Privacy policy

This policy describes what personal data the Greenlight app ("the app") processes and why. It is written in line with Regulation (EU) 2016/679 (GDPR).

1. Data controller

The data controller is Dariusz Biel, Stryszów 361, 34-146 Stryszów, Poland, VAT ID (NIP): 5512550284. For any data-protection matter contact [email protected].

2. What data we process

• Account data: e-mail address and password. Passwords are never stored in plain text; we keep only a cryptographic hash (bcrypt). If you sign in with Apple or Google, we store the identifier assigned by that provider instead of a password, and your e-mail address comes to us from Apple/Google. That is all they share with us. An e-mail address is required to create an account.
• Learning profile: chosen level (A1-C1), comfort threshold, learning goal, favourite genres, daily time goal and time zone, used for vocabulary selection and statistics.
• Personal dictionary and progress: words you know or are learning with their spaced-repetition state, watched-episode history, flashcard sessions and stored episode-analysis results (Gap Check).
• In-app events: basic product events (e.g. the purchase screen being shown) stored on our servers and linked to the account, used solely to improve the app and deleted together with the account.
• Suggestions and votes: titles you suggest for the library and your votes on community suggestions.
• Subscription status: whether you have an active Pro plan. Billing is handled by the App Store; we never receive or store your card details.
• Diagnostics: on a crash the app sends an error report (account identifier, device model, OS and app version, technical error details); performance of a sample of ordinary requests is also measured. Reports contain neither your e-mail address nor your learning content.

3. We author the learning content ourselves

Each show's dictionary is prepared individually. With the help of AI tools we create the Polish translations, usage notes and original example sentences, which we then curate. Everything you see on flashcards is our own content; the app neither stores nor provides any material from the shows. This editorial work does not involve your personal data.

4. Purposes and legal bases

• Providing the service (account, syncing your dictionary and progress, episode analysis): Art. 6(1)(b) GDPR (contract).
• Handling the Pro subscription: Art. 6(1)(b) GDPR. The payment itself is processed by Apple under its own terms.
• Account-related messages (welcome, password reset, account deletion confirmation): Art. 6(1)(b) and (f) GDPR. We send no newsletter and no marketing e-mail.
• Security, bug fixing and product improvement (crash reports, product events, login-attempt limiting): Art. 6(1)(f) GDPR (legitimate interest).
• Complaints and legal obligations: Art. 6(1)(c) GDPR.

5. Sessions and security

We keep you signed in with tokens (JWT and rotating refresh tokens); the database stores only their hashes. On the device, tokens live in the system Keychain. Changing your password or signing out everywhere invalidates all active sessions. Password-reset links are single-use and expire after 15 minutes. Data in transit is encrypted (TLS).

6. Analytics and tracking

The app contains no third-party analytics or advertising SDKs and does not track you across apps; it uses neither the microphone, nor location, nor your contacts. The only "analytics" are the first-party product events described above, stored on our own servers. This website may use Google Analytics, but only with your consent: without it the Google script is not loaded at all and the site sets no cookies. You can withdraw consent at any time on the cookie policy page.

7. Data recipients

We use trusted providers acting on our behalf:

• Hetzner Online GmbH (Germany, EEA): application servers and database;
• Functional Software, Inc. (Sentry): error reports and performance data; stored in the EU region (Germany);
• Resend, Inc. (USA): delivery of account-related e-mails;
• Apple: app distribution and payments; for the App Store and Sign in with Apple, Apple acts as an independent controller (as does Google for Google sign-in);
• TVmaze: show posters load directly from TVmaze servers, so displaying them reveals your IP address to TVmaze (as with opening any website).

We do not sell data and do not share it for marketing purposes.

8. Transfers outside the EEA

As a rule we process data within the European Economic Area. The exception is e-mail delivery via Resend (USA), based on the adequacy decision for the EU-US Data Privacy Framework and, failing that, on standard contractual clauses.

9. Retention

Account and progress data are kept for as long as you have the account. Deleting the account in the app permanently removes the data linked to it; we use your e-mail address once more to send the deletion confirmation, and any show suggestions you submitted remain in anonymised form. Error reports expire per Sentry's retention (up to 90 days). Information we must keep for legally required periods (e.g. billing) is kept for those periods.

10. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection. You can delete the account in the app (Profile) or by writing to [email protected]. A copy of your data (profile, dictionary, watched episodes and statistics; other categories on request) is available by writing to the same address, within a month at the latest. You may also lodge a complaint with the President of the Polish Data Protection Office (UODO, uodo.gov.pl).

11. Children

The app is intended for people aged 13 or older; minors use it with the knowledge and consent of a guardian (see the terms of service). We direct no marketing at children.

12. No profiling

We make no decisions about you based solely on automated processing that would produce legal or similarly significant effects. Vocabulary selection serves only to personalise learning.

13. Changes to this policy

We will announce material changes in the app or on this page. The date at the top marks the last update.