Bingua is a language-learning app provided by Andres Brockmann, who owns the service and holds the Apple Developer account under which it is distributed. Its day-to-day operation, technical administration and user support are carried out from the Netherlands by Sebastian Brockmann.
For the purposes of the EU General Data Protection Regulation (GDPR), Andres Brockmann and Sebastian Brockmann are joint controllers of the personal data described in this policy. In substance: Andres Brockmann determines why Bingua processes personal data, and Sebastian Brockmann determines how — which providers are used, what is collected, and how long it is kept. Sebastian Brockmann handles all communication with users about their data. You may exercise any of the rights in §10 against either of us, and the single contact point for every request is sebabrockmann@gmail.com.
| Joint controller (owner) | Andres Brockmann Cond. Alto Las Palmas 204-2 Av. Piraí esq. 6to Anillo, Zona Norte Santa Cruz, Bolivia +591 69076996 |
|---|---|
| Joint controller (operator) | Sebastian Brockmann Enschede, Netherlands |
| Contact for all data protection matters | sebabrockmann@gmail.com |
| Data protection officer | None appointed — we are not required to appoint one under GDPR Article 37. |
This policy explains what personal data Bingua processes, why, on what legal basis, who it is shared with, how long it is kept, and what rights you have.
The table below is the complete picture. "Install ID" means a random identifier generated on your device the first time you open Bingua — it is not an advertising identifier, a hardware serial, or anything derived from your device or your identity.
| What we do | Data involved | Legal basis (GDPR Art. 6) | How long |
|---|---|---|---|
| Run the app for you, including as a guest with no account | Your flashcards, preferences, streak, XP, saved videos and watch history — stored on your device only | Performance of a contract, Art. 6(1)(b) | Until you delete the app or use its reset function |
| Create your account and sync your learning data so it can be restored | Email address, hashed password (or your Google/Apple sign-in identity, which can include your name), account ID, and the learning data listed above | Performance of a contract, Art. 6(1)(b) | Until you delete your account |
| Generate AI explanations of a word or sentence you tapped | The tapped word, the subtitle sentence and its translation (all public video content), plus your install ID and — if signed in — your account ID | Performance of a contract, Art. 6(1)(b) | Not stored — neither by us nor by our AI provider (§5). |
| Prevent abuse of our AI services and servers | Install ID, account ID, request counters, IP address (short-lived, for rate limiting) | Legitimate interests, Art. 6(1)(f) — specifically: protecting our servers from abuse, and controlling AI costs that would otherwise make the service unsustainable | Request counters are kept indefinitely (see §6). Rate-limit records expire within 24 hours. |
| Provide and manage your subscription | Purchase receipt, a pseudonymous subscription ID, install ID, subscription status | Performance of a contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c), for records our processors must keep | For the life of the subscription and as long as our provider's records require |
| Understand how the app is used, so we can improve it | Product events (e.g. "video watched", "quiz completed"), install ID, account ID once signed in, app version, device model, OS version, language, timezone, and a country derived from your IP address by our analytics provider. Two of these events — tapping a word for a translation, and saving a word as a flashcard — also include the word itself, so we can see which vocabulary learners actually reach for. These are words from the public subtitles of the videos in the app; nothing you type is ever included | Legitimate interests, Art. 6(1)(f) — specifically: understanding which features are used and where users get stuck, in order to improve the app. You can object at any time using the switch in Profile → Privacy (see §8). | 12 months |
| Act on reports about inappropriate videos | The reason you selected, your optional note, the video ID, and your account ID if signed in | Legitimate interests, Art. 6(1)(f) — specifically: keeping the video catalogue appropriate for learners | Kept for moderation. Your account ID is removed if you delete your account. |
| Speaking practice | Your voice, processed by your device's own speech-recognition service (Apple or Google) | Consent, Art. 6(1)(a) — given through the operating system's microphone permission, withdrawable in your device settings | We never receive or store your audio. See §7. |
| Daily reminders | None — reminders are scheduled locally by your device | Consent, Art. 6(1)(a) — the notification permission | Nothing leaves your device; no push service is used |
Do you have to give us this data? No. Bingua is fully usable as a guest, and providing an email address is neither a statutory nor a contractual requirement for that. An email address is required only if you want an account. Without one the app works exactly the same, but your data stays on this device and cannot be restored if you lose it.
Withdrawing consent. Where we rely on consent, you can withdraw it at any time (for example by revoking the microphone or notification permission in your device settings). Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.
We use the service providers below to run Bingua. They process data on our instructions under a data processing agreement. We do not sell personal data, and we do not share it for advertising.
| Provider | What they do for us | Where | Transfer basis |
|---|---|---|---|
| Supabase (database & sign-in) | Stores your account and synced learning data | United States (AWS us-east-1) |
Standard Contractual Clauses |
| PostHog (usage analytics) | Product analytics events | European Union | No transfer — data stays in the EU |
| Groq (AI) | Generates word and sentence explanations | United States | Standard Contractual Clauses (Module 2), under Groq's Data Processing Addendum |
| RevenueCat (subscriptions) | Manages subscription status and receipts | United States | Standard Contractual Clauses |
| Cloudflare (content delivery) | Serves subtitle files and video lists | Global network | Standard Contractual Clauses |
| Expo (app updates) | Delivers app updates. When the app checks for one it sends an anonymous installation ID and your IP address; no account data and no learning data are involved | United States | Standard Contractual Clauses |
| Apple | Sells and bills the subscription; App Store distribution; speech recognition on iOS | Ireland / United States | Apple acts as an independent controller under its own privacy policy |
| Google / YouTube | Embedded video playback; optional Google sign-in; speech recognition on Android | United States / global | Google acts as an independent controller under its own privacy policy |
We may also disclose personal data where we are legally required to do so.
Some of the providers above are located outside the European Economic Area, in countries for which the European Commission has not issued an adequacy decision. Those transfers are made under the European Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR), together with the supplementary measures our providers apply. You may obtain a copy of the safeguards in place for any of these transfers by emailing us at sebabrockmann@gmail.com.
Where we ourselves are. Bingua's systems are administered from the Netherlands, and all access to your personal data by us takes place from within the European Economic Area. Andres Brockmann, the joint controller based in Bolivia, holds no account with our database, analytics or AI providers and does not access user records. Should that ever need to change, we will put an appropriate Article 46 GDPR transfer safeguard in place and update this policy before it takes effect.
Bingua uses YouTube API Services to show videos. Lessons play inside YouTube's official embedded player.
When a video loads, YouTube and Google receive the information any connection to their servers involves — including your IP address, device and browser characteristics — and the embedded player may store information on, or read information from, your device (for example cookies or similar identifiers set by YouTube inside the player). This happens under Google's own responsibility as an independent controller, and we neither control nor receive that data.
Google's handling of that information is described in the Google Privacy Policy. Your use of the embedded player is also subject to the YouTube Terms of Service.
Bingua itself does not request or receive any YouTube account data, and never asks you to sign in to Google in order to watch. We do fetch public information about videos — their titles and thumbnails — to display them in the app.
When you tap a word, or open a sentence breakdown, Bingua sends that word or sentence — together with the surrounding subtitle line and its translation, all of which are public video content — to our servers, which forward it to Groq to generate the explanation. Your install ID travels with the request so we can rate-limit it and prevent abuse, and your account ID does too if you are signed in.
We never send anything you have typed — the request contains only subtitle text and the word you tapped.
Under our agreement with Groq:
Explanations are generated fresh each time and are not stored by us in a form linked to you. If you save a word or sentence as a flashcard, the explanation is saved into that card — which is your data, on your device and (if you have an account) in your account.
Everything on your device — flashcards, preferences, streak, XP, saved videos, watch history — remains until you delete the app or use the reset function inside it.
Your email address and all synced learning data are deleted from our database when you delete your account (Profile → Delete account, or by emailing us). Copies may persist in encrypted backups for up to 30 days before being overwritten.
Rate-limiting records expire within 24 hours. Analytics events are deleted by our analytics provider after 12 months.
Speaking exercises use your device's built-in speech recognition. Depending on your device and settings, your voice audio may be sent to Apple or Google for processing under their own privacy policies — this is the operating system's own service, not ours.
Bingua receives only the recognised text, compares it on your device to score your pronunciation, and then discards it. We never receive, store, or transmit your audio, and we never store the transcript. The microphone is active only while a speaking exercise is running, and only after you have granted permission, which you can revoke at any time in your device settings.
We use PostHog (hosted in the European Union) to record a small, fixed set of product events — things like "a video was watched", "a quiz was completed", "the paywall was shown". Each event carries your install ID, your account ID once you sign in, and basic app and device context. PostHog derives an approximate country from your IP address.
We deliberately do not collect: anything you type, the content of your notes, your email address, precise location, or any advertising identifier. We do not use session recording or screen replay. We do not track you across other apps or websites, and Bingua contains no advertising or third-party tracking SDKs.
To switch analytics off: open Profile → Privacy and turn off Share usage data. While it is off, the analytics service is not started at all and nothing is sent from your device. This is also how you exercise your right to object under Article 21 GDPR; you can alternatively email us.
Bingua personalises your video feed: it weights which videos to show you based on the topics you chose during onboarding, your stated level, and which videos you have already watched. This is profiling in the sense of Article 4(4) GDPR, and we want to be transparent about it.
It is not automated decision-making within the meaning of Article 22 GDPR: it produces no legal effects and nothing similarly significant — at most, a different video appears next. We do not carry out any Article 22 automated decision-making.
Under the GDPR you have the right to:
To exercise any of these, email sebabrockmann@gmail.com. We will respond within one month, as required by Article 12(3) GDPR.
You also have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens — autoriteitpersoonsgegevens.nl. You may also complain to the authority in your own country of residence.
Open Profile → Delete account in the app and confirm. This permanently deletes your account and all synced data — flashcards, preferences, usage, XP, saved videos and watch history — from our database. You can also request deletion by email.
Two things deletion does not do, so there are no surprises:
Bingua is not intended for children. In the Netherlands, the age at which a person can consent to online services on their own is 16. You must be at least 16 years old to use Bingua. We do not knowingly process personal data from anyone under 16; if you believe a child has provided us with personal data, contact us and we will delete it.
Account data is protected by row-level access rules that restrict every record to its owner, passwords are stored hashed, and all connections use TLS encryption. Our AI, analytics and subscription providers are bound by data processing agreements. No system is perfectly secure — which is why the strongest protection here is that we collect as little as possible, and why the app works fully without an account at all.
We may update this policy as Bingua develops. The version number and date at the top always identify the current version. If we make a material change — for example adding a new purpose or a new category of data — we will tell you in the app before it takes effect.
For anything to do with your data, email sebabrockmann@gmail.com — this reaches both joint controllers and is the fastest route to a reply.
Andres Brockmann (owner)
Cond. Alto Las Palmas 204-2, Av. Piraí esq. 6to Anillo, Zona Norte
Santa Cruz, Bolivia
+591 69076996
Sebastian Brockmann (operator)
Enschede, Netherlands
sebabrockmann@gmail.com