Privacy Policy
Last updated: November 2026
1. Who is responsible
This privacy policy explains how we process personal data when you use the website hao2learn.com (including its subdomains), the hao2learn mobile app for iOS and Android, and the hao2learn plugins for AI assistants such as ChatGPT.
Controller: Maae & Spirek GbR ("hao2learn", "we"), Mozartstr. 32, 22880 Wedel, Germany, represented by Bastian Spirek and Malte Maae. Email: info@hao2learn.com. Further details are in our legal notice.
We are not required to appoint a data protection officer. For any question about your data, write to info@hao2learn.com.
2. Hosting and server logs
The website and our servers run on Amazon Web Services (Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg) in the Frankfurt region (Germany). Static files are delivered through Amazon's content delivery network (CloudFront), which may serve them from a location near you. Our database and sign-in service is Supabase (Supabase Inc., USA), also hosted in Frankfurt.
Whenever your browser or the app contacts our servers, the following is processed automatically:
- IP address, date and time of the request,
- the address requested and the referring page,
- browser or app version, operating system and the response status.
We use this to deliver the website and app, to keep them secure and stable, and to find errors. To protect our free features from abuse, we count requests per IP address for short periods (rate limiting; counters are deleted after one day). For features that use AI (see section 7) we keep a log of each call with IP address, approximate country, browser/app identifier, the account ID if you are signed in and technical details. It never contains the text you entered and is deleted after 90 days. Hosting logs are deleted by our providers after a short period.
Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is a secure, stable and abuse-free service.
4. Google Analytics (website, only with your consent)
If you accept analytics in the cookie banner, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). The Google Analytics script is not loaded at all until you consent.
Google Analytics sets cookies (see section 3) and processes information about your use of the website: pages visited, time spent, referring page, approximate location (derived from the IP address, which Google Analytics 4 does not store), device, browser and operating system. This creates pseudonymous usage statistics that help us understand which content is useful and improve the website. We have turned off Google signals and ad personalisation, and we do not combine this data with your hao2learn account.
Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). Analytics data is deleted after 14 months.
Legal basis: Your consent, Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. You can withdraw it at any time (section 3).
More information: Google Privacy Policy and Google Analytics and data protection.
To count views of shared documents and stories we also record an anonymous view count in our own database. It contains no IP address or other personal data. A flag in local storage (see section 3) makes sure the same browser is counted only once.
5. Your hao2learn account
Teachers can create an account on the website, and app users can create one in the app. We process your email address, your password (stored only as a secure hash by Supabase), the date you signed up, and the settings you choose. When you sign up we send a confirmation email or code. To block automated and abusive sign-ups we check the email domain and IP address of each sign-up and record rejected attempts.
In the app you can also use hao2learn as a guest without giving an email address. We then create an anonymous account that is identified only by a random ID.
Legal basis: Art. 6 (1) (b) GDPR (providing the account you asked for); for spam protection Art. 6 (1) (f) GDPR (protecting our service and users from abuse).
We keep your account data until you delete your account. You can delete your account in the app (Profile → Delete account) or by writing to info@hao2learn.com. Data we must keep for legal reasons (e.g. invoices under commercial and tax law, usually 6 to 10 years) is kept only for that purpose.
6. Documents, sharing and live lessons
a. Documents and folders
The documents, folders, vocabulary decks and media you create are stored in your account so we can show, edit and share them. If you share a document or folder by link or embed it on another website, anyone with the link can view it.
Legal basis: Art. 6 (1) (b) GDPR.
b. Live lessons (students)
Students can join a teacher's live lesson without an account. We process the display name the student enters, the answers they submit and a random token that identifies their browser for the lesson (kept in local storage, see section 3; we store only a hash of it). The teacher who runs the lesson can see the display names and answers. We recommend that students use a first name or nickname only.
The teacher decides how long lessons and results are kept and can delete them; they are otherwise deleted when the teacher's account is deleted.
Legal basis: Art. 6 (1) (b) GDPR towards the teacher, and Art. 6 (1) (f) GDPR towards students. Our legitimate interest, and the teacher's, is to run the lesson and show its results.
7. Translation, dictionary, audio and AI features
Some features send the text you enter to specialised providers who process it for us and return the result. We send only the text needed, never your name or email address:
- Translation, example sentences, marking of exercises, story and picture generation: OpenAI (OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, Ireland; processing may take place in the USA).
- Spoken audio (text-to-speech) and, in the app, example sentences: Google (Google Ireland Limited; Google Cloud Text-to-Speech, Gemini API and Firebase AI Logic; processing may take place in the USA).
Under their API terms, these providers do not use the data we send to train their models. To make repeated requests faster and cheaper, we keep the results of common translations and dictionary lookups in a cache that is not linked to you. Please do not enter sensitive personal data into the translator or other AI features.
Legal basis: Art. 6 (1) (b) GDPR (providing the feature you use) and Art. 6 (1) (f) GDPR (efficient operation).
8. Using hao2learn through an AI assistant (hao2learn for Teachers in ChatGPT)
Teachers can connect their hao2learn account to an AI assistant such as ChatGPT, for example through the "hao2learn for Teachers" plugin. You sign in with your hao2learn account and approve the connection on a hao2learn consent page. The assistant then calls our server (teacher-mcp.hao2learn.com) on your behalf with an access token that is limited to your own account.
Categories of data we process:
- your account identifier and the email address of your hao2learn account, to authenticate the connection;
- the content the assistant sends to create or change your documents (titles, text, exercises, instructions for pictures and recordings) and the documents, folders and lessons it reads at your request;
- when you ask for lesson results: the display names your students entered when joining a lesson and the answers they submitted to your exercises;
- usage counters (which limit was used and when), to enforce fair-use limits, and technical error logs (deleted after 90 days).
We do not receive your conversation with the assistant. We only receive the specific requests the assistant sends to our tools.
Purposes: providing the features you request (creating, reading and editing documents, running live lessons, showing results, generating pictures and recordings), securing the connection, and preventing abuse.
Recipients:
- the AI assistant you connected (for ChatGPT: OpenAI), which receives the results of the requests it makes and processes them under its own privacy policy as a separate controller;
- OpenAI, when you ask for a picture to be generated: only the picture description, no account data;
- Google (Gemini), when you ask for a spoken recording: only the text to be spoken, no account data;
- our hosting and database providers, Amazon Web Services and Supabase, who process data on our behalf in the EU (Frankfurt).
Retention: documents, lessons and student answers are kept in your account until you delete them or your account is deleted. Usage counters are deleted automatically after one day. Access tokens expire automatically.
Your controls: you can disconnect the assistant at any time in its settings, which stops all further requests. You can delete documents in hao2learn, and you can ask us to revoke the assistant's access or to delete your account and data by writing to info@hao2learn.com. The rights described in section 13 apply.
Legal basis: Art. 6 (1) (b) GDPR (performance of our contract with you) and, for securing the service and preventing abuse, Art. 6 (1) (f) GDPR (our legitimate interest).
9. The hao2learn mobile app
You download the app from the Apple App Store or Google Play. These stores process data such as your store account and the download under their own privacy policies; we have no influence on this.
a. Learning data and sync
The app stores your vocabulary decks, learning progress and review history, the stories you read, your settings and your learning level, both on your device and in your account (Supabase, Frankfurt), so they are kept safe and synced between devices. For our usage statistics the app also records events such as "app opened", "story read", "test started" or "notification opened" in your account, and for translations the text that was translated. These statistics are only evaluated by us in aggregate form.
Legal basis: Art. 6 (1) (b) GDPR for sync and learning features; Art. 6 (1) (f) GDPR for usage statistics (improving the app).
b. Firebase (Google Analytics for Firebase and App Check)
The app uses Firebase, a service of Google Ireland Limited. Google Analytics for Firebase records how the app is used (for example screens viewed, tutorial steps, completed tests, notification settings, app version, device model, operating system, approximate location and a random app instance ID) so that we can understand and improve the app. We do not send your name or email address. Firebase App Check uses Apple App Attest / DeviceCheck or Google Play Integrity to confirm that requests come from a genuine copy of our app, which protects our AI features from abuse.
Data may be transferred to Google LLC in the USA (see section 11). Analytics data is deleted after 14 months.
Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is improving the app and protecting it from abuse.
c. Push notifications (OneSignal)
If you allow notifications, we use OneSignal (OneSignal, Inc., 201 S. B Street, San Mateo, CA 94401, USA) to send learning reminders and news. We process a push token of your device, your hao2learn user ID, your reminder schedule and time zone, and whether you opened a notification. You can turn notifications off at any time in the app or in your device settings.
Legal basis: Your consent (Art. 6 (1) (a) GDPR), given through your device's notification permission.
d. Subscriptions and in-app purchases (RevenueCat)
Payments for subscriptions are handled entirely by Apple or Google; we never receive your payment details. To know which features you have unlocked, we use RevenueCat (RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA), which receives your hao2learn user ID and the purchase receipts from the store.
Legal basis: Art. 6 (1) (b) GDPR.
e. App updates (Expo)
The app downloads updates from Expo (650 Industries, Inc., USA). Your device's IP address, app version and platform are processed for the download.
Legal basis: Art. 6 (1) (f) GDPR (keeping the app up to date and secure).
f. Feedback in the app
If you send us feedback in the app, we store your message, the app version and operating system and, if you provide them, your email address and a description of your device, so we can follow up. We delete feedback when it is no longer needed.
Legal basis: Art. 6 (1) (f) GDPR (handling your feedback), and Art. 6 (1) (b) GDPR where it concerns your use of the app.
10. Contacting us
If you write to us by email, we use your email address and the content of your message to answer you. We delete the correspondence when it is no longer needed, unless we are legally required to keep it.
Legal basis: Art. 6 (1) (b) GDPR if your message concerns a contract or your account, otherwise Art. 6 (1) (f) GDPR (answering enquiries).
11. Recipients and transfers outside the EU
We share personal data only with the providers named in this policy, in order to provide our services, or where you ask us to (e.g. sharing a document or connecting an AI assistant), or where we are legally required to. We do not sell personal data, and we do not use it for advertising.
Some providers are based in the USA or may process data there. Where a provider is certified under the EU-U.S. Data Privacy Framework, the transfer is covered by the European Commission's adequacy decision (Art. 45 GDPR).
12. Social media
Our website links to our pages on Instagram and Facebook. These are plain links: no data is sent to Meta when you visit our website. Meta only receives data if you click a link and open their website, under Meta's own privacy policy.
13. Your rights
You have the right:
- to access the personal data we hold about you (Art. 15 GDPR);
- to have inaccurate data corrected (Art. 16 GDPR);
- to have your data deleted (Art. 17 GDPR);
- to restrict processing (Art. 18 GDPR);
- to receive your data in a structured, machine-readable format (data portability, Art. 20 GDPR);
- to withdraw any consent you have given at any time, with effect for the future (Art. 7 (3) GDPR);
- to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in your country of residence or the authority responsible for us: Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany.
To exercise your rights, write to info@hao2learn.com.
14. Right to object (Art. 21 GDPR)
Where we process your data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you have the right to object at any time for reasons arising from your particular situation. We will then stop processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. If we were to process your data for direct marketing, you can object at any time without giving reasons.
An email to info@hao2learn.com is sufficient.
15. Children
hao2learn is also used in schools. Students can take part in live lessons without an account; the teacher or school is responsible for using hao2learn with their students in line with applicable law. Children under 16 should only create an account in the app with the consent of a parent or guardian.
16. Obligation to provide data and automated decisions
You are not obliged to provide personal data. Without an email address, however, we cannot create a full account for you. We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.
17. Security
All connections to our website, app and servers are encrypted with TLS (HTTPS). We use appropriate technical and organisational measures, including access controls and encrypted storage at our hosting providers, to protect your data against loss, misuse and unauthorised access.
18. Changes to this policy
This privacy policy was last updated in November 2026. We will update it when our services or the legal requirements change. The current version is always available at https://hao2learn.com/privacy.