Privacy policy

This is a translation for your convenience. Where it differs, the German version applies: switch the site's language to Deutsch to read it.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR; in German, DSGVO) is:

Stanislaw Chirko
13125 Berlin, Deutschland

2. Data collected and purposes of processing

An account is created by the parents; the child has no account of its own. Details of the child are entered by the parents as its legal guardians. We process the following personal data:

Data	Purpose	Legal basis
The family's account: e-mail address; language, time zone; the PIN of the parent area as a hash only. The name and profile picture of the Google account and Google's access tokens are not stored	Sign-in and provision of the service	Art. 6(1)(b) GDPR (performance of a contract)
Details of the child that the parents enter or that arise in practice: name or nickname, avatar, learning state, answers to tasks (including texts the child writes), mistakes, stars and rewards, school grades and class tests (Klassenarbeiten) entered	The core function of the service: practice, revision, forecast	Art. 6(1)(b) GDPR
Sign-in and forms: a counter per IP address of sign-in attempts and of messages sent through the contact form and the request for an invitation. Neither the IP address nor the browser's identification is stored with the sign-in session itself	Security, protection against misuse	Art. 6(1)(f) GDPR (legitimate interest)
Request for an invitation: e-mail address and the language of the page	Handing out invitations during the beta	Art. 6(1)(b) GDPR (steps prior to a contract)
Contact form: name, e-mail address, message	Answering the enquiry	Art. 6(1)(f) GDPR

3. Use of AI services

Most tasks are checked by the application itself, without AI. In two places data leaves our servers and goes to an AI service in the USA — even though we ourselves store only little of it:

Anthropic, PBC (USA) — grades the answers the child writes in its own words. What is transmitted: the task with its criteria, the text the child wrote, and the family's language, in which the summary for the parents is written.
Anthropic, PBC — writes tasks when the parents start this in the parent area. What is transmitted: the topic, the description the parents enter for it, the photo of a textbook page if they take one, and the wording of the tasks that already exist for the topic. The photo is used for that one request only and is not stored by us.
OpenAI (USA) — produces the spoken text of dictations. What is transmitted: the dictation text from the task and a pseudonymous identifier of the account (a hash from which neither a name nor an e-mail address can be read), which the provider requires to detect misuse. Each recording is produced once and then stored with us.

Not transmitted are the child's name, the family's e-mail address, school grades, class tests and the learning state. What the child writes about itself in a free text, and what can be seen on a photographed page, does go along, however: please photograph pages without names and handwritten entries.

Under both providers' terms for their programming interfaces (APIs), the content transmitted is not used to train their models; to detect misuse it may remain stored there for a limited time.

4. Recipients and third countries

We use the following service providers, which process data as part of their service:

Vercel Inc. (USA) — hosting and running the application; the application runs in the Frankfurt am Main region.
Neon, Inc. (USA) — hosting the database; the database is located in the Frankfurt am Main region.
Google Ireland Limited (Gmail) — sending e-mails (invitations, notifications, messages from the contact form).
Google Ireland Limited — sign-in with the Google account.
Anthropic and OpenAI — see section 3.

Where data is transferred to the USA in the process, this is done on the basis of the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

5. Storage periods

Data of the account and the child: until the parents delete the account in the parent area under “Settings”
Sign-in sessions: until sign-out, 180 days at most
Counters of sign-in attempts and of forms sent per IP address: two days at most after the last attempt
The record of what individual AI calls cost (date, kind of call, size, amount): remains after the account is deleted, under an identifier that then no longer belongs to any person; it contains no content
Requests for an invitation: until an invitation is made or the request is declined
Messages from the contact form: only as an e-mail with the operator, not in the application's database

6. Cookies

This website uses only technically necessary cookies: the session cookie after sign-in, the chosen language, access to the parent area after the PIN is entered (20 minutes) and — during sign-in with an invitation — the invite code (one hour at most). They are strictly necessary to provide the service (§ 25(2) TDDDG). No tracking or marketing cookies are used and no advertising is shown.

7. Your rights

Under the GDPR you have the following rights:

Access (Art. 15) to the data stored
Rectification (Art. 16) of inaccurate data
Erasure (Art. 17) — carried out with “Delete account” in the settings of the parent area
Restriction of processing (Art. 18)
Data portability (Art. 20)
Objection (Art. 21) to processing based on legitimate interest
Complaint to a supervisory authority (Art. 77)

To exercise your rights, write to us using the contact form on the Impressum page.

8. Supervisory authority

The competent authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), www.datenschutz-berlin.de.

9. No automated decision-making

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, with legal or similarly significant effect takes place. Gradings of answers and estimated grades are feedback for practice without legal effect.

Last revised: October 2026