rankings and do not expose private text.
6. Recipients, processors, and international transfers
Linota uses service providers for hosting and analytics (Vercel), authentication/database services (Supabase), requested AI generation (OpenAI), crash reporting (Sentry), email (Supabase Auth for sign-in links; Resend for plan, cancellation and withdrawal confirmations, the weekly summary, messages sent through the contact form, problem reports and reports of shared collections from the app, and one invitation to a shared collection sent to an address without a Linota account), push notifications to the iPhone app if you turn them on (Expo, by 650 Industries, Inc., USA, which passes them to Apple's push service), and public reading data (Wikimedia). Plans bought in the iPhone app are sold and billed by Apple through the App Store, also as an independent controller. The current list and purpose of each provider is on the Service providers page.
Some providers may process data outside the European Economic Area. Where required, Linota relies on an adequacy decision, approved standard contractual clauses, and appropriate supplementary safeguards.
7. Browser storage and cookies
Linota uses essential authentication cookies to keep you signed in and local browser storage, including in the website screens the iPhone app shows, for your theme, visual motif, extension connection, local Radar cache, and practice preferences such as which things you explored in Places. These are required for features you request. We do not use advertising cookies. Public-page analytics is configured without advertising identifiers or analytics cookies. If a future feature requires consent, it will remain off until you choose it, and withdrawing consent will be as easy as giving it.
The Linota extension for Chrome is installed from the Chrome Web Store and connected from the iPhone app. Its own storage in your browser holds the device token that connects it to your account, whether sending saved words to your account is on (connecting turns it on; you can turn it off in the extension), saved selections still waiting to be sent, the latest result, and for Pro a short-lived copy of your saved words for Radar. It reads a page only when you save a selection, use its keyboard shortcut or start Radar, and it does not work in private windows or in form fields. Removing the extension deletes its storage.
The extension keeps a temporary reading-session summary for pages where you use Linota: the website origin, up to 40 recent selections, available meanings and study-note summaries, and approximate time while the page is visible and focused. Session timing is not sent to Linota or third parties and does not inspect keystrokes, pointer activity, or page text. The summary is removed when the tab or browser closes, when cleared, or after 12 hours without session activity; at most 12 tab sessions are retained. The separate unsynced selection queue and latest-selection preview can remain in local extension storage until synced, replaced, or removed.
Radar also matches a small common-word dictionary locally to offer up to three suggestions. Unchosen suggestions and their page context are not sent back to Linota. Choosing to save or analyse one sends that selected word and the same optional source information as an ordinary saved selection. A study-note request follows the processing described in section 4.
Say it yourself can use your browser’s built-in speech recognition when you tap Speak. Your browser, not Linota, turns your voice into text, and the browser vendor may process the audio on its own servers (for example Google in Chrome or Apple in Safari) under its own privacy terms. In Say it yourself and Situation practice, Linota never receives the audio or the recognised text; the text stays in the practice box on your device and is not saved. In a mission, the recognised text becomes your reply when you send it. The microphone is used only while you are speaking, and you can always type instead.
Listen and Play pronunciation buttons use your browser’s built-in German voice. Some browsers use online voices, which send the German text being read (Linota’s sentence or the word you chose) to the browser vendor; Linota does not receive or store any audio.
8. Your rights
You can contact us using the address in section 1 to exercise your data-protection rights on any plan, including Free. You do not need to buy an export feature. Requests are normally free, and we normally respond within one month; if a lawful extension is needed, we explain it within that period.
Subject to the legal conditions, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time where consent is the basis; this does not affect earlier lawful processing. In the iPhone app, you can change privacy settings and delete the account in Profile, Settings.
You may complain to a data-protection authority. The authority responsible for a Heidelberg-based operator is generally the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg; you may also contact the authority where you live or work.
9. Required and optional data
An email address and the technical account/session data are required to create and synchronize an account. Learning text is optional, but Linota cannot create the requested note or practice card without it. Display name, username, source context, personal notes, and Radar recognition are optional. When you scan an image (Basic and Pro), the text is read on your own device; only the text you then save is stored in your account, never the image. When you open a file (Basic and Pro), only its text is stored, never the file: text files and ebooks are read on your device, and a PDF is sent once to Linota to read its text in memory and is not kept. When you transcribe audio (Pro), your iPhone turns the audio into text with its own on-device speech recognition; the audio never leaves your device, and only the text you save is stored. Your German level and what you are learning German for are asked once and can be changed in Settings; Linota uses them to choose the word of the day, the reading, and the starting level of exercises.
In the iPhone app: Sign in with Apple gives Linota the email address Apple shares (your own or an Apple private relay address), your first name if you share it, and an Apple account identifier, used only to sign you in (Art. 6(1)(b)). Sign in with Google (in the app and on the website) gives Linota the email address of your Google account, your name, the address of your Google profile picture (Linota does not show it) and a Google account identifier, used only to sign you in (Art. 6(1)(b)); if a Linota account already uses that address, you sign in to that account. Your session is kept in the iPhone's keychain. A daily reminder is scheduled on the iPhone itself, and Linota receives no device or notification token, unless you turn on notifications in the app; then Linota sends the reminder, with the number of cards due, as described in section 3. When you speak instead of typing, the iPhone's own speech recognition turns your voice into text; depending on your iPhone's settings, Apple may process the audio on its servers under its own privacy terms, and Linota receives only the text you then send. Translations shown on the iPhone are made by Apple's translation on the device. With Pro, the app keeps a copy of what it last loaded (your words, notes, practice and today's lesson) on the iPhone so it works without a connection; the copy is removed when you sign out or when another account signs in. The in-app browser loads a fixed list of German websites directly from those sites, and a YouTube video plays in YouTube's own player, which loads the video and its subtitles from YouTube; those providers receive your request under their own privacy terms, and the subtitles are kept only on your iPhone. Linota does not carry out solely automated decision-making with legal or similarly significant effects.
10. Children and changes
Linota is only for people aged 16 or older. Please do not use Linota if you are younger; if we learn that an account belongs to someone under 16, we delete it. We will update this notice when processing changes materially and, where required, inform account holders before the change takes effect.
Last updated: 19 October 2026.