Privacy Policy

Last Updated: 9 October 2026

1. Introduction

Welcome to OnAlbanian! This Privacy Policy explains how OnAlbanian ("we," "us," or "our") collects, uses, shares, and protects your personal data when you use our website (https://onalbanian.com) and any related services, including our mobile application (collectively, the "Service").

We are committed to protecting your privacy and handling your data in an open and transparent manner, in compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws, including Apple App Store guidelines.

This policy applies to all users of our Service. By using the Service, you agree to the collection and use of information in accordance with this policy.

2. Data Controller

The data controller responsible for your personal data is:

OnAlbanian
Email: info@onalbanian.com
Website: https://onalbanian.com

3. What Personal Data We Collect and How

We collect information to provide and improve our Service to you. The types of personal data we may collect include:

Information You Provide Directly:

  • Account Information: When you create an account, we collect your email address and a password (stored securely using hashing).
  • Contact Information: If you sign up for our newsletter or contact us, we collect your email address.
  • Language Information: If you log in via Google, we may collect information about your language preference or the language you are learning. Users may also be able to set this information within their profile.
  • User Content: Information you generate while using the Service, such as progress in exercises, flashcards created, or feedback submitted through integrated tools.

Information Collected Automatically:

  • Log and Usage Data: When you access the Service, our servers automatically record information, including your IP address, browser type and settings, device information, operating system, date/time stamps, and interactions with the Service (e.g., pages visited, features used).
  • Approximate Country: We derive an approximate country from your IP address (using Cloudflare's country detection or the MaxMind GeoLite2 database) and store only the country code with your account, for statistics. We do not store your precise location.
  • Cookies and Similar Technologies: We use a small number of cookies to operate our site. We do not use advertising or tracking cookies. The cookies and similar technologies we use are:
    • Essential Cookies: Necessary for the website to function (e.g., session management, security like CSRF protection).
    • Referral Cookie: If you open a friend's invite link, a first-party cookie remembers the invite for up to 30 days so the referral can be credited when you sign up. It is not shared with third parties.
    • Local Storage: Your light/dark theme choice is saved in your browser's local storage. It is never sent to our servers.

Information from Third Parties:

  • Google Login: If you choose to log in using Google, we receive certain profile information from Google, such as your email address and potentially language preference, as permitted by Google's policies and your privacy settings.

4. How We Use Your Personal Data (Purpose and Legal Basis)

We use your personal data for the following purposes, based on specific legal grounds:

  • To Provide and Manage the Service: (Legal Basis: Necessary for the performance of a contract)
    • Creating and managing your user account.
    • Providing access to learning materials, exercises, and features.
    • Tracking your learning progress.
    • Responding to your inquiries and providing customer support.
  • To Improve the Service: (Legal Basis: Legitimate Interests)
    • Analyzing usage patterns to understand how our Service is used and identify areas for improvement.
    • Using language information for statistical analysis (this data is aggregated or anonymized where possible for purely statistical use).
    • Gathering feedback and fixing bugs.
  • To Communicate With You: (Legal Basis: Consent, where required; Legitimate Interests for service updates)
    • Sending newsletters and promotional materials (only if you have opted-in/consented).
    • Sending important service-related notices (e.g., security alerts, changes to terms or policies).
  • For Security and Fraud Prevention: (Legal Basis: Legitimate Interests)
    • Protecting the security and integrity of our Service.
    • Preventing fraudulent activity.
  • To Comply with Legal Obligations: (Legal Basis: Legal Obligation)
    • Meeting legal requirements or responding to lawful requests from authorities.

5. Data Sharing and Third Parties

We do not sell your personal data. We may share your data with third-party service providers who help us operate our Service, but only to the extent necessary and under strict confidentiality obligations. These include:

  • Mixpanel (product analytics): Our app and website send events about how the Service is used (e.g., screens opened, lessons and quizzes completed, purchases started) to Mixpanel, linked to your account ID. This helps us understand and improve the Service. Data is stored in Mixpanel's EU data residency region, and Mixpanel acts as our data processor (Legal Basis: Legitimate Interests). Website visitors who are not signed in: our homepage sends anonymous usage events (e.g., page viewed, button clicked) with no cookies, no stored identifier and no location taken from your IP address; they are stored on Mixpanel's EU servers.
  • Sentry (error and crash monitoring): When the app or website hits an error or crashes, technical details (e.g., error message, device and app version, and possibly your account ID) are sent to Sentry so we can fix the problem. Sentry acts as our data processor (Legal Basis: Legitimate Interests).
  • Hosting Provider: Our servers are located in Germany, hosted by a provider compliant with GDPR standards.
  • Legal Requirements: We may disclose your data if required by law or in response to valid requests by public authorities.

We ensure that any third party with whom we share your data provides the same or equal protection of user data as stated in this policy and required by GDPR and Apple guidelines.

Payment processing

In-app purchases and subscriptions are processed by Apple (App Store) on iOS and Google (Google Play) on Android. We do not receive or store your payment card details. From these platforms we receive only the transaction identifier, subscription status (active/cancelled/expired), and product purchased. Subscriptions bought on our website are processed by Stripe; Stripe handles your card details, and we receive only the customer and subscription identifiers, the plan, and its status. See Stripe's privacy policy at https://stripe.com/privacy, Apple's privacy policy at https://www.apple.com/legal/privacy and Google's at https://policies.google.com/privacy.

Session replay (iOS and Android apps)

To find bugs and improve usability, our iOS and Android apps (version 7.1.0 and later) record app sessions of signed-in users using Mixpanel Session Replay. When a session is recorded, we capture the app screens you view and where you tap, including the lesson text and images shown on screen. Recording pauses on screens with personal or payment information (sign-in and registration, your profile and settings, the leaderboard, subscriptions and purchases), so those screens are not recorded at all. Your name and other users' usernames are always hidden in recordings. We do capture the answers you type in exercises, but never on the sign-in and registration, profile and settings, leaderboard, or payment screens — those aren't recorded at all. Recordings are stored on Mixpanel's servers in the EU and deleted after 30 days. Mixpanel acts as our data processor. The legal basis is our legitimate interest in keeping the app working well and easy to use. You can object to this at any time by emailing info@onalbanian.com.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required or permitted by law.

  • Account Data: We retain your account information and associated usage data for as long as your account remains active. If you delete your account, we will delete this data within a reasonable timeframe (typically 30 days), subject to any legal obligations to retain certain information (e.g., for security logs or financial records).
  • Other Data: Log data, statistical data, and cookie data are retained for a limited period necessary for their purpose (e.g., server logs are typically retained for 90 days for security analysis).
  • Session Replays: App session recordings (see Section 5) are deleted after 30 days.

7. Data Security

We take the security of your data seriously and implement appropriate technical and organizational measures to protect it against unauthorized access, alteration, disclosure, or destruction. These measures include data encryption (both in transit and at rest where appropriate), access controls, and regular security reviews. Our servers are located in Germany. However, no internet transmission or electronic storage is 100% secure.

8. Your Data Protection Rights (GDPR)

You have the following rights regarding your personal data:

  • Right to Access: You can request copies of your personal data.
  • Right to Rectification: You can request that we correct any inaccurate information or complete incomplete information.
  • Right to Erasure ('Right to be Forgotten'): You can request that we delete your personal data, under certain conditions (including upon request, as required by Apple).
  • Right to Restrict Processing: You can request that we restrict the processing of your personal data, under certain conditions.
  • Right to Object to Processing: You can object to our processing of your personal data where we rely on Legitimate Interests as the legal basis.
  • Right to Data Portability: You can request that we transfer the data we have collected to another organization, or directly to you, under certain conditions.
  • Right to Withdraw Consent: If we rely on your consent to process your data (e.g., for newsletters), you have the right to withdraw that consent at any time.
  • Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority if you believe our processing of your data infringes GDPR.

To exercise any of these rights, please contact us at info@onalbanian.com. We will respond to your request within one month.

9. International Data Transfers

Our own servers are located in Germany (within the European Economic Area - EEA). Some of the service providers listed in Section 5 may process data outside the EEA, for example Stripe for website payments. Error and crash data is currently processed by Sentry (Functional Software, Inc.) in the United States; we are moving it to Sentry's EU region (Germany). Wherever personal data is transferred outside the EEA, we rely on appropriate safeguards, such as the provider's certification under the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.

10. Children's Privacy

Our Service is not intended for use by children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16 without verification of parental consent, we will take steps to remove that information from our servers.

11. Cookies

We only use essential cookies and the referral cookie described in Section 3. Our website analytics are cookieless. If we introduce cookies that require consent (e.g., for analytics or marketing), we will provide clear information and obtain your explicit consent beforehand.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. For significant changes, we may also notify you through the Service or via email. We encourage you to review this Privacy Policy periodically for any changes.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

info@onalbanian.com