Last updated: October 2026. This privacy policy applies to the website vokakitty.nl, to the mobile app “VokaKitty” for Android and to the web app “VokaKitty” that runs in the browser (including on iPhone and iPad). The Android app and the web app are together called the “app”; where they differ, this is stated expressly. This is a translation for convenience; the legally binding version is the German Datenschutzerklärung.
1. Controller
The controller for data processing within the meaning of the General Data Protection Regulation (GDPR) is:
Christian Staehler
Wendelsweg 60
60599 Frankfurt am Main
Germany
Email: info@vokakitty.nl
As matters currently stand there is no statutory obligation to appoint a data protection officer, and none has been appointed.
2. Principles
We process personal data only to the extent necessary to provide a functioning service and the features you ask for. VokaKitty is built for data minimisation: there is no analysis of your usage behaviour, no advertising tracking and no collection of location data. No third-party analytics or crash SDKs are included. No automated decision-making with legal effect within the meaning of Art. 22 GDPR takes place.
3. Visiting this website
3.1 Server log files
When you access the website, the hosting provider automatically stores information transmitted by your browser in server log files: IP address, date and time of access, the URL requested, the volume of data transferred, the referrer URL, browser type and operating system. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in technical operation and IT security). The host’s access logs are deleted or anonymised after roughly eight weeks (IONOS standard retention).
3.2 Hosting
The website, the web app and the app’s server component are operated at IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. The provider processes the data named above exclusively on our behalf; a data processing agreement under Art. 28 GDPR is in place with IONOS (IONOS DPA version 1.3, as of 03/2026). Processing takes place in a member state of the EU or the EEA; transfers to third countries occur only where necessary to provide the service, and then under the conditions of Art. 44 et seq. GDPR. IONOS is certified to ISO 27001 and engages sub-processors on the basis of a general authorisation with a right to object.
3.3 Cookies
As delivered, the website sets only technically necessary cookies (for example for the comment function or when signing in to the WordPress backend). No cookies are set for analytics or marketing purposes. The legal basis for technically necessary cookies is section 25(2) TDDDG in conjunction with Art. 6(1)(f) GDPR.
4. Using the “VokaKitty” app
4.1 Account and registration
An account is required to use the app. During registration we process: username, email address, password (stored only as a cryptographic hash), date of birth and the language you select, together with the version of the terms you accepted. Alternatively you can sign in via Google (Android app and web app) or Apple (Android app only) (OAuth); in that case we receive an ID from those providers along with the profile details you have released.
The date of birth is collected at registration and serves to verify age (see 4.2). We do not collect a country of origin and do not carry out IP geolocation.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract); with respect to the age information, additionally Art. 6(1)(c) in conjunction with Art. 8 GDPR.
4.2 Minimum age and children
The app can be used from age 4. The date of birth collected at registration serves to verify age. For users under 16, the social and online features – the friends function, sharing pools and the online challenge – are blocked until consent from a parent or guardian under Art. 8 GDPR has been given. Unlocking is controlled by the server through so-called capabilities; the date of birth itself does not drive the interface. Learning with your own word lists is usable independently of this.
If we become aware that the social features have been unlocked for a person under 16 without the required consent, we will block them without delay and delete the data arising from that use. Please send any such information to info@vokakitty.nl.
4.3 Learning content and progress
We process the word lists (pools) and words you create, your learning progress (flashcard box positions, due dates, answer results), your learning settings and game elements such as the streak counter and coins. This data is stored locally – in the Android app in an encrypted database, in the web app in your browser’s storage (see 4.10) – and synchronised with the server so that it is available across several devices and is not lost. Legal basis: Art. 6(1)(b) GDPR.
4.4 Friends and sharing
For the friends function we process your friend code, incoming and outgoing friend requests, your friends list and your block list. Other users are shown only your user ID and username – never your email address, date of birth, coins, streak or settings. Legal basis: Art. 6(1)(b) GDPR.
4.5 Online challenge
In the online challenge we process match data (participants, rounds, results, scores). It is visible to both participants together with the match history. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). The app does not offer a chat or messaging function.
4.6 Push notifications (Firebase Cloud Messaging, Android app only)
For push notifications (challenge invitations, social events, shared pools, optional learning reminders) we use Firebase Cloud Messaging (FCM) from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. A device token is transmitted to Google and stored there. The content of the notifications is minimised (only the event type, the ID concerned and the username of the account that triggered it) – no vocabulary content, pool names, email addresses or scores. Transfer to the USA cannot be ruled out; Google relies on the EU standard contractual clauses or the EU-US Data Privacy Framework.
The legal basis for transaction-related notifications is Art. 6(1)(b) GDPR. Learning and streak reminders are expressly opt-in (Art. 6(1)(a) GDPR) and can be switched off at any time in the app settings. You can also disable push notifications entirely at operating system level. The web app does not use Firebase Cloud Messaging (see 4.10).
4.7 AI features
Some optional features use an external language model: AI cloze texts in practice mode D (single sentences and short stories), translation suggestions, detection of a word’s language, additional information on words, and the import of word lists from pasted text, from files and from photos. The provider is configured by the server at runtime; currently this is OpenAI, L.L.C. (3180 18th Street, San Francisco, CA 94110, USA). The provider may change – for instance to an OpenAI-compatible provider or to Anthropic; the current details are maintained at this point in the text.
Only what the feature in question needs is transmitted to the provider: the words or word pairs and languages concerned, for stories also the interests you may optionally have entered, and for the import the text you pasted or the photos you selected. Not transmitted are username, user ID, email address, date of birth, pool name, device ID or location. Please note: photos and pasted texts are transmitted as you select them. If they contain names or other personal details (for example on a worksheet), these also reach the provider – crop such parts out beforehand.
The requests run through our own server: the app sends them to the VokaKitty backend, which passes them on to the provider. The provider therefore learns our server’s IP address, not yours, and the access key for the provider never leaves our server. Neither the Android app nor the web app contacts the provider directly. The providers are based in the USA; the transfer is based on the EU standard contractual clauses or – where the recipient is certified – on the EU-US Data Privacy Framework. If you do not use any of these features, no transfer to the provider takes place. Legal basis: Art. 6(1)(b) GDPR (providing the feature you requested).
4.8 Media
Short reward clips (cat videos) are served statically from the web space and cached on the device or in the browser. This involves only the technically necessary connection to the web server (see 3.1).
4.9 Storage on the device (Android app)
Access and refresh tokens are stored in the Android keystore or in encrypted storage, and the local learning database is encrypted with SQLCipher. The database and tokens are excluded from automatic device backup.
4.10 Special features of the web app
The web app is loaded as program files from our server at IONOS and then runs in your browser. Loading it produces the server log files described in 3.1. The web app integrates no analytics, advertising or tracking services and sets no cookies for such purposes.
Storage in your browser: so that the web app also works offline, it stores in your browser: the learning database (pools, words, learning progress, settings) in IndexedDB; access and refresh tokens, a randomly generated device ID and device settings (for example language) in localStorage; and the program files and reward clips in the cache of a service worker. Unlike in the Android app, this data is not additionally encrypted; the browser and operating system shield it from other websites. We do not gain access to any other data in your browser. The legal basis for storing and reading it is section 25(2) no. 2 TDDDG (strictly necessary for the service you requested) in conjunction with Art. 6(1)(b) GDPR.
When you sign out, the access tokens are removed. You remove the remaining locally stored data completely by deleting the web app’s website data in your browser (on iPhone and iPad: Settings → Apps → Safari → Advanced → Website Data). Changes not yet synchronised are lost in the process. On shared devices you should sign out after use and delete the website data.
Signing in with Google: when you tap “Sign in with Google” in the web app, your browser loads a script from Google (accounts.google.com) only at that moment. In doing so, Google Ireland Limited receives your IP address and technical browser data; the sign-in itself is governed by Google’s terms. A transfer to the USA cannot be ruled out (see 6). Without this tap, no Google script is loaded. Signing in with Apple is not available in the web app.
Reminders instead of push: the web app does not send push messages via Google or Apple. It shows learning reminders – only if you allow this in the browser – as a local notification while the web app is open. No data is transmitted to third parties in the process.
Camera and photos: the web app accesses the camera or photo library only when you yourself take or select a photo while importing word lists; for further processing see 4.7. Inviting friends: if you share your friend code, the web app uses your operating system’s share function; we do not learn which route you choose. When someone opens an invitation link, the web app reads the friend code it contains from the address.
5. Recipients and processors
- IONOS SE, Montabaur – operation of the website, web app and app server, as well as mailboxes and mail delivery for system and confirmation emails (processing on our behalf, EU/Germany).
- Google Ireland Limited – push notifications via Firebase Cloud Messaging (Android app only).
- Google Ireland Limited / Apple Inc. – when signing in via “Sign in with Google” (Android app and web app) or “Sign in with Apple” (Android app only).
- OpenAI, L.L.C. (USA) – when using the AI features (see 4.7), exclusively through our server, never directly from your device. The language model provider may be changed.
6. Transfers to third countries
Transfers to the USA (including Google, OpenAI and – when signing in via Apple – Apple) take place on the basis of the EU standard contractual clauses under Art. 46(2)(c) GDPR and, where the recipients are certified, the EU-US Data Privacy Framework under Art. 45 GDPR. A copy of the safeguards is available from the controller.
7. Retention periods
- Account and learning data: until the account is deleted.
- After account deletion: hard deletion of identifying data, irreversible anonymisation of content; then final deletion after the stated period.
- Match data: for as long as the accounts involved exist; on account deletion, as above.
- Server log files: roughly eight weeks.
- Data in the browser (web app): until you delete the website data in the browser; access tokens at most until you sign out.
- Access tokens: 30 days, refresh tokens: 180 days (automatically invalid thereafter).
8. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You may withdraw consent you have given at any time with effect for the future.
You can exercise your right to erasure directly in the app: the entire account via Profile → Delete account (instructions under delete your account), and individual words, pools or learning progress directly in the “Pools” area (instructions under delete words and pools). For anything else, please contact info@vokakitty.nl.
You have the right to lodge a complaint with a supervisory authority. The competent authority is the data protection authority of your place of residence, or the authority responsible for the controller:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI)
Postfach 31 63, 65021 Wiesbaden, Germany
Phone: +49 611 1408-0 · Email: poststelle@datenschutz.hessen.de
9. Obligation to provide data
Providing a username, email address, password and date of birth is necessary in order to enter into the contract. Without this information no account can be created and the app cannot be used.
10. Changes to this privacy policy
We adapt this privacy policy when the data processing changes or legal requirements make it necessary. The current version is always available on this page.