Privacy Policy

1. Introduction

This Privacy Policy informs you, in accordance with Articles 13 and 14 of the EU General Data Protection Regulation (GDPR), which personal data we process when you use the Abece application for iOS and the website abece.app, for which purposes and on which legal bases, to whom we disclose it, how long we keep it, and which rights you have. It applies to the Service as defined in section 3.

2. Controller and contact

The controller within the meaning of Article 4(7) GDPR is:

Engin Deniz Usta
Brennerei 2
82024 Taufkirchen
Germany

Email, also for privacy requests: support@abece.app
Security reports: security@abece.app

We have not appointed a data protection officer, because the statutory requirements for such an appointment are not met.

3. Definitions

In this Privacy Policy, the following terms have the meanings set out below:

• "We", "us" and "our" refer to Engin Deniz Usta as the controller.
• "App" means the Abece application for iOS, including its test versions.
• "Website" means the website abece.app, including its language versions.
• "Service" means the App and the Website together.
• "Account" means the account the App creates for you when you accept the Terms of Use, with or without a sign-in with Apple or Google.
• "User ID" means the random identifier of your Account. It is the only identifier under which we keep your data, and the App shows it in Settings under Account.
• "Personal data" means any information relating to an identified or identifiable natural person (Article 4(1) GDPR).
• "Processing" means any operation performed on personal data, such as collection, storage, use, disclosure or erasure (Article 4(2) GDPR).
• "Processor" means a service provider that processes personal data on our behalf and under our instructions (Article 4(8) and Article 28 GDPR).
• "TDDDG" means the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz).
• "KVKK" means the Turkish Personal Data Protection Law No. 6698.

4. Overview

• You can use Abece without signing in. We do not ask for your name, telephone number, contacts, photos or location.
• You can try a short sample ring first. It runs on your device with words built into the App; for it, the App creates no Account and no identifier and sends nothing to us (section 5.12).
• When you tap Start learning, the App creates an anonymous Account with a random User ID. All your data is kept under this ID.
• We keep your languages, settings and results so that the App can show your level, your streak and your review words.
• The App shows no advertising and does not track you across apps or websites of other companies. Apart from AppsFlyer, which measures our ads and runs only if you agree to Analytics (section 5.14), it contains no third-party analytics. We never sell your data.
• Above Start learning, a line says that tapping it accepts the Terms of Use, with links to them and to this Privacy Policy. When you tap it, the App asks iOS for your age range, using Apple's Declared Age Range feature; in some regions it asks before the sample ring. The App never asks for your date or year of birth. Abece is not available to children under 13. If you are 16 or over, the App asks after your first finished ring, separately, whether you agree to Analytics and to News & offers. Both are off unless you turn them on, and Abece works fully without them. If you are 13 to 15, or if you do not share your age range, the App does not ask, and both stay off (sections 5.12 and 13).
• Only if you agree to Analytics do we link your use of the App to your Account, and only then does the App ask Apple whether you came to Abece through one of our ads on the App Store; Apple then tells us which ad it was, but not who you are (sections 5.5 and 5.11). Only then, too, does the App start AppsFlyer, which tells us which of our ad campaigns, for example on TikTok, Google or the App Store, led to your installation (section 5.14). You can withdraw your consent at any time in Settings (section 6.4).
• Without your consent, our server keeps only when you last used the App and totals that contain no User ID (section 5.5).
• In the App's Settings you can see your User ID, export your data, delete it, and switch Analytics and News & offers on or off.
• The Website sets no cookies. It counts page views with Vercel Web Analytics, which stores nothing on your device and produces aggregated statistics only (section 5.8).

5. Data we process and why

5.1 Your Account

When you tap Start learning (section 5.12), or when you continue with Apple or Google before you have an Account (section 5.4), an anonymous Account with a random User ID is created for you. Before that, the App holds no identifier for you and does not contact our server or RevenueCat. We need the User ID to provide the Service, which cannot function without it. Until you sign in, the Account is tied to this installation of the App: if you delete the App, reset your device or change devices, the App starts over with a new Account, and you cannot get your progress back in the App. An Account that is no longer used is deleted after 24 months (section 5.5).

5.2 Learning data and settings

We process the languages you speak and learn, the level you chose, the language of the clues, whether clues are read aloud, and your results: the rings you play, the answers you type, which words you solved, passed or missed, the times, and your time zone. From these we determine your level (A1 to C1), your streak and the words due for review. Some settings, such as the App language, sound and haptics, remain on your device and are never transmitted to us.

5.3 Clue reports

If you report a clue, we store the clue, the reason you selected and your User ID, so that we can correct the clue.

5.4 Signing in with Apple or Google (optional)

You may continue with Apple or Google to keep your progress across devices; your User ID remains the same. If you do so before you have an Account, the App first asks for your age range (section 5.12), then creates your Account, and the line "By continuing, you accept the Terms of Use." on that screen is your acceptance of the Terms of Use. If you already have an Account and the Terms of Use have changed since you last accepted them, the App shows you the changed version on a separate screen and asks for your acceptance there. The sign-in screen says: "We only use your email address. We never use your name or photo." With Apple, we receive an email address only: that of your Apple account or, if you choose to hide it, a forwarding address created by Apple. We do not request your name from Apple. With Google, Google shares your email address, your name and a link to your profile picture with our sign-in provider, Google Firebase, which stores them on our behalf; we never use the name or the picture. We use only the email address: to find your Account when you contact us, to send you your data at your request, and to send you notices about the Service and the Terms of Use for which the law requires a durable medium (section 25.1 of the Terms of Use). If the Apple or Google account already holds Abece progress, the progress of your anonymous Account is transferred to it, the anonymous Account is deleted, and a record of the transfer is kept with the Account.

5.5 When you last used Abece, and usage statistics

For every Account. Our server keeps the date on which you last used the App, without the time of day and without any history. It is taken from a request that the App makes in any event; nothing additional is stored on or read from your device for it. We use it for security, to see whether an Account is in use when we investigate misuse; for support, to answer questions about your Account; and to delete Accounts that are no longer used. An Account that has not been used for 24 months is deleted. If we have an email address for the Account because you signed in with Apple or Google, we write to you 30 days before; an Account without an email address is deleted without notice. Many people return to a language app after a long break, which is why we wait this long.

Work in progress: The deletion of Accounts not used for 24 months is not running yet; this section describes how it will work.

From this date, the date your Account was created and the rings finished, we compute totals per day that contain no User ID, such as how many people use Abece, how many come back and how many rings are finished, in order to find out whether Abece works and to improve it. Totals we look at never show a number below 5, so that no one can be singled out. We do not use them to make decisions about you or to contact you. You can object to being counted in these totals by writing to support@abece.app with your User ID; we then leave your Account out of them (section 6.5).

Only with your consent to Analytics (section 6.4). For each day on which you use the App, our server also records your User ID, the date, the platform and the App version, taken from a request that the App makes in any event, so that we can see how use develops over time. Nothing additional is stored on or read from your device for this purpose, and no analytics company receives these entries. If you switch Analytics off, we delete these entries at once and record no more.

5.6 Operation and security of the App

When the App communicates with our server, our hosting records your IP address, the time, the request, and the App and operating system version, in order to operate the Service, protect it against attacks and misuse, and identify faults. Error reports on our server may contain your User ID.

Before the App may use our server, Google Firebase and Apple verify that the request originates from a genuine copy of the App. This verification concerns the device, not your identity.

The audio recordings for the clues are delivered through a content delivery network, which processes your IP address. These requests carry no User ID.

5.7 Crash reports

The App contains no crash reporting tool and reads nothing from your device for this purpose. If you have allowed your iPhone or iPad, in the iOS settings, to share analytics with app developers, Apple collects crash reports as an independent controller and makes those concerning Abece available to us: technical details of the error, the device model, and the operating system and App version, without our User ID. We use them to find and fix faults, on the basis of our legitimate interest in a stable App (Art. 6(1)(f) GDPR).

Apple also passes on crash reports and feedback from TestFlight test versions, together with the name and email address with which a tester was invited.

5.8 The Website

Hosting. When you visit the Website, our hosting provider Vercel processes technical request data (IP address, time, page requested, browser type) in order to deliver the Website and protect it against attacks and misuse.

Work in progress: How long Vercel keeps these request logs will be added here.

Web Analytics. We use Vercel Web Analytics to obtain aggregated statistics on the use of the Website. For each page view, the following is transmitted to Vercel: the address of the page, the website you came from if you followed a link from another website, and technical information that Vercel derives from the request, namely country, region and city, operating system, browser and device type. Vercel does not recognise visitors by cookies. Visitors are distinguished by a hash value formed from the request, and a visitor session is discarded after 24 hours. We receive aggregated figures only. Vercel Web Analytics creates no profiles, does not track you across other websites, and is not linked to the App or your User ID.

Work in progress: How long Vercel keeps the Web Analytics data, and where it stores them, will be added here.

No cookies and no third-party requests. The Website sets no cookies, and it loads no resources from third parties: the analytics script is loaded from, and its data are sent to, the Website's own address.

Links to the app stores. Some links to the App Store on the Website and in our posts on social media lead through a link service of AppsFlyer, which forwards you to the right destination for your device and counts the clicks per link. For this, AppsFlyer processes your IP address, your browser and device type, the time and the campaign name of the link on our behalf. The link service sets no cookies. The clicks are not linked to your User ID, with one exception: if the App is already installed on your device and you have switched on Analytics, the link opens the App, and AppsFlyer records that the App was opened through that link (section 5.14).

Work in progress: How long AppsFlyer keeps the click data will be added here.

5.9 When you email us

If you write to support@abece.app or security@abece.app, we process your email address, your message and any attachments in order to answer you. Mail to these addresses is forwarded to our mailbox by Cloudflare. If your message concerns your data, please include your User ID from Settings, Account.

Work in progress: The provider that hosts the mailbox the forwarded mail reaches will be named here.

5.10 Abece Plus (optional purchase)

Abece Plus is sold by Apple through the App Store. Apple processes the payment; we never receive your card details or your Apple account. Our service provider RevenueCat manages the purchase status: once your Account exists, the App connects to RevenueCat with your User ID each time it starts, so that it can show the correct status and restore a purchase, even if you never buy anything. Before you tap Start learning, the App does not connect to RevenueCat. If you purchase Abece Plus, we and RevenueCat process the transaction data provided by Apple (product, price, currency, store country, time, transaction numbers, and whether a subscription is active, renewed, cancelled or refunded) as well as whether you have Abece Plus and until when.

Work in progress: How long purchase records are kept, including records that cannot be matched to an account, is still being decided. This section describes how it works today.

5.11 How you found Abece (our ads on the App Store)

We advertise Abece on the App Store with Apple Ads. To learn which of our ads bring people who use Abece, return to it and buy Abece Plus, and what that costs us, the App asks iOS for a token from Apple and sends it to our server, but only if you have switched on Analytics (section 6.4), and only once for each consent you give. Our server passes the token to Apple, and Apple tells us whether the App was installed after you tapped or saw one of our ads on the App Store and, if so, which campaign, ad group, search keyword and ad it was, where the ad was shown, the country or region, and the time of the tap or view, rounded to the minute. If the App was not installed through one of our ads, we only note that. Apple does not tell us who you are, and the App neither reads nor transmits the advertising identifier of your device. The source of this information is Apple (Article 14 GDPR).

We store this information with your User ID and compute totals per campaign from it, without any User ID. We also pass the campaign, ad group and keyword to RevenueCat (section 5.10) with your User ID, so that purchases can be evaluated per campaign. We do not use this information to make decisions about you or to show you advertising, and we do not pass it on to advertisers, ad networks or data brokers; Apple receives nothing from us except the token. This is not tracking within the meaning of Apple's App Tracking Transparency rules, so the App does not ask for permission to track you.

Measuring our ads is part of Analytics (section 6.4). The App asks for this consent in every country and region, and without it the App does not ask for the token. Only people aged 16 or over are asked (section 13).

Withdrawing your consent. You can withdraw your consent at any time, with effect for the future: switch off Analytics in Settings under Privacy and data, or write to support@abece.app with your User ID from Settings, Account. We then delete the information on how you found Abece, including the campaign details at RevenueCat, and the App does not ask for the token again unless you consent again. Withdrawing restricts nothing else in the App. Delete my data in Settings under Privacy and data also deletes this information, together with your progress (section 11.2).

Work in progress: Measuring our ads on the App Store arrives with version 1.0 of the App.

5.12 Starting with Abece: the sample ring, the Terms of Use, your age and your choices

When you first open the App, you can try a short sample ring, or skip it. It runs entirely on your device, with words and audio built into the App: for it, the App creates no Account and no identifier, and it sends nothing to us or to RevenueCat.

After the sample, the App shows the line "By tapping Start learning, you accept the Terms of Use. The Privacy Policy explains what Abece stores." above the Start learning button, with links to the Terms of Use and to this Privacy Policy, which you can also open later in Settings. By tapping Start learning, you accept the Terms of Use. Your acceptance concerns the agreement on the use of Abece; it is not consent to the processing of your data, and the App does not ask you to confirm that you have read this Privacy Policy. The processing described here rests on the legal bases in section 6.

When you tap Start learning, the App asks iOS for your age range, using Apple's Declared Age Range feature, before it creates your Account. In regions where the law requires apps to check the age range, it asks before the sample ring. iOS shows its own dialog, and you decide whether to share your age range; for a child's Apple Account, the parent or guardian who manages it in Family Sharing may decide. Apple tells the App only an age range (under 13, 13 to 15, 16 to 17, or 18 and over), never your date of birth, and the App never asks for your date or year of birth itself. The App keeps on your device only whether you are under 13, under 16, or 16 or over, and whether you shared your age range; this is not sent to us. What follows from the answer:

• Under 13: Abece is not available, and the App shows a page that says so.
• 13 to 15: the App does not ask for consent, and Analytics and News & offers stay off and cannot be switched on in Settings (section 13).
• 16 or over: the App asks for your consent after your first finished ring, as described below.
• If you do not share your age range, the App treats you as under 16: Analytics and News & offers stay off, and you can share your age range later in Settings. In regions where the law requires apps to check the age range, the App cannot be used until you share it, and if you are 18 or over but your age has only been declared by you, you first need to confirm it in the iOS Settings app.

If the age range you shared is under 16, the App asks iOS again when it starts, so that it notices when you turn 16; it then asks you once for your consent.

Unless you are under 13, the App then creates your Account, records your acceptance with the time you tapped, loads its settings from our server, and asks which languages you speak and learn and how much you already know (section 5.2).

If you are 16 or over, the App asks, separately from the Terms of Use, after your first finished ring (or once on the home screen the next time you open the App, if you have not finished one), whether you agree to Analytics (sections 5.5, 5.11 and 5.14) and to News & offers (section 5.13). You can accept both, reject both, or decide on each one. These are the only consents the App asks for. Both are off unless you turn them on, and you can use Abece fully if you leave them off. Nothing that needs your consent runs before you have answered.

We keep a record that you accepted the Terms of Use, with the versions of the Terms of Use and of this Privacy Policy that you were shown and the time you tapped Start learning (or continued with Apple or Google), and a record of each decision you make on Analytics and News & offers (section 6.4). If we change the Terms of Use or this Privacy Policy, the App shows them to you again.

Work in progress: The sample ring, the line above Start learning, the age range check and the two choices after the first ring arrive with version 1.0 of the App.

5.13 News and offers

If you switch on News & offers, we may send you occasional news and offers about Abece. We send none at present. Messages about something you already use or asked for, such as a reminder about your daily ring, are part of the Service and do not need this consent; messages that promote something, such as an offer or a new feature, are sent only with it. We share no data with advertising partners. If we ever do, we will name each partner here and ask you again; an earlier consent does not cover it.

5.14 Measuring our ads with AppsFlyer

We advertise Abece on several platforms, for example TikTok, Google and the App Store. To learn which of our campaigns lead to installations of the App, and whether the people they bring use Abece and buy Abece Plus, the App contains software from our service provider AppsFlyer Ltd. (Israel). It starts only after you have switched on Analytics (section 6.4), and it stops when you switch Analytics off. Until then it stores nothing on your device and sends nothing.

While it runs, the App sends AppsFlyer:

• your User ID;
• an identifier that AppsFlyer creates for this installation of the App and stores on your device;
• your IP address, from which AppsFlyer derives your approximate region;
• the device model, the operating system and its version, the language and time zone settings, the App version, and technical data such as the network type;
• the time of the installation and of each start of the App;
• whether you finished your first ring (if you finished it before you switched on Analytics, the App reports it once when you switch it on) and whether you bought Abece Plus, with product, price and currency, never your payment details. These are the only steps in the App that are reported to AppsFlyer.

The App does not read the advertising identifier of your device (IDFA), does not give AppsFlyer the identifier that iOS assigns to all apps of the same developer on your device (IDFV), and does not ask for permission to track you. AppsFlyer does not receive the token from Apple described in section 5.11. AppsFlyer does not recognise you by combining technical characteristics of your device (fingerprinting).

From this, AppsFlyer tells us which campaign an installation came from, or that it came from none. On iPhone and iPad it relies on Apple's SKAdNetwork and AdAttributionKit: if you install the App after seeing or tapping one of our ads, Apple itself tells the advertising platform and AppsFlyer which campaign it was and, in broad steps, how the installation developed, without your User ID and without an identifier of your device. Advertising platforms such as TikTok and Google receive only such figures; they never receive your User ID, a device identifier or your IP address from us or from AppsFlyer. We receive the result with your User ID, so that we can see what the people a campaign brought do in Abece. We do not use it to make decisions about you or to show you advertising, and we do not pass it on to advertisers, ad networks or data brokers.

AppsFlyer processes these data on our behalf and under our instructions, as our processor (Article 28 GDPR). Under its terms, it may also use them, without identifying you, to detect fraudulent installations and to produce aggregated statistics. The legal basis is your consent to Analytics (Article 6(1)(a) GDPR and § 25(1) TDDDG). Only people aged 16 or over are asked (section 13). AppsFlyer's privacy policy: https://www.appsflyer.com/legal/services-privacy-policy/

Withdrawing your consent. If you switch off Analytics in Settings under Privacy and data, or write to support@abece.app with your User ID from Settings, Account, AppsFlyer stops at once, and we ask AppsFlyer to delete the data it holds under your User ID. Delete my data and Delete account do the same (section 11.2). Withdrawing restricts nothing else in the App.

Work in progress: AppsFlyer is not in the App yet; it arrives with version 1.0 of the App.

6. Legal bases

6.1 Overview

6.2 Our legitimate interests

Where we rely on Article 6(1)(f) GDPR, our legitimate interests are:

• Providing the Service: where a contract with you has not been validly concluded, for example because a minor's acceptance of the Terms of Use is not effective without a parent or guardian, providing the Service you have chosen to use.
• Purchase status: selling Abece Plus reliably, which requires showing every user the correct status and allowing purchases to be restored.
• Operation and security: a secure and stable Service, protection against attacks and misuse, and the identification and correction of faults.
• When you last used the App: security, support, and deleting Accounts that are no longer used (section 5.5).
• Totals: knowing whether Abece is used and returned to, in order to improve it, from totals that contain no User ID.
• Website: delivering the Website securely, and knowing which pages are read and how visitors find the Website, in order to improve it.
• Links to the app stores: sending each visitor to the right destination for their device, and knowing which of our links are used.

6.3 Storage on and access to your device

App. The App stores on your device, and reads back, only what is strictly necessary to provide the Service you have requested: your sign-in, the key for the device check, the purchase status, your settings, your privacy choices and the result of the age range check (§ 25(2) no. 2 TDDDG). It therefore does not ask for consent for these.

Ads on the App Store. Asking iOS for the token described in section 5.11 and sending it to our server is access to information on your device within the meaning of § 25(1) TDDDG. It is not necessary for the Service, so the App does it only with your consent to Analytics (section 6.4), in every country and region.

AppsFlyer. The AppsFlyer software stores an identifier for this installation on your device and reads technical information from it (section 5.14). This is not necessary for the Service, so it runs only with your consent to Analytics (section 6.4).

Website. Vercel Web Analytics sets no cookies and stores no information on your device. On each page view, its script checks whether a particular entry exists in your browser's local storage; that entry is created only on websites that use Vercel's features for identifying visitors, which the Website does not use, so the check finds nothing. We therefore assume that no information is stored on or read from your device within the meaning of § 25(1) TDDDG, and we do not ask for consent.

6.4 Your consent and how to withdraw it

Two kinds of processing rest on your consent (Article 6(1)(a) GDPR, and § 25(1) TDDDG where the App accesses your device for it):

• Analytics: linking your use of the App to your Account through daily usage entries (section 5.5), and measuring our ads, on the App Store (section 5.11) and with AppsFlyer (section 5.14).
• News & offers: occasional news and offers about Abece (section 5.13).

The App asks for them after your first finished ring (or once on the home screen the next time you open the App, if you have not finished one), separately from the Terms of Use, and only if you are 16 or over (sections 5.12 and 13). Each is off unless you turn it on, and you can turn each on or off later in Settings under Privacy and data.

You can withdraw your consent at any time, as easily as you gave it: switch off Analytics or News & offers, or write to support@abece.app with your User ID. The withdrawal does not affect the lawfulness of the processing before it (Article 7(3) GDPR). When you switch off Analytics, we delete your daily usage entries and the information on how you found Abece, including the campaign details at RevenueCat, and the App does not ask for the token again; AppsFlyer stops, and we ask AppsFlyer to delete the data it holds under your User ID. If you later switch Analytics on again, that is a new consent, and the App asks for the token once more. Nothing else in the App changes.

We keep a record of each decision you make on Analytics and News & offers: whether you gave or withdrew your consent, the version of the text you were shown, the time, and where you made the decision (for example after your first ring or in Settings). Each decision is added to the record and earlier entries are not changed, so that we can show that you consented (Article 7(1) GDPR). We delete the record with your Account. If what a consent covers changes, for example because a new recipient is added, the App asks you again.

Work in progress: This record arrives with version 1.0 of the App.

6.5 Your right to object

Where we rely on legitimate interests, you may object at any time, on grounds relating to your particular situation, to the processing of your personal data (Article 21 GDPR). Write to support@abece.app with your User ID from Settings, Account. If you object to being counted in the totals described in section 5.5, we leave your Account out of them; nothing in the App is restricted as a result.

6.6 Whether you must provide data

You are not obliged by law or by contract to provide personal data. The User ID, the learning data and the request data described in sections 5.1, 5.2 and 5.6 are, however, necessary to provide the App; without them, the App cannot be used. Signing in with Apple or Google, clue reports and emails are voluntary.

7. Automated decision-making

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR). Your level only determines which rings you receive.

8. Recipients

We do not sell or rent personal data and do not share it with advertisers. The following service providers process personal data on our behalf and under our instructions as processors (Article 28 GDPR):

• Google Cloud (Belgium): operates our server, logs and security, and delivers the audio.
• Supabase (Ireland, on Amazon Web Services): hosts our database.
• Google Firebase (United States): accounts and sign-in, and the device check.
• RevenueCat (United States): purchase status for Abece Plus, and, with your consent to Analytics, the campaign details from section 5.11.
• Vercel (United States): hosts the Website and provides Web Analytics.
• Cloudflare (United States): DNS for abece.app and forwarding of our email.
• AppsFlyer (Israel): forwarding and counting clicks on our links to the app stores (section 5.8) and, with your consent to Analytics, measuring our ads (section 5.14).

Apple (App Store, TestFlight, Apple Ads, payment for Abece Plus, Sign in with Apple, the device check) and Google (Sign in with Google) act as independent controllers under their own terms and privacy policies. We may disclose data where we are legally obliged to do so, for example to a court or an authority.

Work in progress: We are still confirming the data processing terms of each provider listed above and the transfer mechanism each one names (section 9).

9. Transfers outside the European Economic Area

Our server and our database are located in the European Union. Google Firebase processes account data in the United States, and RevenueCat, Vercel and Cloudflare are based there; our other providers may also access data from outside the European Economic Area. For such transfers we rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, for certified companies, or on the Standard Contractual Clauses adopted by the European Commission (Articles 45 and 46(2)(c) GDPR). AppsFlyer is based in Israel, for which the European Commission has adopted an adequacy decision (Article 45 GDPR). AppsFlyer states that it stores the data in the European Union; its service providers and affiliates may also access them from other countries, including the United States, and for such transfers its data processing terms include the Standard Contractual Clauses (Article 46(2)(c) GDPR).

10. Retention

We keep personal data only for as long as it is required for the purposes set out above, unless the law requires us to keep it longer.

• Account, choices, progress, records of transferred accounts: until you delete them in the App or ask us to delete them (section 11).
• Your acceptance of the Terms of Use and your privacy choices, including the record of each decision on Analytics and News & offers: as long as your Account exists; they are deleted with it, and Delete my data keeps them.
• The date you last used the App: as long as your Account exists; it is deleted with it, and Delete my data keeps it.
• Accounts not used for 24 months: deleted, with an email 30 days before where we have an email address (section 5.5).
• Your age group from the age range check (under 13, under 16, or 16 or over, and whether you shared it): only on your device, until you delete the App.
• Abece Plus status and purchase records: as long as your Account exists (see the note in section 5.10). Our tax records are Apple's sales reports, which contain no data about individual buyers.
• Your record at RevenueCat: deleted together with your Account. The campaign details from section 5.11 are removed earlier if you withdraw your consent or delete your data.
• How you found Abece: 12 months from the installation of the App, or earlier if you switch off Analytics or delete your data or your Account. The totals per campaign contain no User ID and are kept. Apple states that it keeps the data it uses for this for up to 21 days.
• Daily usage entries (with Analytics): 90 days, or earlier if you switch off Analytics or delete your data or your Account. The totals contain no User ID and are kept.
• Server logs and error reports: 30 days.
• Crash reports passed on by Apple: in accordance with Apple's periods.
• Database backups: 7 days, so deleted data leaves the backups within 7 days.
• Website request logs and Web Analytics data: work in progress, see section 5.8.
• Clicks on links to the app stores: work in progress, see section 5.8.
• Data at AppsFlyer from the App: information on individual installations for as long as AppsFlyer needs it to attribute them, at most 24 months, and totals without your User ID for up to 25 months; earlier if you switch off Analytics or delete your data or your Account, when we ask AppsFlyer to delete it. AppsFlyer completes such a request within 10 days.
• Emails: as long as needed to handle your request, unless the law requires us to keep them.

11. Your rights

11.1 Your rights under the GDPR

You have the right to access your personal data and to receive a copy of it (Article 15 GDPR), to have it rectified (Article 16), erased (Article 17) or its processing restricted (Article 18), to receive it in a structured, commonly used and machine-readable format (Article 20), and to object to its processing (Article 21, section 6.5). Where processing rests on your consent, you may withdraw it at any time (Article 7(3), section 6.4).

11.2 In the App

In Settings under Privacy and data, Export my data gives you a file containing everything our database holds about you. Delete my data deletes your rings, answers, review words, usage entries and the information on how you found Abece, has AppsFlyer delete what it holds under your User ID (section 5.14), and resets your level and streak, while keeping your Account, sign-in, settings and Abece Plus. Under Account, Delete account deletes your Account, including a sign-in with Apple or Google, and everything we hold under your User ID, and has AppsFlyer delete what it holds under it; the App then starts over with a new User ID. In both cases, clue reports remain with the clue, without your User ID. Deletion is final, so the App asks you to confirm it first. Deleting the App alone deletes nothing on our server.

Work in progress: If you signed in with Apple, Delete account does not yet revoke Abece's access to your Apple account.

11.3 What remains

Settings kept only on your device are removed when you delete the App. Logs and backups are not edited, but expire as set out in section 10. Delete account also has RevenueCat delete its record of you. An Abece Plus purchase remains with your Apple account and can be restored through Apple; deleting your Account does not cancel a subscription, which you cancel in your Apple account settings.

11.4 By email

You may also write to support@abece.app. Please include your User ID from Settings, Account; our database holds no name or email address, so this is how we find your data. If you signed in with Apple or Google, you may instead write from that account's email address (if you hid your address from Apple, please tell us the forwarding address Apple created). If we cannot identify your Account, we will inform you (Article 11 GDPR). We answer within one month; for complex requests this period may be extended by two further months, in which case we will inform you.

11.5 Users in Türkiye

Users in Türkiye also have the rights under Article 11 of the KVKK. The Turkish version of this Privacy Policy sets them out in full.

11.6 Users in California

We do not sell personal information and do not share it for cross-context behavioural advertising. You may request to know and to delete the personal information we hold about you, as described above, and we will not discriminate against you for exercising these rights. We answer within 45 days; this period may be extended once by a further 45 days.

12. Complaints

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence or place of work (Article 77 GDPR). The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, https://www.lda.bayern.de.

Users in Türkiye may also lodge a complaint with the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu), https://www.kvkk.gov.tr.

13. Children

Abece is intended for persons aged 13 and over and is not directed at children. The App checks your age range through Apple's Declared Age Range to make sure of this and to decide whether it may ask for your consent (section 5.12); if the age range shows that you are under 13, Abece cannot be used.

Almost all of the processing described in this Privacy Policy rests on the performance of the contract, on our legitimate interests or on a legal obligation (section 6), not on consent, so the consent of a parent or guardian is not required for it. Where a young person's acceptance of the Terms of Use is not effective without a parent or guardian, we provide the Service on the basis of our legitimate interest (section 6.1).

The exceptions are Analytics and News & offers (section 6.4), which run only with consent. In Germany, a person can give such consent themselves only from the age of 16 (Article 8 GDPR), and we apply this age everywhere. If your age range shows that you are 13 to 15, or if you do not share it, the App does not ask for these consents, and Analytics and News & offers stay off, so AppsFlyer (section 5.14) never starts. Abece works fully without them. The App never asks for your date of birth, and we do not receive your age range. If we learn that someone under 16 has turned either of them on, we treat it as off and delete what it produced.

Young people can exercise the rights in section 11 themselves; a parent or guardian can also exercise them on their behalf.

A parent or guardian can delete a child's data with Delete account on the child's device or by writing to us. If we learn that a child under 13 is using Abece, we delete the data under that User ID as soon as we can identify it.

14. Security

We protect personal data with appropriate technical and organisational measures (Article 32 GDPR). Data is transmitted in encrypted form (HTTPS). Our database is hosted in the European Union with encrypted storage, restricted access and daily backups. Only Engin Deniz Usta can view an individual user's data, one user at a time, through access-controlled and logged tools. If a personal data breach is likely to result in a risk to you, we will notify the supervisory authority within 72 hours and inform you as the GDPR requires (Articles 33 and 34 GDPR).

15. Changes to this Privacy Policy

We update this Privacy Policy when the Service changes, and before any new kind of processing begins. The date at the top shows the current version. We will point out significant changes in the App or in the update notes before they take effect.

16. Contact

For any questions about this Privacy Policy or about the processing of your personal data, please contact us:

• Email: support@abece.app
• Post: Engin Deniz Usta, Brennerei 2, 82024 Taufkirchen, Germany