Oktopus1. Controller
The controller is the provider of Oktopus; name, address and contact details are in the legal notice (Impressum). Send privacy questions to the address given there.
2. What data we process
Account data: email address, name and profile picture (taken from Google or Apple when you sign in with them). Learning data: your answers, results, progress, saved exercises and words, your settings, your exam date if you choose to give it (for reminders before it), and your consent to the terms of use. AI content: your texts and speaking recordings when you have them graded. The Oktopus assistant: it answers questions about the app on your device, where the chat history stays; questions it cannot answer are stored without any link to your account so we can add answers; questions to Oktopus AI Advanced are sent to the AI to be answered. AI usage data: for each AI request the feature, its size (tokens processed), its cost and the credits charged, to calculate and settle credits. Purchases: plan and purchase status, no payment details. Notifications: your device's notification token with its platform and language, your time zone (so reminders come at your local time) and which reminder was sent when; you can turn them off in the app and in your device's settings. Technical data: device and app checks (Firebase App Check) against abuse.
3. Purposes and legal bases
We process the data to provide the app to you (Art. 6(1)(b) GDPR), to protect it against abuse (point f), and for ads on the FREE plan only with your consent (point a), which you can withdraw at any time. We do not sell data.
4. Recipients
Google (Firebase for sign-in, database, storage, functions and notifications; AI services of Google Cloud (Vertex AI) for AI grading and Oktopus AI Advanced; AdMob for ads on the FREE plan), and Apple and Google for purchases (our server checks each purchase with them directly). Data processing agreements are in place with these services. Transfers to the USA rely on the EU-US Data Privacy Framework or standard contractual clauses.
5. Retention
We keep account and learning data until you delete your account. With your account we keep a one-way hash of your mailbox (it does not reveal the address), so that one mailbox receives the welcome credits only once. When you delete your account, we keep for at most 30 days a one-way hash of your email address (it does not reveal the address) and the date your free credits would have renewed, so that deleting and re-creating an account does not grant new free credits. For the same time, at most 30 days, we keep with that hash the credit balance left on the account when you deleted it and the deleted account's internal ID (without name or email address), only to give it back to you if you sign up again with the same email address, and to settle correctly a store refund of one of that account's purchases; for that we keep the ID even when no credits were left. The record is deleted as soon as the credits are given back, and otherwise automatically when the time is up (legal basis: our legitimate interest in preventing abuse and in returning your credits, Art. 6(1)(f) GDPR). If refunds of credits already used were recorded on the account in the last 90 days, or its purchases were paused or blocked, we keep with that hash for one year this status and the IDs of those refunds, and for as long, which account a deleted account's credits were given back to (internal IDs only), so that deleting and re-creating an account does not get around the refund rules (legal basis: our legitimate interest in preventing abuse, Art. 6(1)(f) GDPR). If the account bought something in the App Store or on Google Play within the last year, we keep the hash, the deleted account's internal ID and which account its credits were given back to for one year as well, because a store may still refund a purchase in that time and we settle it on that record; the credit balance itself is given back only within the 30 days (same legal basis). Records we must keep by law, namely purchases, refunds, licences and the credit ledger, stay under the deleted account's internal ID, without name or email address, for as long as German commercial and tax law requires (up to ten years; legal basis: legal obligation, Art. 6(1)(c) GDPR). Speaking recordings are deleted automatically after a fixed period (currently 30 days); the text, grade and notes remain. The dictionary keeps your searches on your device only. It translates sentences on the device (Google ML Kit); each language is downloaded once from Google, which sees your IP address, and the translated text never leaves the device.
6. Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection, and to withdraw consent. You can delete your account and its data in the app at any time. You may complain to a data protection supervisory authority.
7. Children
Oktopus is meant for people aged 16 and over. Younger people may only use it with their parents’ consent.
8. Changes
We update this policy when the app or the law changes. The current version is always in the app.