This policy explains how [legal name] ("Kleoma", "we", "us") handles personal data when you use the Kleoma mobile app (the "app") and the website kleoma.com (the "website"). We wrote it to be read. If something is unclear, write to us at privacy@kleoma.com.
Who is responsible for your data
The controller of your personal data is:
- Company: [legal name] ([legal form])
- Address: [address], [country]
- Registration number: [registration number]
- Privacy questions and requests: privacy@kleoma.com
We have not appointed a data protection officer. [VERIFY: confirm with a lawyer whether one is required.]
The short version
- You create an account with an email address, Google or Facebook. We store your language choices, your learning progress and your daily-practice flame, so the app can pick up where you left off on any device.
- We do not sell your data, and we do not use your learning data for advertising.
- If the app shows ads, Google AdMob may use an advertising identifier. In the EEA, the UK and Switzerland this happens only after you agree in a consent form, and on iPhone only if you allow tracking. You can change this at any time.
- The website uses no cookies and no analytics.
- You can export or delete your data in the app (Settings, Data and privacy), or by writing to us.
What we collect and why
| Data | What it includes | Why we use it | Legal basis (GDPR) | How long |
|---|---|---|---|---|
| Account data | Email address; the sign-in method (email, Google or Facebook); an internal user ID. If you sign in with Google or Facebook we receive the name and email that provider shares. If you use email and password, the password is handled by Firebase Authentication and we never see it. | To create and secure your account and let you sign in. | Contract (Art. 6(1)(b)) | Until you delete your account |
| Profile and settings | Native and target language, start level, daily goal, playback and notification settings, your consent choices and the versions you accepted. | To personalise the app and to prove which terms you accepted. | Contract; legal obligation to demonstrate consent (Art. 6(1)(b), (c)) | Until you delete your account |
| Learning progress | For each word or phrase: how often you heard it, when you last heard it, how well it seems to be remembered, whether you marked it known; where you stopped in a session or dialogue; how long you listened. | To choose what you hear next, to resume where you left off, and to sync between your devices. | Contract | Until you delete your account |
| Daily practice flame | Days you practised, your current and best run, the shields and repairs you used, milestones reached. | To show your progress and keep the flame. | Contract | Until you delete your account |
| Purchases (only if the app offers paid features) | Which subscription or purchase you hold and whether it is active. Apple or Google take the payment; we never receive your card details. RevenueCat manages entitlements for us. | To give you the features you paid for and to restore purchases. | Contract; legal obligations (accounting) | As long as needed for the contract and legal retention periods |
| Advertising data (only if ads are shown) | Advertising identifier, IP address, device information and ad interactions, handled by Google AdMob. | To show ads and measure them. Personalised ads only with your consent. | Consent (Art. 6(1)(a)); in some regions legitimate interest for non-personalised ads | Set by Google, see Google's policy |
| Technical and security data | IP address, app version, device type and operating system, request logs and error information. | To keep the service running and secure, to find and fix faults, and to stop abuse. | Legitimate interests (Art. 6(1)(f)) | Server logs about 30 days |
| Support messages | Your email address and what you write to us. | To answer you. | Contract; legitimate interests | Until the request is closed, then up to 12 months. [VERIFY: choose the period.] |
| Optional analytics and marketing choices | Whether you agreed to analytics or marketing messages when you accepted the terms. | To respect your choice. We only run analytics or send marketing if you agreed. | Consent | Until you change your choice or delete your account |
[VERIFY: today the app records an analytics choice but this document must say exactly which analytics tool, if any, is used. If none is used, say so here and remove the row.]
[VERIFY: if marketing emails or push notifications are introduced, add the provider and the opt-in flow before launch.]
Advertising and tracking
If the app shows ads, they are provided by Google AdMob.
- Consent form. In the EEA, the UK and Switzerland, Google's consent form (the Google User Messaging Platform) asks you whether ads may be personalised. You can open it again in Settings, Privacy options.
- iPhone. Apple asks whether the app may track you across other companies' apps and websites. If you say no, the app does not receive your advertising identifier and shows non-personalised ads.
- What is never used for ads. Your learning progress, your language choices and your messages to us are not shared with advertisers.
Who receives your data
We use service providers (processors) who handle data only on our instructions. The current list, with their purpose and location, is on the subprocessors page. The main ones are Google (sign-in, database, hosting, ads), Cloudflare (delivery and protection of the service), RevenueCat (purchases), and Apple and Google for the app stores and payments.
We disclose data to authorities only when the law requires it. If we ever merge with or are acquired by another company, personal data may pass to it, and we will tell you before it is governed by a different policy.
Where your data is stored and transfers outside the EEA
Our own database and file storage are in the European Union (Google Cloud, Warsaw, Poland). Some providers also process data outside the EEA, for example in the United States. Where that happens we rely on an adequacy decision (for example the EU-US Data Privacy Framework for certified companies) or on the European Commission's Standard Contractual Clauses. [VERIFY: confirm the transfer mechanism for each provider on the subprocessors page and the location of Firebase Authentication and Cloud Firestore data.] You can ask us for a copy of the safeguards at privacy@kleoma.com.
How long we keep your data
- Account, profile, progress and flame data: until you delete your account. We then delete it (see Data deletion).
- Server logs: about 30 days.
- Backups: our database is backed up automatically. Deleted data disappears from backups when they expire. [VERIFY: confirm the backup retention period, state it here.]
- Purchase records: kept by Apple, Google and RevenueCat under their own policies and by us where tax or accounting law requires it.
- Consent records: kept as long as your account exists, so we can show what you agreed to.
Your rights
Under the GDPR you have the right to:
- access the data we hold about you and receive a copy;
- have it corrected if it is wrong;
- have it deleted ("right to be forgotten");
- restrict or object to certain processing, in particular processing based on our legitimate interests;
- receive your data in a portable format;
- withdraw consent at any time, without affecting what happened before.
The quickest way is in the app: Settings, Data and privacy, where you can export or delete your data. You can also write to privacy@kleoma.com. We may ask you to confirm it is you. We answer within one month.
You may complain to a data protection authority. Ours is [supervisory authority]; you can also contact the authority where you live or work.
Children
Kleoma is not for children. You must be at least 16 years old to use the app, and the app asks you to confirm it. We do not knowingly collect data from younger people. If you think a child has given us data, write to privacy@kleoma.com and we will delete it.
Automated decisions
The app chooses which words and phrases to play next from your learning progress. This is personalisation of the study order. It has no legal or similarly significant effect on you, and you can always pick content yourself.
Security
We protect data with encryption in transit (HTTPS), access controls, separate credentials for each service, and network protection. No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the authority as the law requires.
California and other US states
We do not sell personal information. If personalised ads are shown, some US state laws call the use of an advertising identifier "sharing" for cross-context behavioural advertising; you can switch this off in Settings, Privacy options, or in your device settings. You may ask to access, correct or delete your data at privacy@kleoma.com, and we will not treat you differently for doing so. [VERIFY: have a lawyer confirm which US state notices are needed at launch.]
Changes to this policy
When we change this policy in a way that matters to you, we update the version and date at the top and, where the law requires it, ask you to accept it again in the app. Older versions are available from privacy@kleoma.com.
Contact
- [legal name], [address], [country]
- Email: privacy@kleoma.com
Version history
| Version | Date | What changed |
|---|---|---|
| 2026-10 | 2026-10-29 | First version (draft). |