Privacy Policy

Effective date: July 30, 2026

Dubara / Learn by Translating ("the service", "we") helps you learn languages by translating sentences and reading news articles. This policy explains what personal data we process, why, on what legal basis, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR).

Who is responsible (controller)

The controller responsible for your data is Soner Sahin (Germany). Full contact details and the postal address are listed in our Impressum. You can reach us any time at info@dubara.io.

What we collect

  • Account data — your email address (or the identity from Sign in with Apple / Google) and a random user identifier.
  • Learning content — the translations you type, words you save, your language pair, level, topics, points, and streaks.
  • Subscription status — whether you have an active subscription, tied to your user identifier. We never see or store your payment card details.
  • Usage & analytics data— on the website, if you accept analytics in the cookie banner (see "Analytics and cookies" below), we measure which pages and features are used and counts of key actions to understand how the service is used and improve it. No analytics runs on the web until you opt in. In the iOS app, we collect which features you use (e.g. completing a practice session), your subscription tier, and app lifecycle events, tied to your user identifier.

Why we process it and the legal basis

  • Providing the service — creating your account, saving your learning progress, grading your translations, and generating exercises. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
  • Payments and subscriptions — processing purchases and keeping your subscription status current. Legal basis: performance of a contract (Art. 6(1)(b)).
  • Analytics — measuring usage to improve the product. On the website, analytics runs only after you opt in via the cookie banner; legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time. In the iOS app, legal basis: our legitimate interest in understanding and improving the product (Art. 6(1)(f)); you can object at any time by contacting us.
  • Security and abuse prevention — rate-limiting and protecting the service from misuse. Legal basis: our legitimate interests in keeping the service secure and available (Art. 6(1)(f)).

Service providers and sub-processors

We use the following providers to run the service. Some process data outside the EU (see "International transfers").

  • Supabase — backend, authentication, and database. Location: EU (Frankfurt, Germany).
  • OpenAI and OpenRouter— AI grading and content generation. The sentences you translate, the words you tap, and your messages to the AI tutor are sent to these providers to grade your translations, hold tutor conversations, and produce exercises, hints, and speech. Tutor messages are also screened by OpenAI's content-moderation service to keep conversations safe. These requests contain only the learning content needed for the feature — never your email or identity. Location: United States.
  • PostHog Inc. — product analytics for the website (including session replay, used only after you opt in via the cookie banner) and for the iOS app. Location: European Union (EU-hosted, Frankfurt / eu.posthog.com).
  • Vercel — website hosting. Location: United States.
  • RevenueCat — subscription management for the iOS app. Location: United States.
  • Paddle — payment processing and merchant of record for web purchases. Location: United Kingdom / United States.

International transfers

Where providers process data in the United States or United Kingdom, the transfer is protected by appropriate safeguards under GDPR Chapter V — Standard Contractual Clauses (SCCs) and, where applicable, the EU–US Data Privacy Framework. You can request more information about these safeguards by contacting us.

How long we keep your data

  • Account and learning data — for as long as your account exists. When you delete your account we remove it within 30 days, except where we must keep certain records longer to meet legal obligations (for example, payment and tax records).
  • Analytics data — analytics events are linked to a pseudonymous account identifier (a random ID — never your name or email) and are retained by PostHog for up to 7 years, or until you delete your account, whichever comes first. Deleting your account also erases your analytics profile and its events.

Analytics and cookies (web)

On the website, we use PostHog for product analytics (including session replay), hosted in the EU (Frankfurt / eu.posthog.com). PostHog is gated behind an opt-in consent banner: no analytics runs, no analytics cookies or local storage are set, and no analytics network requests are made until you actively accept. If you reject, or before you make a choice, nothing analytics-related loads. Your choice is remembered on your device, and you can change it at any time by clearing that stored choice. The legal basis for this processing is your consent (GDPR Art. 6(1)(a)).

What we don't do

  • We do not sell your data.
  • We do not use advertising SDKs or profile you for advertising.
  • We do not collect your precise location, contacts, or photos.

Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, and port your personal data, and to object to processing based on legitimate interests. Where processing is based on consent, you can withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

You can delete your saved words and attempts in the app, and you can delete your entire account and its data directly from your profile in the iOS app. To exercise any other rights, contact us at info@dubara.io and we will act within 30 days.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement.

Children

The service is not directed at children under 16.

Changes to this policy

We may update this policy as the service evolves. We will update the effective date above when we do.

Contact

info@dubara.io

Note: this policy is provided in good faith and should be reviewed by a qualified data protection lawyer before launch to confirm it fully reflects your processing and legal obligations.