Privacy Policy

This Privacy Policy explains how personal data is processed when you use the Karo mobile apps and the karo-learn.com website (together, the "Service"). It applies to everyone, and the sections on GDPR rights and on U.S. state privacy rights give extra detail for people in Europe and in the United States.

Who is responsible

The controller of your personal data is "Karo".

Contact for everything, including privacy requests: support@karo-learn.com. We have not appointed a data protection officer, because the law does not require one for what we do. We are established in the European Union, so no separate EU representative is needed.

Our approach

The best way to protect data is not to hold on to more than you need. So we collect the minimum, we do not sell personal data, we do not use the contents of your learning for advertising, and we do not take part in profiling that has legal or similarly significant effects on you.

Personal data we collect

Account. Your email address and display name when you sign in with Google or with email. We never see or store your password: it is handled by the sign-in provider (Firebase Authentication).

Learning. Your lesson progress, completed lessons, streak, experience (XP), lives, achievements, study time, review history and settings, so we can save and sync where you left off. Until you sign in, this stays on your device.

Technical data. Device model, operating system and app version, interface language, an anonymous installation identifier, diagnostics and crash reports.

Security data. Your IP address is used by our servers to limit abuse and, when you change your password or sign in from a new device, to work out an approximate region (country and city) through a third-party geolocation service so we can warn you by email. Rate limits are kept as counters keyed by a one-way hash, never by the plain address, and they are deleted after a few days. We also use signals that confirm a request comes from the genuine Karo app (Google Play Integrity on Android, Apple App Attest on iPhone).

Advertising (free plan only). If you use Karo for free, Google AdMob may use your device's advertising identifier and technical device data to show and measure ads, in line with the choice you make in the consent form that Google's consent platform shows where the law requires it. There are no ads in Karo Pro.

Purchases. Subscriptions are bought and paid through Google Play or the Apple App Store. Your card details never reach us. We receive a confirmation that is checked against the store (product, status, dates and an order or purchase identifier) so we can unlock Karo Pro.

Notifications. If you allow push notifications, we store your device token (Firebase Cloud Messaging on Android, Apple Push Notification service on iPhone) so we can remind you to practice.

Email and messages. The welcome email, confirmation codes and account security warnings are sent through the Resend email service: only your address and the text of the message are passed to it. If you write to us, send a language suggestion or report a mistake in a lesson, we keep what you send and your reply address.

Website. Our hosting provider (Vercel) logs technical data of each request (IP address, time, address requested, browser). The account pages of the website, which you reach from the link in an email, use a single-use link and one short-lived session cookie described below.

Acceptance of the terms. When you create an account or sign in, we store the date, the version of these Terms and this Privacy Policy and the app language, linked to your account, as proof of what you accepted. Legal basis: our legitimate interest in proving what was agreed, Article 6(1)(f). It is deleted with the account.

Website statistics. The public pages of the website are measured with Vercel Web Analytics: the page visited, the page you came from, country, device type, browser and operating system. It uses no cookies and stores nothing on your device; a visitor is told apart only by a value calculated from the request that is valid for a single day and then discarded. The account pages and the owner dashboard are not measured.

We get this data from you, from your device, and from the sign-in providers and app stores you use. We do not buy personal data from data brokers.

Microphone and pronunciation

Pronunciation exercises ask for access to the microphone. The permission is requested only at the moment you tap the record button yourself, and you can refuse it.

Speech is recognised by the speech service built into your phone (Android's speech recognition, or Apple's on iPhone), not by Karo. We do not record, store or receive your voice: the app gets back only the recognised text, and it is compared with the correct answer on the device itself. Neither the audio nor that text is sent to our servers. The phone's own speech service has its own privacy terms, which depend on your system settings.

Voices that read words aloud

The German and English voices in Karo are small neural models and pronunciation dictionaries that ship inside the app and run entirely on your phone. The words and sentences being read are not sent to us or to anyone else, and nothing about them is stored. For other languages, or if the on-device voice cannot be used, Karo asks your phone's own text-to-speech engine to read the text, and that engine follows your system settings and its own privacy terms.

Why we use your data and the legal bases (GDPR)

Where the GDPR or the UK GDPR applies, we need a legal basis for each use of personal data. These are ours:

Running the Service (account, sign-in, saving and syncing progress, unlocking Karo Pro, support): performance of our contract with you, Article 6(1)(b).

Security and abuse protection (rate limits, app integrity checks, account warnings, fixing faults): our legitimate interest in a safe and working Service, Article 6(1)(f).

Crash reports and diagnostics: our legitimate interest in keeping the app stable, Article 6(1)(f).

Website visit statistics (Vercel Web Analytics, no cookies): our legitimate interest in understanding how the website is used and improving it, Article 6(1)(f). You can object, as explained under Your rights.

Usage analytics (which lessons work, so we can improve them): your consent where the law requires it, which we ask for through the consent form in the app, Article 6(1)(a); elsewhere, our legitimate interest in improving Karo.

Advertising on the free plan: your consent where the law requires it, given or refused in Google's consent form, Article 6(1)(a).

Push notifications: your consent, which you give by allowing notifications and can withdraw in your system settings, Article 6(1)(a).

Legal obligations and legal claims: to comply with the law, and to establish, exercise or defend legal claims, Article 6(1)(c) and 6(1)(f).

You can withdraw a consent at any time, with effect for the future. Where we rely on legitimate interests you can object, as explained under Your rights.

Analytics and crash reports

We use Google Firebase (Analytics and Crashlytics) to see which lessons work and to fix crashes. Analytics runs with advertising features switched off: it does not use your advertising identifier and does not personalise ads. There is no third-party behavioural ad tracking inside the lessons.

The website measures visits with Vercel Web Analytics, which works without cookies: it records page views together with country, device type, browser and operating system, without advertising identifiers and without following you across other websites. Vercel processes this data on our behalf. The account pages (password reset, email confirmation) and the owner dashboard are excluded, so a single-use link never reaches the statistics.

Cookies and similar technologies

Website. karo-learn.com sets no analytics, advertising or tracking cookies. The only cookie is a strictly necessary session cookie on the account pages (password reset, email confirmation): it is created when you open the single-use link from your email, cannot be read by page scripts, and is deleted as soon as the action is finished or expires. Strictly necessary cookies do not need your consent. The website does not use Google Analytics or social media plugins.

Apps. Karo uses the app's own storage on your device to remember your progress and settings, and, on the free plan and only in line with your consent choice, the advertising identifier through Google AdMob. You can reset or delete the advertising identifier, or opt out of personalised ads, in your phone's settings (Google: Settings, Ads; Apple: Settings, Privacy and Security, Tracking). Karo Pro shows no ads at all.

Some browsers send a "Do Not Track" or Global Privacy Control signal. The website's visit statistics use no cookies and build no advertising profile, so there is no tracking for the signal to switch off.

Who receives your data

We do not sell or rent your personal data. It is processed only by contractors that work on our behalf and may use it only on our instructions: Google Firebase (hosting of the database in the EU, sign-in, sync, notifications, crash reports and analytics), Google AdMob (ads on the free plan), Google Play and the Apple App Store (purchases and subscription checks), Vercel (hosting of karo-learn.com), Resend (sending email), and an IP geolocation service (ipwho.is, used only for the security warnings and receiving only the IP address).

Data may also be disclosed to public authorities where the law requires it, to professional advisers bound by confidentiality, and to a successor if the business is sold or transferred, under the same protections.

International data transfers

The main database and our server functions are located in the European Union. Some of our contractors, such as Google, Vercel and Resend, may process data in other countries, including the United States. Where that happens we rely on an adequacy decision (for example the EU-U.S. Data Privacy Framework) or on the European Commission's standard contractual clauses, with additional safeguards where needed. You can ask us for a copy of the safeguards that apply.

How long we keep data

We keep personal data only as long as it is needed for the purposes above, including any legal, accounting or reporting duty, and to establish or defend legal claims. To decide how long, we look at the nature and sensitivity of the data, the risk of harm from misuse and whether the purpose can be reached another way.

Your account and learning data: while your account is active. When you delete the account in the app (Profile, Settings, Delete account), it is deleted straight away from our systems; copies in backups are overwritten within 90 days.

Rate-limit counters and security records: a few days.

Crash reports and analytics: for the periods set in Firebase, up to 14 months for analytics and 90 days for crash reports.

Website visit statistics: aggregated figures; Vercel keeps the underlying events for no longer than 12 months.

Messages you send us (support, language suggestions, lesson reports): until we have dealt with them and for as long as they help us improve the lessons; we delete them when you ask.

Purchase records: the stores keep payment and invoice records under their own rules; we keep the subscription status for as long as your account exists and delete it with the account. We keep only an irreversible hash of the purchase identifier, so that one purchase cannot be claimed by several accounts.

When we no longer need data we delete it or make it anonymous. Anonymous data can no longer be linked to you and may be kept.

Your rights (GDPR and UK GDPR)

If you are in Europe, you have these rights over your personal data, free of charge:

Access: ask for information about how we process your data and for a copy of it.

Correction: have inaccurate data corrected.

Deletion: have your data deleted where there is no good reason for us to keep it. You can do this yourself in the app.

Restriction: have processing limited, for example while we check a correction.

Portability: receive the data you gave us in a machine-readable form, or have it sent to another provider.

Objection: object to processing that rests on our legitimate interests, and at any time to direct marketing (we send none).

Withdraw consent: at any time, with effect for the future.

To use a right, write to support@karo-learn.com. We may ask for details to confirm it is you. We answer within one month. If we refuse, we tell you why.

Complaints. You may complain to the data protection authority where you live, work or where you think your rights were infringed. In the EU you can find your authority at edpb.europa.eu; in the United Kingdom it is the Information Commissioner's Office (ico.org.uk). The authority responsible for us is the one of our own country.

Providing data is not required by law or contract, but without an account and the data above we cannot save and sync your progress or unlock Karo Pro.

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you, and we do not profile you for such purposes.

Additional information for residents of U.S. states

If you live in a U.S. state with a comprehensive privacy law (for example California, Colorado, Connecticut, Virginia, Texas, Oregon and others), you may have the rights below. In this section "personal information" has the meaning the state law gives it.

What we collect and why. In the last 12 months we collected identifiers (email address, display name, device and advertising identifiers, IP address), internet or app activity (lesson progress, usage events, crash data), device information, approximate location derived from the IP address, commercial information (subscription status) and the text of messages you send us. We use it for the purposes listed in this policy, and we disclose it only to the service providers named under Who receives your data.

We do not sell personal information for money. On the free plan the advertising partner that serves ads through Google AdMob may use advertising identifiers to show you ads. Some state laws call this "sharing" or targeted advertising. You can opt out in Google's consent form where it appears, in your device's advertising settings, or by switching to Karo Pro, which has no ads. We do not knowingly sell or share the personal information of anyone under 16.

Your rights. To know and to access the personal information we hold about you, to correct it, to delete it, to get a portable copy, to opt out of targeted advertising and of any sale or sharing, to limit the use of sensitive personal information (we do not use it to infer characteristics about you), to appeal a refusal, and not to be treated worse for using these rights.

How to ask. Write to support@karo-learn.com, or delete your account in the app. We verify requests by matching them with the account email. An authorized agent may send a request for you with written permission. If we refuse, you can appeal by replying to our answer.

Nevada residents may also ask us not to sell their information; we do not sell it.

Children

Karo is not directed at children under 13, and we do not knowingly collect their personal data. In the European Union and the United Kingdom, if you are under 16 (or under the lower age your country sets), you may use Karo only with your parent's or guardian's consent where consent is the legal basis. A parent who believes a child has given us data can write to us and we will delete it.

Security

Data travels over encrypted connections (TLS). Access to the database is limited by server-side rules that check who you are on every request, secrets are kept on the server and never in the app, and we use app-integrity signals to tell the genuine Karo app from abuse. No system is perfectly secure, and we cannot guarantee it, but we take reasonable technical and organisational measures. If a breach puts your rights at risk, we will tell you and the authority as the law requires.

Other sites and services

Karo may link to other websites and to the stores. We do not control them and are not responsible for their privacy practices. Please read their policies.

Changes to this policy

We may update this policy. We will announce important changes in the app or by email and update the date at the top, and where the law requires it we will ask again for your consent. Earlier versions are available on request.

Contact us

Questions about data and requests: support@karo-learn.com.