FrettkoPrivacy policy
This policy explains what data the Frettko app and the frettko.app website process, why, for how long, and what rights you have. We keep it in plain language. The short version: we collect what the app needs to work and to get better, we never sell your data and there are no ads.
1. Who we are
The controller of your personal data is NæsteFase, a Danish sole proprietorship (enkeltmandsvirksomhed), CVR 46848934, Lyngbyvej 83A, 2100 København Ø, Denmark. Frettko is our product. For anything about your data, write to [email protected].
2. What we process and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Random app ID. On first launch the app creates an anonymous account with a random ID, before you sign up for anything. Your progress is linked to it. If you start signing up, the email address you enter is stored with it while it waits for confirmation. | So you can learn straight away without an account and keep your progress. | Contract, Art. 6(1)(b) |
| Account. Email address, password (stored only as a secure hash by our sign-in provider), optional display name, and the app language, so account emails reach you in your language. If you sign in with Google: the name, email, Google account ID and profile picture link Google shares. | To create and secure your account, sign you in and send account emails (activation, password reset, password changed). We don't send marketing emails. | Contract, Art. 6(1)(b) |
| Learning data. Learning sessions (mode, category, time, number of answers and correct answers), streaks and streak shields, word mastery, completed items, daily usage counters, your Frettko+ status and free Frettko+ gifts. | To run the app, save your progress across devices and apply what your plan includes. | Contract, Art. 6(1)(b) |
| Usage events. Events such as opening the app, finishing a session, choosing a course or accent, tapping the Frettko+ button, signing up or turning on reminders, including your phone's language and region setting. Linked to your random account ID. | To understand which features help people learn and where they get stuck, and to suggest the course that fits your phone's region. Never for advertising or profiling. | Legitimate interests, Art. 6(1)(f). You can object at any time (section 7). |
| Feedback. The message you send from the app, the app version and platform. | To read and answer it and to fix problems. | Legitimate interests, Art. 6(1)(f) |
| Security data. Your IP address and technical browser signals during the CAPTCHA check at sign-in, sign-up and password reset; your IP address to limit automated creation of anonymous accounts; for each signed-in session, the IP address and device type; technical server logs. | To protect accounts and the service from bots and abuse. | Legitimate interests, Art. 6(1)(f) |
| Crash and performance reports. Error details and code trace, timing of app operations, device model, operating system, app version and a random installation ID. We don't attach your name, email or account ID. | To find and fix bugs and slow screens. | Legitimate interests, Art. 6(1)(f) |
| Purchases. When you buy Frettko+, Apple or Google handle the payment; we never see your card. Our subscription provider receives the purchase receipt and your random account ID to confirm the subscription and keeps the purchase history. We store whether Frettko+ is active. | To give you what you paid for, on every device you sign in to. | Contract, Art. 6(1)(b) |
| Support emails. Your email address and what you write to us. | To answer you. | Legitimate interests, Art. 6(1)(f) |
We don't collect your location, contacts, photos, camera or microphone, and the app doesn't ask for them. We don't use advertising networks, we don't sell data and we don't make automated decisions about you that have legal or similar effects.
3. Data on your phone
Some data stays only on your device and never reaches our servers: your settings (app and course language, accent, playback speed, reminder days and times), favourite words, cached course content, recordings you've played (so they work offline) and a short queue of progress waiting to sync. Your sign-in session is kept in the phone's secure storage. Reminders are local notifications scheduled by your phone; we don't use push notification servers. Uninstalling the app removes all of this. Deleting your account does not remove it from the phone, so uninstall the app too if you want it gone.
4. Who we share data with
We use these providers to run Frettko. They process data on our behalf under data processing agreements and may not use it for their own purposes.
| Provider | What for | Where |
|---|---|---|
| Supabase, Inc. | Database, sign-in, file storage for recordings | EU (Ireland) |
| Functional Software, Inc. (Sentry) | Crash reports | USA |
| Cloudflare, Inc. | CAPTCHA check (Turnstile), hosting of this website | Global network |
| Resend | Sending account emails | USA |
| RevenueCat, Inc. | Confirming Frettko+ subscriptions | USA |
Apple and Google are independent controllers when you buy through the App Store or Google Play, and Google is one when you choose to sign in with Google. Their own privacy policies apply to what they process. We may also disclose data when the law requires it, for example to a court or authority.
5. Transfers outside the EU
Our database is in the EU. Some providers above are based in the USA or work globally. Where data leaves the EU/EEA, the transfer relies on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.
6. How long we keep data
- Account, learning data, usage events, feedback: as long as you have the account. When you delete it, they are deleted with it.
- Accounts without sign-up (random ID only): deleted automatically after 180 days without a learning session, together with everything linked to them.
- Sign-in sessions (IP address, device type): until you sign out or the session expires, and always together with the account.
- IP addresses for limiting anonymous sign-ups: about a day; old entries are removed at the next check.
- Crash and performance reports: deleted automatically by Sentry within 90 days.
- Backups and technical logs at our hosting provider: overwritten in their normal cycle, within days.
- Support emails: up to 2 years after the conversation ends.
- Purchase records: Apple and Google keep theirs under their own rules. Our subscription provider keeps the purchase history linked to your random account ID; we delete it there on request, including when you ask us to delete your account. In our database we keep only whether Frettko+ is active, for as long as the account exists.
7. Your rights
Under the GDPR you can ask us for access to your data and a copy of it, correction, deletion, restriction of processing and data portability. You can object at any time to processing based on our legitimate interests, including usage events; just write to us. Where processing relies on consent, such as notifications you allow in your phone's settings, you can withdraw it at any time. We answer within one month.
You can also complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, datatilsynet.dk, or to the data protection authority where you live. We'd appreciate the chance to fix things first.
8. Deleting your account
You can delete your account in the app (Profile, Delete account) or by email, without installing the app. Step-by-step instructions, and what stays for a limited time, are on Delete your account.
9. This website
frettko.app sets no cookies and uses no analytics or tracking. If you pick a language or close the bar suggesting your phone's language, your browser remembers that choice in its local storage; it never leaves your device. Fonts and all files are served from our own domain. Our hosting provider, Cloudflare, processes your IP address and technical request data to deliver the pages and protect the site, based on our legitimate interests. Recordings in the “Listen now” box load only when you tap play.
10. Children
Frettko is for people aged 13 and older. If you think a child under 13 has given us personal data, write to us and we'll delete it.
11. Security
Data is encrypted in transit, and access to our database is limited by row-level security, so each account can only reach its own data. Passwords are never stored in readable form. No system is perfectly secure, but if a breach affects your data, we'll tell you and the authorities as the law requires.
12. Changes and contact
If we change this policy, we update the date at the top; for important changes we'll also tell you in the app. Questions or requests: [email protected], or by post to NæsteFase, Lyngbyvej 83A, 2100 København Ø, Denmark.