Privacy policy

Data minimisation isn't an afterthought at VocaBox: the app works without a user account, your vocabulary stays on your device, and I use neither tracking nor advertising. This policy applies to the website www.vocabox.app and the VocaBox app for iOS and Android.

1. Controller

Marcel Breska, Sperlingstr. 4, 82377 Penzberg, Germany.
Email: support@vocabox.app. Further details are in the imprint.

2. The website

Hosting and server log files

This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. When you open the site, the server automatically processes technical data that your browser transmits, in so-called server log files: IP address, date and time of access, the page requested, the amount of data transferred, the previously visited page (referrer), as well as your browser type and operating system. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in the secure and stable operation of the website. This data is deleted after a short time. A data processing agreement under Art. 28 GDPR is in place with Hetzner.

Cookies, analytics, advertising

The website is static. It sets no cookies, embeds no analytics, tracking or advertising services, and loads no third-party content that transmits personal data. There is no audience measurement and no profiling.

3. The app

Local storage of your data

All content you create in the app – boxes, vocabulary, images, learning progress, statistics and settings – is stored exclusively locally on your device. There is no user account and no cloud synchronisation operated by me; I have no access to this data. Backup files (.vbxbackup) and shared vocabulary files (.vbxshare) are created by you and passed on by a means of your choice (e.g. AirDrop, messenger or email) – that, too, does not go through me.

Translation feature (Microsoft Translator)

When you use the translation feature, the text to be translated is processed in order to show you a translation. On iOS – provided your device supports it – Apple's on-device translation is used; the text then does not leave your device. Otherwise (in particular on Android and for languages not supported on-device), the text to be translated is transmitted to the Microsoft Translator service (Microsoft Azure) to retrieve the translation. The provider is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA, or Microsoft Ireland Operations Ltd. Only the text to be translated together with the language indication is transmitted; no account or device identifiers that would identify you are sent. The legal basis is Art. 6(1)(b) and (f) GDPR (provision of the feature you invoked and the legitimate interest in a working translation). Information on data protection at Microsoft: privacy.microsoft.com. Please do not enter sensitive personal data into the translation field.

Purchases

One-time in-app purchases are handled via the Apple App Store or Google Play. Payment processing and the associated data processing are carried out by Apple or Google; I receive no payment data. The privacy notices of Apple and Google additionally apply.

Permissions on the device

For individual features the app may ask you for permissions – for example access to photos or the camera to add an image to a word, or permission for notifications to remind you of due repetitions. This data is used only locally for the respective feature and is not transmitted to me.

No analytics, no tracking, no advertising

The app contains no analytics, tracking or advertising components. I do not measure usage behaviour and create no profiles.

4. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and a right to object (Art. 21). Since your app content resides exclusively on your device, you can view, change and delete it yourself at any time – including by uninstalling the app. For requests to the controller, an informal message to the email address above is sufficient.

5. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for me is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

6. Changes

I will adapt this privacy policy if the legal situation or my processing changes. The version published on this page at the time applies.