Privacy Policy

Last updated: November 12, 2026

This privacy policy applies to the “Gabbies” app (iOS and Android) and to this website. It explains which personal data we process, for what purpose, on what legal basis, and what rights you have.

1. Controller

Patrick Wiesenthal
Doerpfeldstrasse 3a
33739 Bielefeld
Germany
Email: patrickwiesenthal@gmx.de

You can reach us at this email address with any questions about data protection.

2. The key points in brief

• Gabbies shows no ads and uses no tracking and no analytics services.
• Your account and learning progress are stored with Supabase in the EU (Frankfurt). The AI features run on Microsoft Azure in an EU region.
• Voice recordings are processed for recognition and scoring and are not stored.
• All data is linked to your account. You can remove it with “Profile → Delete account.”

3. This website

Hosting and server logs

The website is hosted by Vercel. When you open a page, the provider processes technically necessary data in server logs: IP address, date and time, the address requested, the amount of data transferred, the referring page, and information about your browser and operating system. This is necessary to deliver the page and to detect disruptions and misuse. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).

No cookies, no analytics

The website sets no cookies and embeds no analytics, advertising, or social media services and no external fonts. When you choose the language of the site, your browser remembers this choice in the local storage of your device; it is not transmitted to us. This is necessary to show you the site in the language you chose (Section 25(2) no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act).

Free tools

The tools on this website do all their calculations in your browser. What you enter does not leave your device.

Contact by email

When you write to us, we process your email address and the content of your message in order to answer your request (Art. 6(1)(b) or (f) GDPR). We delete the correspondence as soon as it is no longer needed and no retention obligations prevent this.

4. The app

4.1 Account and sign-in

To use the app, you create an account. In doing so, we process your email address, a randomly assigned user ID, and your password in encrypted form (as a hash).

Purpose: providing your account and keeping your progress across devices. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

4.2 Learning progress

So that the app works, we store the following with your account: the languages you chose and your app language, interests, level and placement test results, your cards and their ratings, study times, texts you have read and questions you have answered, your Gabbies and eggs, and the conversation minutes you have used. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

4.3 Your own content and AI features

Texts you import and messages you write or speak in role-plays are stored with your account so that you can open them again. For AI answers, word explanations, and generating texts, we send the content needed in each case (for example the conversation history, the tapped word with its sentence, or your imported text) to Microsoft Azure OpenAI in an EU region. Your email address is not sent along. According to Microsoft, this content is not used to train the models; Microsoft may retain content for a short time in order to detect abuse.

Please do not enter any sensitive data about yourself or others in conversations and imported texts. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

4.4 Voice recordings and microphone

When you speak in a role-play or use pronunciation scoring, the app accesses the microphone with your permission. The recording is transmitted to Microsoft Azure AI Speech in an EU region, converted into text there and, where applicable, scored. The recording itself is not stored; only the recognized text is stored as part of your conversation and, where applicable, the result of the scoring. You can withdraw the microphone permission at any time in your device settings; you can then still type. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

If you have a word or a reply in a conversation read aloud to you, the text to be read is sent to Azure AI Speech and returned as audio.

4.5 Subscriptions and purchases

You take out subscriptions through the Apple App Store or Google Play. The respective store handles the payment under its own responsibility; we do not receive any payment data such as card numbers. To unlock your subscription in the app, we use RevenueCat. RevenueCat processes your user ID, the product purchased, the time and status of the subscription (for example active, in trial, canceled, expired), and technical details of the purchase from the store, and reports the status to us. We store the resulting plan and the purchase events with your account.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR); where we have to retain billing records, a legal obligation (Art. 6(1)(c) GDPR).

4.6 Reminders

If you turn on reminders, the app schedules local notifications directly on your device. No data is sent to us or to a notification service for this. You can turn reminders off at any time in your profile or in your device settings.

4.7 No ads, no tracking, no analytics

The app contains no ads, no advertising identifiers, and no analytics or tracking services. We do not create profiles for advertising purposes and do not sell data.

5. Services and recipients

We use the following service providers. Where they process data on our behalf as processors, we have concluded data processing agreements with them in accordance with Art. 28 GDPR.

Beyond this, we pass on data only if we are legally obliged to do so.

6. Transfers to countries outside the EU

We process the content of the app in the EU. Some providers are based in the USA (RevenueCat, Vercel, and the parent companies of Supabase, Microsoft, Apple, and Google), so access from there cannot be ruled out. We base such transfers on an adequacy decision of the European Commission (EU-US Data Privacy Framework) where the provider is certified under it, and otherwise on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

7. Retention periods

• Account, learning progress, your own content: for as long as your account exists. They are removed when you delete your account.
• Voice recordings: are not stored.
• Purchase status: for as long as your account exists; billing records beyond that only where statutory retention obligations require it.
• Server logs of the website: only for a short time, as specified by the hosting provider.
• Emails to support: until your request has been resolved, and after that only within the scope of statutory retention obligations.

8. Deleting your account and data

You can delete your account yourself at any time: in the app under Profile → Delete account. This permanently removes your account and all data linked to it – learning progress, cards, imported texts, conversations, and Gabbies. Alternatively, an email from the address of your account to patrickwiesenthal@gmx.de is enough.

This does not automatically end an active subscription; please cancel it in your store account settings.

9. Your rights

Under the GDPR, you have the right to

• access the data stored about you (Art. 15),
• have inaccurate data rectified (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing that is based on legitimate interests (Art. 21),
• withdraw any consent you have given, with effect for the future (Art. 7(3)).

To do so, simply send us an email. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example where you live. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia).

10. Necessity and automated decisions

Without an account and the data listed above, we cannot provide the app. There is no automated decision-making with legal effect and no profiling within the meaning of Art. 22 GDPR. The assessment of your language level serves solely to select suitable learning content.

11. Minors

Gabbies is aimed at adults and older teens. The app is not intended for children under 16. If we learn that a younger child has created an account without parental consent, we will delete it.

12. Changes

We update this policy when the app, the services we use, or the legal situation changes. You will always find the current version on this page; we will let you know in the app about significant changes.