Privacy Policy

This is a convenience translation. The German version (Datenschutzerklärung) is legally binding.

1. Controller

Alireza Shahsavarkhani

c/o Impressumservice Dein-Impressum
Stettiner Str. 41
35410 Hungen
Germany

Email: alireza@deep-mirroring.com
Another direct means of contact: the feedback function in the app (Settings → Feedback).

2. What the app processes without an account

Sawasdee works entirely without an account. Learning progress (learned words, review schedule, streak, settings, activity history) is stored exclusively locally on the device (app storage). If you have enabled your operating system's device backup (Android backup with Google, iCloud Backup), it may include the app storage; you control this in the system settings. There is no tracking, and there are no advertising SDKs or analytics services.

Audio playback uses recordings by native speakers that are included in the app or, as a fallback, the operating system's speech output; no data is transmitted to us in the process. The “Repeat after” exercises (microphone) and the placement test run entirely on the device: your recording is only cached temporarily for immediate playback, is not stored permanently and is not transmitted.

Audio packs. Recordings that are not included in the app (levels from A2 up, or target languages without bundled recordings) are hosted on GitHub Pages (GitHub, Inc., USA). You can download them in full under Settings → Vocabulary audio; without a download, the app fetches only the single recording from there the first time you play a word, and stores it for offline use. For technical reasons your device transmits its IP address and the address of the requested file (language and recording number) to GitHub. No other data is sent. Legal basis: Art. 6(1)(b) GDPR; transfer to the USA on the basis of the EU-US Data Privacy Framework (GitHub Privacy Statement).

3. Optional account and cloud synchronisation (Supabase)

If you sign in under “Account & Premium” – with a one-time code sent by email, with “Continue with Google” or (on iPhone) with “Continue with Apple” – the following is stored:

Purpose: backing up and syncing progress between devices. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

Provider: Supabase Inc.; the data is stored in the EU (Frankfurt, eu-central-1) region. Supabase acts as our processor under Art. 28 GDPR; data processing agreement: https://supabase.com/legal/dpa.

The one-time code is sent by email via Brevo (Sendinblue GmbH, Cologne); in doing so, Brevo processes your email address and delivery metadata. https://www.brevo.com/de/legal/termsofuse/#dpa.

Deletion: Under Settings → Account & Premium → “Delete account” you delete your account and cloud data immediately and permanently; the local progress on the device is retained. In doing so, we remove the email address as well as device and diagnostic data from feedback reports you sent while signed in; the report text is retained for up to 12 months (section 4). The identifier held by the purchase status service RevenueCat (section 5) is retained as proof of your purchases. Without deletion, we store the data for as long as the account exists.

4. Feedback function

Via “Report a problem” you voluntarily send us a message. The following is sent along with it: app version, platform (Android/iOS/Web), browser/device identifier (user agent), a random identifier generated per installation (so that you can see in the app which of your reports have been accepted), selected languages, where applicable the reported word, where applicable the error message of the last app crash and – optionally – your email address for follow-up questions. If you switch on “Attach diagnostics” when sending (off by default), the report additionally contains up to the last 50 usage events of this installation (e.g. “session started”, “paywall opened”, error code – without texts, recordings or exact timestamps) and your 7-day recall rate; you see this data in a preview before sending. Without this option, it is not transmitted; the log never leaves your device in the background. After a learning session that was ended early, the app asks for the reason at most once a day; the answer is only sent if you submit the report. Storage with Supabase (EU); a notification is sent to us via Brevo. If you have provided an email address, we send you a short message via Brevo as soon as we have accepted your report or completed our review of it. Legal basis: Art. 6(1)(f) GDPR (bug fixing/product improvement). Reports are deleted automatically 12 months after receipt.

5. Purchases / Premium

Premium (monthly or yearly subscription, one-time purchase) is purchased, depending on the device, via Google Play or, on iPhone, via the App Store; payment processing is handled accordingly by Google (Google Play Terms of Service and Google's privacy policy) or Apple (Apple's privacy policy); we do not receive any payment data. To check the purchase status (“Premium yes/no”, term, trial period) we use RevenueCat (RevenueCat, Inc., USA); what is transmitted is an anonymous app user ID generated per installation (if you are signed in, the pseudonymous identifier of your account instead, so that purchases apply on all your devices) as well as the purchase receipts and purchase history of the respective store (Google Play or App Store) – no email address or name is transmitted. Legal basis: Art. 6(1)(b) GDPR. Transfer to the USA on the basis of Standard Contractual Clauses / EU-US Data Privacy Framework. https://www.revenuecat.com/privacy.

5a. Invite friends (optional, account only)

Signed-in users receive a personal invite code under Settings → Account & Premium. If you redeem a code, we store: the identifiers of both accounts and the time of redemption, whether the invited person subsequently learned on three different days (determined from the activity history that is synchronised anyway, see section 3), whether they purchased Premium (query of the purchase status at RevenueCat using the account identifier, see section 5) and the Premium days credited as a result. To unlock these days, we transmit the account identifier and the expiry date to RevenueCat. The inviting person only sees counts (invited / learning / Premium), never names, email addresses or learning content of the invitees.

Purpose: running the invitation programme. Legal basis: Art. 6(1)(b) GDPR. The data is deleted together with the respective account; days already credited to the other person remain. An exception is an irreversibly computed check value (SHA-256 hash) of your email address together with the time of redemption: it is retained even after the account has been deleted and serves exclusively to prevent an invitation from being redeemed more than once with the same email address (legal basis: legitimate interest in preventing abuse, Art. 6(1)(f) GDPR). It is deleted as soon as the invitation programme ends.

6. Reminders

Daily reminders are scheduled locally on the device (operating system notifications). No push servers are used.

7. Your rights

Access, rectification, erasure, restriction of processing, data portability, objection (Art. 15–21 GDPR) as well as the right to lodge a complaint with a supervisory authority. Contact: alireza@deep-mirroring.com. Competent supervisory authority: the data protection authority of the German federal state in which the controller is established.

8. Children

The app is not specifically aimed at children under the age of 16; an account may only be created with your own email address.

9. Changes

Last updated: 1 October 2026. We update this policy when the app changes; the current version is linked in the app under Settings → Legal.