Privacy Policy

Our Privacy Promise

This policy explains, in plain English, what Parloy collects, why we use it, and which service providers process it. Parloy is an English learning app for iOS operated by KNTC, Ruslan Sayfutdinov, Altenbacher Weg 18, 42799 Leichlingen, Germany.

Most important: we do not sell your personal data.

What You Should Know

  • Your account and learning progress are stored with our cloud provider so they are available across your devices.
  • Parloy uses Google Analytics for Firebase, the Meta SDK, and the TikTok SDK to measure app usage, attribute installs, and deliver and measure advertising.
  • On iOS we ask for your permission through Apple's App Tracking Transparency prompt before using your device identifier (IDFA) for cross-app tracking. If you decline, no IDFA is used.
  • You can request access, correction, export, restriction, or deletion of your personal data.

Data We Collect

Account data

Your account identifier, sign-in details, email address, and app settings, used to authenticate you and provide the service.

Learning data

Lessons completed, answers, vocabulary you practice, streaks, levels, scores, and study preferences. We use this to run the learning experience, adapt difficulty, and show your progress.

Subscription data

Subscription status and purchase information needed to unlock paid features. Apple handles App Store payments; we do not receive your full payment-card details.

Usage, diagnostic, and device data

Feature interactions, screen views, session information, app version, device model, operating system version, language and approximate region derived from your IP address, coarse advertising identifiers, and technical errors and crashes.

Advertising and attribution data

Events such as app install, registration, trial start, subscription, and other conversion events, plus identifiers used to attribute them to an ad campaign. Where you have permitted tracking, this may include your Apple advertising identifier (IDFA). Where you have not, we rely on privacy-preserving measurement such as Apple's SKAdNetwork.

Support messages

Information you send us when you ask a question or report a problem.

Analytics and Advertising SDKs

Parloy includes the following third-party SDKs:

  • Google Analytics for Firebase — measures how the app is used, which features are opened, and where errors occur, and helps us measure ad performance.
  • Meta SDK (Facebook, Instagram) — measures the performance of our ads on Meta platforms, attributes installs and conversion events, and can be used to build audiences for advertising.
  • TikTok SDK — measures the performance of our ads on TikTok, attributes installs and conversion events, and can be used to build audiences for advertising.

These SDKs receive event data and technical identifiers such as an app instance ID, device and OS information, and, if you have allowed tracking, the IDFA. Meta and TikTok act as independent controllers or joint controllers for parts of this processing under their own terms and privacy policies: Meta Privacy Policy, TikTok Privacy Policy, Google Privacy Policy.

Advertising and non-essential analytics are used only with your consent, which we request in the app and, on iOS, through Apple's App Tracking Transparency prompt. You can withdraw consent at any time in Settings → Privacy & Security → Tracking on your device, and you can limit personalized ads in Settings → Privacy & Security → Apple Advertising. Withdrawing consent does not affect processing that took place before.

Google, Meta, and TikTok may process data outside the European Economic Area, including in the United States. For those transfers we rely on appropriate safeguards, in particular the European Commission's Standard Contractual Clauses incorporated into the providers' data-processing terms, and, where applicable, the EU-U.S. Data Privacy Framework.

Why We Process Data

Our legal bases under the GDPR depend on the purpose:

  • Contract performance (Art. 6(1)(b)): account operation, storing and syncing your learning progress, and subscriptions.
  • Legitimate interests (Art. 6(1)(f)): service security, fraud prevention, essential diagnostics, and improving reliability. We balance these interests against your rights.
  • Consent (Art. 6(1)(a)): advertising, attribution, cross-app tracking, optional analytics, and marketing communications. You may withdraw consent at any time.
  • Legal obligation (Art. 6(1)(c)): records we must keep to comply with law, such as tax records.

Service Providers and Subprocessors

  • Google LLC / Google Ireland Limited (Firebase) — authentication, database and file infrastructure, cloud functions, crash reporting, and Google Analytics for Firebase.
  • Meta Platforms, Inc. / Meta Platforms Ireland Limited — advertising, install attribution, and conversion measurement.
  • TikTok Technology Limited / ByteDance group — advertising, install attribution, and conversion measurement.
  • Apple Inc. — App Store purchases, Sign in with Apple, and SKAdNetwork attribution when you use those services.

We may update this list when our providers change. Material changes will be reflected on this page.

Retention

We keep account and learning data while your account remains active and as needed to provide the service. You can delete your account in the app or ask us to delete your data. Analytics and advertising event data are retained for the periods set by the respective providers, typically between 2 and 26 months. Some records may remain for a limited period in backups, security logs, or where law requires us to keep them.

Children

Parloy is not directed at children under 16. We do not knowingly collect personal data from children under that age without parental consent. If you believe a child has provided us with personal data, contact us and we will delete it.

How We Protect Data

Encryption in transit using HTTPS/TLS

Encryption and security measures for data stored by our cloud providers

Authentication, access controls, monitoring, and security updates

No system can guarantee absolute security, but we use technical and organizational measures appropriate to the risk.

Your Rights

Subject to the GDPR's conditions and exceptions, you may:

  • Access your personal data and receive a copy
  • Correct inaccurate or incomplete data
  • Request erasure of your data
  • Restrict processing or object to certain processing
  • Receive data you provided in a portable format
  • Withdraw consent without affecting earlier lawful processing
  • Complain to a competent data-protection authority

Contact

For privacy questions or to exercise your rights, contact:

Last updated: September 3, 2026