Privacy Policy

Last updated: 15 May 2026

This Privacy Policy explains how NUB Tech ("we", "us", "our") collects, uses, and protects personal data when you use the Alphiox Learn German mobile app (the "App"). We comply with the EU General Data Protection Regulation (GDPR) and the German Bundesdatenschutzgesetz (BDSG).

1. Controller

NUB Tech is the controller responsible for your personal data.
Contact: alphaexplorer@nubtech.org

2. The App

Alphiox Learn German is an independent language-learning app for adult learners. It offers Telc-format A1 and B1 mock exams (Hören, Lesen, Sprachbausteine, Schreiben, Sprechen), AI-graded writing and speaking feedback, interactive lessons, role-play conversations, and a vocabulary trainer. The App is not affiliated with telc gGmbH; see our Terms & Conditions for the full disclaimer.

3. Data we collect

3.1 Account data (when you sign in)

You create an account by signing in with Google or Apple. From the identity provider we receive:

Your name (display name)
Your email address
A stable user identifier (Apple "sub" or Google subject ID)

We do not receive your password, contacts, or other profile data from the identity provider.

3.2 Learning & exam data

While you use the App we store:

Your target CEFR level and daily learning-time goal
Your progress across lessons, conversations, and vocabulary
Your mock-exam attempts: your answers per question, AI scores, AI feedback, and total score
Your spoken-answer transcripts from the Sprechen section (see §3.4 — the raw audio itself is not uploaded)
Daily activity (XP earned, exams taken, streak counter)

3.3 Subscription & token data

If you purchase a subscription or token pack, the purchase is processed by Apple App Store or Google Play. We receive from RevenueCat (our subscription-management partner):

Your subscription tier (free / premium) and renewal status
The product ID of token packs you have purchased and the resulting token balance

We do not receive your full payment details — only the metadata needed to grant access.

3.4 Audio from the Sprechen section

Audio stays on your device. When you speak during the Sprechen section, your audio is transcribed locally on your device. We never upload, store, or have access to the raw audio file. Only the resulting text transcript is sent to our servers for AI grading and saved as part of your exam attempt.

Specifically:

Android. Speech-to-text is handled by the on-device Vosk German model (preferred, fully offline) or, as a fallback, the Android system SpeechRecognizer. The Vosk model is downloaded once on first use; subsequent recognition is entirely on-device. When the system recognizer is used, audio is sent to Google's speech service under Google's own privacy terms.
iOS. Speech-to-text is handled by the Apple Speech framework, which may use either on-device or Apple-server recognition depending on iOS version and device. This is governed by Apple's privacy terms.

3.5 Device & diagnostic data

For security and stability we may log:

App version, OS version, and device model (sent with API requests for compatibility checks)
Crash reports and error stack traces (no personal content of your messages or transcripts)
Request timestamps and IP address at the server edge (held briefly for abuse prevention)

4. Legal bases (GDPR Art. 6)

Purpose	Legal basis
Creating and maintaining your account	Art. 6(1)(b) — contract
Providing exam grading and learning features	Art. 6(1)(b) — contract
Subscription & token billing	Art. 6(1)(b) — contract
Security, fraud prevention, abuse detection	Art. 6(1)(f) — legitimate interests
Service improvement (aggregated, non-identifying analytics)	Art. 6(1)(f) — legitimate interests
Compliance with legal obligations (e.g. tax)	Art. 6(1)(c) — legal obligation

5. Third-party processors

We use the following processors strictly to provide the App. Each is bound by a Data Processing Agreement.

Google Cloud / Vertex AI (Gemini). AI grading of Schreiben and Sprechen. Only the exam content (your answer text and the prompt) is sent — no name, email, or user ID. Governed by Google Cloud's Data Processing Addendum.
RevenueCat. Subscription and token-purchase management. RevenueCat receives an opaque user identifier and the store transaction metadata. See revenuecat.com/privacy.
Apple App Store / Google Play. Payment processing for subscriptions and token packs. Governed by Apple's and Google's own privacy terms.
Sign-in providers. Google Sign-In and Sign in with Apple, used only at the moment of authentication.
Hosting. Our backend runs on a European cloud provider; all your data is stored in the EU.

6. International data transfers

Some processors (notably Google Cloud) operate in regions outside the EU. We rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework to ensure an equivalent level of data protection.

7. Retention

Account data: kept while your account is active. Deleted immediately when you delete your account in the app.
Exam attempts & AI feedback: kept for the lifetime of your account so you can review your history.
Spoken transcripts: stored with the relevant attempt; deleted with the attempt.
Billing records: may be retained for up to 10 years as required by German tax law (§§ 147 AO, 257 HGB).
Server logs: rotated and deleted within 90 days.

8. Your rights under GDPR

You have the right to:

Access (Art. 15) — request a copy of the personal data we hold about you.
Rectification (Art. 16) — ask us to correct inaccurate data.
Erasure (Art. 17) — request deletion of your account and personal data.
Restriction (Art. 18) — limit how we process your data while a dispute is resolved.
Data portability (Art. 20) — receive your data in a machine-readable format.
Objection (Art. 21) — object to processing based on legitimate interests.
Complaint (Art. 77) — lodge a complaint with your local supervisory authority (in Germany: the Landesdatenschutzbeauftragte).

9. Deleting your account

How to delete your account. Open the app, go to Profile → Delete account, and confirm. Your account and all associated personal data (profile, learning progress, exam attempts, transcripts, AI feedback, token balance) are permanently erased from our servers immediately; the action cannot be undone. Subscription and token purchases are processed by Apple / Google and must be cancelled separately in your store account. Billing records held by the stores may be retained for tax-law reasons (see §7). If you cannot access the in-app option, email alphaexplorer@nubtech.org from your account email and we will perform the deletion on your behalf.

10. Children

Alphiox Learn German is intended for adult learners. We do not knowingly collect data from children under 13. If you believe a child has signed up, contact us at alphaexplorer@nubtech.org and we will delete the account.

11. Security

We use industry-standard safeguards including TLS in transit, encryption at rest for sensitive fields, hardened server configuration, and restricted access on a need-to-know basis. No system is perfectly secure; in the event of a personal-data breach affecting you, we will notify you and the competent supervisory authority as required by Art. 33 / 34 GDPR.

12. Cookies and web pages

The App itself does not use cookies. Our web pages (nubtech.org/alphiox-learn-german) use only technically necessary storage required for functionality. We do not run advertising cookies or third-party tracking.

13. Changes to this policy

We may update this Privacy Policy as the App evolves or as the law changes. Material changes will be announced inside the App or by email. The "Last updated" date at the top of this page indicates the latest revision.

14. Contact

Questions or to exercise any of your rights: alphaexplorer@nubtech.org. We will respond within 30 days.