AILA

Deutsche Fassung: Datenschutzerklärung. If the two versions differ, the German text prevails.

Privacy policy

Last updated:

This policy describes the personal data processed when you use the AILA learning app and when you open this website. The EU General Data Protection Regulation (GDPR) applies. German data-protection law, in particular the Federal Data Protection Act (BDSG), applies alongside it.

1. Controller

Niklas Galli
Sole proprietor
Niklas Galli – AILA
Neuburger Straße 73a
86668 Karlshuld
Germany

Product name: AILA. Email: niklas.galli@getaila.de. No telephone number is published. Please use the email address.

2. What this policy covers

AILA is a learning app for iOS and Android. This policy covers the processing in that scope: reading progress, personalization, an optional name, settings, and a cache on the device, loading public content from this repository, paid use through the Apple App Store or Google Play including a seven-day trial where the store offers it, checking subscription status through RevenueCat, delivering app updates through Expo, local notifications, email to the controller, and visits to this website.

This website publishes the product page for the app, the privacy policy, and the legal notice. It is a static site hosted on GitHub Pages.

3. Processing

3.1 Reading progress, settings, and cache on the device

The app stores reading progress, personalization, settings, and a cache locally on your device, using AsyncStorage. That data stays on the device. It is not sent to the controller. He does not keep a copy.

You may enter a name in settings. The name is optional. The app does not require one. The name stays only on the device, also in AsyncStorage, and is not sent to the controller. There is no quiz, and the app does not ask you to pick a time for the reminder.

The purpose is the learning function of the app: progress, personalization, an optional name, and settings remain available on the same device, and content that was already loaded can be shown from the cache. The legal basis is Article 6(1)(b) GDPR, because storage is necessary to provide the app you asked for.

The data stays on the device until you remove the app data or uninstall the app. The control for that is in the operating system, not on a server of the controller. Because he does not receive the data, he cannot delete it from a server or hand it over from one.

3.2 Public content (pulse.json and briefing.json)

The app loads public content directly from your device at these addresses:

The files contain editorial articles and the daily briefing. They do not contain personal data of people who use the app. When a file is requested, GitHub receives the connection data needed to open the address, in particular the IP address, date and time, and the details your device sends to make the connection. The request goes directly from your device to GitHub. This repository does not build a profile about you from that request. The controller does not run his own server for the request.

The purpose is to show the learning content and the briefing in the app. The legal basis is Article 6(1)(b) GDPR. The recipient of those connection data is GitHub, Inc., a Microsoft company, established in the United States. GitHub processes them as its own controller. Section 4 explains the transfer.

3.3 Subscriptions through the Apple App Store and Google Play

Paid use is offered through the Apple App Store or Google Play, including a seven-day trial where that store offers it for the account. The contract and the payment are made with that store, not on this website. The stores may ask for a payment method for the trial.

Apple or Google processes the data needed for that, such as the store account, the purchase, and the subscription status, as its own controller. The controller does not receive your payment-card number. Whether a store shares particular purchase or contact details with him depends on that store’s settings and on the choice you make there.

The purpose is to enter into and perform the subscription. The legal basis is Article 6(1)(b) GDPR. The stores’ own notices:

The controller does not store payment-card data himself. Apple and Google decide how long they keep purchase data.

The app checks the status of the trial and the subscription through RevenueCat. Section 3.4 describes that.

3.4 Subscription status through RevenueCat

The app asks RevenueCat whether the trial or the subscription is unlocked. RevenueCat, Inc., United States, processes this data as a processor for the controller. The data are an anonymous identifier of app use, purchase receipts and transaction data, the status of the trial and the subscription, and device and app details such as device type and operating system. In its privacy policy, RevenueCat names among that data the Apple receipt file, the Google purchase token, and the time the app was last seen.

The purpose is to perform the contract for the trial and the subscription. The legal basis is Article 6(1)(b) GDPR. Payment and the store account remain with Apple or Google, as section 3.3 describes. The controller does not store the data processed at RevenueCat on a server of his own.

The data are transferred to the United States. RevenueCat’s privacy policy states that it stores them on Amazon Web Services in the United States. For a transfer from the European Economic Area, the data processing addendum makes available the European Commission’s standard contractual clauses (Implementing Decision 2021/914, module 2, where the controller transfers the data as controller). Sub-processors are listed in that addendum.

Under the data processing addendum, the data stay stored until RevenueCat’s service ends. If the controller asks within thirty days after that end, RevenueCat deletes the data or returns them. That is subject to ordinary backup and archive copies. The privacy policy also provides for storage where it is required for legal duties, resolving disputes, and enforcing agreements. RevenueCat describes a period of six years after an account ends for people who have an account of their own with RevenueCat. The data described here are an anonymous identifier and the purchase data, not the sign-in details of such an account.

3.5 App updates (EAS Update)

The app asks Expo for updates to the program files. The service is called EAS Update. A new version of the app logic can be loaded that way, without the store providing a new installation. The provider is 650 Industries, Inc., United States. The request goes from the device to Expo’s servers.

The request transmits the IP address, the device platform, and the app and runtime version. The runtime version names the native build the update must match. Expo additionally describes the contents of such a request as the operating system, the project identifier, and a random token for the installation. Expo states that this token is not an advertising identifier.

The purpose is to keep the app secure and up to date. The legal basis is Article 6(1)(f) GDPR. The legitimate interest is closing faults and security gaps in the app that has been shipped. You can object to the processing; see section 6.

Expo processes the request in order to deliver the update. In its explanation of end-user data, Expo describes itself as a processor for that. For aggregated details, or details from which identifiers have been removed, where they are still personal data under the GDPR, Expo describes itself in its terms of service as its own controller. In its privacy policy, Expo states that it complies with the EU-U.S. Data Privacy Framework and that it has self-certified to that framework. For transfers, the same policy names standard contractual clauses or other appropriate mechanisms where applicable law requires them. Expo’s privacy policy states that it keeps information only for as long as necessary for the purposes described there.

3.6 Local notifications

The app can schedule notifications locally on the device. That requires permission from the operating system. No device token is sent to the controller, and he does not run a notification server.

The app schedules at most one reminder a day. It takes the time from recent opens, not from a clock you pick. There is no time picker and no quiz.

The legal basis is your consent through the system prompt, Article 6(1)(a) GDPR. You can withdraw consent by turning off notifications for AILA in the iOS or Android settings. Withdrawal applies going forward.

3.7 Email to the controller

If you write to niklas.galli@getaila.de, the controller processes your email address, the message, and his reply in order to handle the request.

The legal basis is Article 6(1)(b) GDPR when the message concerns the contract or the app, and otherwise Article 6(1)(f) GDPR. The legitimate interest is answering enquiries. Where commercial or tax retention duties apply, Article 6(1)(c) GDPR is an additional legal basis.

Correspondence is kept for as long as handling the request and any statutory retention period require, and is then deleted.

3.8 This website

These pages are static files delivered through GitHub Pages. Their own code sets no cookies and uses no analytics tool. There is no consent banner for that reason. When you open a page, GitHub Pages receives the connection data the request requires, in particular the IP address.

The product page may request the public file briefing.json from the address in section 3.2, in order to show up to three items from that day’s briefing. Those are cards from the one daily package, not three editions a day. If that request does not succeed, the copy embedded in the page stays visible. The request sets no cookie and is not an analytics tool. GitHub receives the connection data, as section 3.2 describes.

The purpose is to publish the information the law requires and to deliver the pages. The legal basis is Article 6(1)(c) GDPR where the pages provide the information required by section 5 of the German Digital Services Act (DDG) and Article 13 GDPR, and Article 6(1)(f) GDPR for technical delivery. The legitimate interest is reliable publication without an account on this site. You can object to processing based on point (f); see section 6.

4. Recipients and countries outside the EU

Activity Recipient Role
Request for pulse.json and briefing.json, and visits to this website GitHub, Inc. (Microsoft), United States Its own controller for the connection data, in particular the IP address. Privacy statement: GitHub Privacy Statement.
Subscription and trial, payment Apple, Google Their own controllers for payment and the store account. The operator does not receive the card number.
Status of the trial and the subscription RevenueCat, Inc., United States Processor. Privacy policy: Privacy Policy. Transfer: standard contractual clauses in the data processing addendum.
App updates (EAS Update) 650 Industries, Inc. (Expo), United States Processor for delivery. Privacy policy: Privacy policy.
Email to the address above Niklas Galli Controller for the correspondence.

GitHub may process connection data in the United States and in other countries. The request for pulse.json and briefing.json, and a visit to this website, are direct connections from your device to GitHub. GitHub states that it complies with the EU-U.S. Data Privacy Framework and that it generally uses the European Commission’s standard contractual clauses (Implementing Decision 2021/914) for transfers to countries without an adequacy decision. GitHub’s listing is in the Data Privacy Framework, and the details are in the GitHub Privacy Statement. Apple and Google describe their own transfers in their privacy policies. The transfers to RevenueCat and to Expo are described in sections 3.4 and 3.5.

5. Whether you must provide data, and automated decisions

You are not required by law to provide data. A name is not required. Without local storage, the app cannot keep reading progress, personalization, an optional name, and settings on the device. Without the request for pulse.json and briefing.json, it cannot show the current texts. Without a purchase through Apple or Google, there is no subscription. Without the request to RevenueCat, the app cannot determine the status of the trial and the subscription. Without the update request to Expo, the device does not load a program update by that route. Without the system permission, there are no local notifications.

The controller does not make a decision based solely on automated processing that produces legal effects or similarly significantly affects you (Article 22 GDPR). Personalization runs on the device and does not change your legal position.

6. Your rights

Where the statutory conditions are met, you have the following rights against the controller:

For reading progress, personalization, an optional name, settings, and the cache, access and erasure are practical steps on the device, because the controller does not receive that data. For every other request, write to niklas.galli@getaila.de.

The supervisory authority for the controller in Bavaria is the Bavarian Data Protection Authority for the private sector (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, poststelle@lda.bayern.de, www.lda.bayern.de. You may also contact the supervisory authority of your place of residence or work.

7. Language and date

The German version prevails. This English text is a translation for easier reading. Last updated: .