Language

Privacy Policy for Shapedeep

Last updated: 14 August 2026

1. Controller

The controller responsible for personal data processed in connection with the Shapedeep app and Shapedeep-operated web pages is:

Shapedeep
Ender Temizdemir
c/o Postflex 7026
Emsdettener Str. 10
48268 Greven
Germany
No parcels or packages – acceptance will be refused.

Privacy contact: privacy@shapedeep.com
Support contact: support@shapedeep.com
Website: https://shapedeep.com

No data protection officer has been appointed at this time.

2. Scope and key points

This Privacy Policy applies to the Shapedeep mobile app, its backend services, and static web pages provided by Shapedeep.

Key points:

  • Shapedeep does not sell personal data.
  • The current app does not display ads, use the Android Advertising ID, or access the device address book.
  • Usage analytics and crash diagnostics are separate, optional settings and start disabled.
  • The Firebase Authentication UID is not set as an Analytics User-ID or as a Crashlytics user identifier.
  • Users aged 13 to 15 cannot enable optional analytics or diagnostics.
  • A public social profile is created only after explicit activation; username searchability is controlled separately.
  • Accounts can be deleted in the app. An external web resource is also provided to initiate deletion.
  • Users can export account-related data from the app as a JSON file.

3. Firebase and Google services used

Shapedeep uses in particular:

  • Firebase Authentication for account creation and sign-in;
  • Cloud Firestore for account, profile, learning, and feature data;
  • Cloud Functions for Firebase for server-side processing;
  • Firebase App Check with Play Integrity for the intended production release and the debug provider in development builds;
  • Firebase Remote Config for technical configuration such as version or update notices;
  • Google Analytics for Firebase only after separate consent;
  • Firebase Crashlytics only after separate consent.

Google generally processes Customer Data for many Firebase services as a processor. Google Analytics is also subject to separate terms and data-processing conditions.

4. Data categories and purposes

4.1 Account and authentication data

When you create or use an account, we process in particular:

  • email address;
  • Firebase Authentication UID;
  • sign-in provider, such as email/password or Google Sign-In;
  • email-verification status;
  • account creation and last sign-in timestamps;
  • profile information returned by Google Sign-In where required for authentication;
  • technical authentication tokens and session information.

Firebase Authentication also automatically processes technical data such as IP address, user-agent information, Firebase App ID, and SDK/platform version. Passwords are processed by Firebase Authentication. Shapedeep does not store plaintext passwords in Firestore or in its own database.

Purposes: account creation, sign-in, email verification, password reset, account security, and abuse prevention.

Legal bases: Article 6(1)(b) GDPR and, for security and abuse prevention, Article 6(1)(f) GDPR.

4.2 Profile, onboarding, and preference data

Depending on use, we process:

  • username and optional display name;
  • a selected avatar bundled locally with the app;
  • age group, not a full date of birth;
  • source and target language or languages;
  • current target language and text-to-speech locale;
  • learning reasons;
  • humour preference;
  • optionally, how you heard about Shapedeep; skipping is stored as “not provided”;
  • onboarding and notification status;
  • sound, language, and interface preferences.

The stored age group uses stable technical values such as 13_15, 16_17, or 18_24. An “under 13” value is not retained as a normal profile age group.

Purposes: account setup, language-learning configuration, age-related controls, and app personalisation.

Legal basis: Article 6(1)(b) GDPR. The discovery-source answer is voluntary.

We store:

  • whether and which Terms version was accepted;
  • the server-side time of acceptance;
  • which Privacy Notice version was shown;
  • the server-side time it was shown;
  • separate choices for optional analytics and optional diagnostics, including timestamp, notice version, app version, and source of the choice.

The Privacy Notice is not treated as a blanket consent. Terms acceptance, display of the Privacy Notice, Analytics consent, and Diagnostics consent are separate actions.

Legal bases: Article 6(1)(b) GDPR for Terms acceptance; Article 6(1)(c) or (f) GDPR for documentation; Article 6(1)(a) GDPR for optional Analytics and Diagnostics.

4.4 Learning progress and gamification

To provide the learning experience, we process in particular:

  • selected courses and languages;
  • current lesson path;
  • completed lessons and themes;
  • aggregated lesson data, such as exercise count, correct first attempts, difficulty, and category counts;
  • language progress;
  • XP, JP, and CP;
  • Weekly XP and league data;
  • streak, learning days, freezes, and reserves;
  • achievements, daily missions, and mystery-prize data;
  • timestamps needed for progress, rewards, and synchronisation.

Shapedeep does not send a complete list of completed task IDs, answers, sentences, or free text when a lesson is completed. Technical task references may be processed only when the app requests protected learning content for a specific chapter.

Purposes: save progress, provide lessons, calculate gamification, synchronise data, and prevent manipulation.

Legal bases: Article 6(1)(b) and (f) GDPR.

4.5 Protected learning content and rate limiting

Some content is not fully bundled in production builds and is requested through Cloud Functions when needed. This may involve:

  • Firebase UID and authentication status;
  • language pair;
  • theme, chapter, and lesson context;
  • technical task references for the requested chapter;
  • schema and content version;
  • App Check token or integrity signal;
  • request timestamp and rate-limit counters.

The rate-limit state contains no email address, device ID, or exported learning content. It receives a server-set expiry time and is normally deleted after approximately 48 hours.

Purposes: content protection, abuse prevention, scraping protection, and service stability.

Legal bases: Article 6(1)(f) GDPR and, where required to provide the requested content, Article 6(1)(b) GDPR.

4.6 Optional social features

A social profile is created only when you activate it. Username searchability can be enabled or disabled separately.

When enabled, other signed-in users may see:

  • username or display name;
  • selected avatar;
  • total XP;
  • XP earned during the current week;
  • current streak;
  • follow/follower status where required by the relevant screen.

The following are not displayed publicly:

  • email address;
  • JP and CP;
  • join date;
  • complete learning history;
  • number of completed lessons;
  • specific answers;
  • onboarding or telemetry choices.

We also process follow relations and searches for enabled public profiles. Search queries are not stored as a personal search history. Shapedeep does not read device contacts and does not match contacts by email address.

Legal basis: Article 6(1)(b) GDPR based on the social feature you activate.

4.7 Feedback, error reports, and feature requests

If you voluntarily send feedback, a feature request, or an error report, we process:

  • your message;
  • submission type and fixed source value;
  • your Firebase UID for account association and later account deletion;
  • limited typed context, such as screen key, app version, locale, language pair, theme/chapter/lesson/task identifier, and a bounded error code;
  • creation time, status, expiry time, and whether redaction was applied.

The app does not automatically send your email address, username, answer text, correct solution, full URL, authentication header, token, local file path, or device ID.

Before storage, the server attempts to redact email addresses and obvious secrets such as bearer tokens, JWTs, passwords, API keys, reset codes, or oobCode. The unredacted original is not retained separately.

Please still do not submit passwords, payment data, authentication codes, or particularly sensitive personal data.

Retention:

  • error reports: 90 days;
  • feedback: 180 days;
  • feature requests: 365 days.

Legal bases: Article 6(1)(b) GDPR for account-related support and Article 6(1)(f) GDPR for troubleshooting and product improvement.

4.8 Optional usage analytics

Google Analytics starts disabled and is enabled only if:

  1. the server-confirmed age group is at least 16;
  2. you separately enable usage analytics; and
  3. the app configuration permits Analytics for the release channel.

When enabled, the following may be processed:

  • pseudonymous app/installation identifier;
  • automatically generated app and session events;
  • screen views and sanitised route names without query parameters;
  • app version, platform, and technical device category;
  • approximate country or region derived from technical signals;
  • only fixed, aggregated product parameters where a corresponding event is actually wired into the released app.

Shapedeep does not set the Firebase Authentication UID, email address, or username as an Analytics User-ID. Answers, free text, learning reasons, humour preference, and the discovery-source answer are not sent to Analytics.

The intended Google Analytics property configuration retains user- and event-level data for two months, with “Reset on new user activity” disabled. Google Signals, User-provided Data, Google Ads links, BigQuery export, and ads personalisation are not used for the intended release. Granular location and device collection is disabled regionally.

Legal basis: Article 6(1)(a) GDPR. Consent can be withdrawn at any time in Settings with effect for the future.

4.9 Optional crash diagnostics

Firebase Crashlytics starts disabled and is enabled only if:

  1. the server-confirmed age group is at least 16;
  2. you separately enable crash diagnostics; and
  3. the app configuration permits Crashlytics for the release channel.

When enabled, the following may be processed:

  • stack traces;
  • crash timestamp;
  • relevant app state;
  • app version and package identifier;
  • operating system, device model, and technical device metadata;
  • Crashlytics Installation UUID, Firebase Installation ID, and session identifier;
  • limited, sanitised technical error information and non-fatal errors.

Shapedeep does not set the Firebase Authentication UID as a Crashlytics user identifier. Answers, feedback text, and complete request payloads are not intended to be attached as Crashlytics custom data.

Firebase states that crash stack traces and associated installation identifiers are retained for 90 days before removal from live and backup systems begins.

Legal basis: Article 6(1)(a) GDPR.

4.10 App Check, Remote Config, and technical security data

Depending on the build, Firebase App Check processes Firebase user-agent data and, for production releases, a Play Integrity token. These signals help distinguish genuine app instances from abusive clients. Server-side enforcement is rolled out in controlled groups after successful debug and Play Integrity testing.

Firebase Remote Config may process a Firebase Installation ID to deliver technical configuration, such as version or update notices.

At invocation, Cloud Functions automatically processes the function name, IP address, and, for signed-in users, the Firebase UID in the authentication context. The Functions client can also technically transmit an FCM token. Shapedeep uses an allowlisted operational logger that does not include UID, email address, message, full payload, or tokens in ordinary logs. Security and Cloud Audit Logs may still contain technical resource, access, and principal information.

Legal bases: Article 6(1)(b) and (f) GDPR.

4.11 Self-service data export

You can request an export of account-related data in the app. A Cloud Function creates a direct structured JSON response only for the currently authenticated Firebase UID. No public download URL or permanent Storage export is created.

The app temporarily writes the JSON file locally and opens the operating system share/save sheet. After sharing or saving, you control further retention of the file.

To prevent abuse, a maximum of three export requests per 24 hours applies. The technical rate-limit state expires after approximately 48 hours and contains no export content or email address.

Legal bases: Article 6(1)(b) and (c) GDPR and Articles 15 and 20 GDPR where applicable.

4.12 Website, hosting, and pre-registration

The Shapedeep website uses no analytics, advertising, or marketing cookies and loads no external fonts or tracking scripts. Firebase Hosting may process incoming-request IP addresses for service operation, abuse detection, and technical usage analysis.

If you pre-register on the website, we process in particular:

  • your normalised email address;
  • the selected page language;
  • consent version, consent purpose, and the source value website;
  • status and the required creation, update, confirmation, expiry, and unsubscribe timestamps;
  • hashed confirmation and unsubscribe tokens;
  • for abuse prevention, an HMAC-pseudonymised rate-limit key, counters, and short-lived expiry data. Raw IP addresses are not stored in the waitlist record.

Registration is confirmed only after you select the double-opt-in link. Unconfirmed registrations expire after 48 hours. Confirmed records remain until unsubscribe, withdrawal, or another applicable reason for deletion. The email address is used only for messages about the Shapedeep launch and, where applicable, earlier access to a test version. Messages contain no tracking pixels or remote images.

The waitlist uses Firebase or Google Cloud for the Function, Firestore, logs, and Secret Manager in the intended europe-west3 region, and IONOS for SMTP and mailbox services. Human replies to feedback@shapedeep.com may be forwarded to Gmail according to the actual mailbox configuration.

Legal bases: Article 6(1)(a) GDPR for the requested email messages; Article 6(1)(f) GDPR for secure delivery, abuse prevention, and technical stability. Consent may be withdrawn at any time through the unsubscribe link with effect for the future.

4.13 Processing not currently used

The current app:

  • does not use the Android Advertising ID;
  • does not display ads;
  • does not use personalised advertising;
  • does not access the device address book;
  • does not perform email-based contact discovery;
  • does not allow users to upload their own profile photos;
  • does not process in-app payments or subscriptions;
  • does not send marketing newsletters or measure marketing-email opens.

Before any such feature is introduced, the app, consent interfaces, Google Play disclosures, and this Policy will be updated.

5. Recipients and processors

Recipients or service providers may include:

  • Google Ireland Limited and affiliated Google entities for Firebase, Google Cloud, Google Analytics, Google Sign-In, App Check, and Play Integrity;
  • the email provider and Firebase services used for verification and password-reset emails;
  • IONOS for double-opt-in and waitlist email delivery and mailbox services; human replies may be forwarded to Gmail according to the actual mailbox configuration;
  • Google Play when the app is installed through Google Play or Play Integrity is used;
  • other signed-in users only within social features you activate;
  • authorities or other recipients where disclosure is legally required.

We do not sell personal data. Transfers to service providers are made to provide the relevant functions. Google Play Data safety disclosures follow the current Play definitions for processors and sharing.

6. International transfers

Cloud Firestore and Cloud Functions are configured for European locations or europe-west3 for core Shapedeep data and backend operations where the relevant service supports location selection.

According to Google, Firebase Authentication is operated only from US data centres. Other global Firebase, Analytics, App Check, Remote Config, and support services may process data outside the European Economic Area.

Google relies, where applicable, on adequacy decisions, the EU-U.S. Data Privacy Framework, and Standard Contractual Clauses. Firebase Data Processing and Security Terms apply, and Google Analytics has separate data-processing terms.

7. Retention

Data category Regular retention
Account, profile, learning, and gamification data Until account deletion or while required for the active feature
Public social profile Until social-profile deactivation or account deletion
Follow relations Until unfollow or account deletion
Protected-content rate limit Approximately 48 hours using server-set expiresAt and Firestore TTL
Data-export rate limit Approximately 48 hours using server-set expiresAt and Firestore TTL
Error reports 90 days
Feedback 180 days
Feature requests 365 days
Google Analytics Two months for user- and event-level data; reset on new activity disabled
Firebase Crashlytics 90 days for crash data and associated installation identifiers, according to the provider
Firebase Authentication Authentication data until deletion is initiated; removal from live and backup systems within up to 180 days according to the provider; IP logs for a few weeks
Cloud Logging _Default Currently 30 days
Cloud Audit Logs in _Required Provider-controlled, currently 400 days
Local export file Until you delete it from your device or chosen recipient
Unconfirmed pre-registration 48 hours, followed by expiry and intended TTL deletion
Confirmed pre-registration Until unsubscribe, withdrawal, or another applicable reason for deletion
Waitlist rate limit Short-lived HMAC pseudonym, counter, time window, and TTL expiry

Legal retention duties or the establishment, exercise, or defence of legal claims may require longer retention in individual cases. Where possible, data is then restricted to the necessary scope.

8. Account deletion

You can delete your account in Settings. Recent sign-in or reauthentication may be required to protect against unauthorised deletion.

The server-side deletion process removes or cleans up in particular:

  • Firebase Authentication account;
  • private user document and subcollections;
  • public social profile;
  • follow relations;
  • league membership and own league state;
  • feedback, error reports, and feature requests associated with the Firebase UID;
  • consent-audit and export-job documents where present;
  • protected-content and data-export rate-limit documents.

Authentication is deleted last so that a failed earlier cleanup can be retried.

An external web page is also provided to initiate account deletion. Deleting the app from a device does not itself delete the server-side account.

Provider logs, backups, or legally required records may remain for the periods stated above.

9. Access, portability, and other rights

Subject to legal requirements, you may have rights to:

  • access;
  • rectification;
  • erasure;
  • restriction of processing;
  • data portability;
  • object to processing based on legitimate interests;
  • withdraw consent with effect for the future;
  • complain to a supervisory authority.

The self-service export is available in Settings. Other requests can be sent to privacy@shapedeep.com. We may verify identity to prevent unauthorised disclosure.

10. Children and teenagers

Shapedeep is not intended for children under 13. Selecting “under 13” stops account creation, or requires cleanup of a provisionally created account.

For accounts with the 13_15 age group, usage analytics and crash diagnostics are technically disabled. From age 16, these optional processing activities can be enabled separately.

Where applicable law requires parental or guardian permission for other contractual or feature-related matters, the app may be used only with that permission.

11. Automated features

Shapedeep uses rules and automated systems to operate onboarding, learning paths, XP, streaks, missions, achievements, rewards, leagues, rate limits, and abuse protection. These processes provide app functionality and do not produce legal or similarly significant effects within the meaning of Article 22 GDPR.

12. Security measures

Measures include:

  • Firebase Authentication;
  • Firestore Security Rules;
  • server-authoritative Cloud Functions;
  • App Check and Play Integrity for intended release builds;
  • separated, default-off telemetry;
  • no account identifier in Analytics or Crashlytics;
  • typed Analytics and submission contexts;
  • server-side redaction of obvious secrets;
  • rate limits and automatic TTL deletion;
  • an allowlisted operational-logging model;
  • HTTPS encryption in transit;
  • role-based access in Firebase and Google Cloud.

No internet service can guarantee absolute security.

13. Changes to this Policy

We update this Policy when functions, data flows, providers, legal requirements, or retention periods materially change.

The app records the current Privacy Notice version. A new Privacy Notice is not blanket consent. Where a change requires consent, it will be requested separately.

14. Contact

Privacy requests: privacy@shapedeep.com
Support: support@shapedeep.com

Controller: Ender Temizdemir, address as stated in section 1.