Privacy policy for the Klarineo app

1. Controller

The controller responsible for data processing in the App is:

You can contact us about privacy at any time by email or via Telegram (see section 13).

2. Analysis of letters and documents

When you photograph a letter or enter text, the App sends the image or text together with your chosen explanation language to Google's Gemini models through Firebase AI Logic (Vertex AI Gemini API), a service of Google. The model creates the explanation, key phrases and reply draft that you see in the App. Before upload, the App re-encodes photos on your device and removes embedded metadata such as location (EXIF/GPS).

Purpose: providing the function you request. Legal basis: your consent, which the App asks for before the first analysis — Art. 6(1)(a) GDPR and, because letters can contain special categories of data (for example health information), your explicit consent under Art. 9(2)(a) GDPR. You can withdraw consent at any time in the App settings (“AI analysis of letters”); after that, letter analysis and speaking practice are no longer available, while your saved phrases remain usable.

Letters often contain personal data — such as your name, address, file numbers or information about benefits or health. Please only photograph documents you are entitled to use, and you may cover information that is not needed for the explanation.

Under Google's terms for these services, the content is processed to generate the response and is not used to train Google's AI models. We do not store the photos or texts of your letters on our servers. Google may keep data for a limited time where required for security and abuse prevention, in accordance with its terms. The AI is instructed not to repeat personal identifiers in its answer, but this cannot be ensured in every case.

Processing location: the App uses Google's Vertex AI service, configured per our project settings; depending on the configured region, requests may be processed in data centres outside the EU/EEA (see section 10).

3. Data stored on your device

Letters you save, their explanations, deadlines, key phrases, your review progress, daily goal, streak and settings are stored locally on your device. We have no access to this data. It is removed when you use “Delete all my data” in the App or uninstall the App. Your operating system's own device backup may include app data, depending on your device settings.

4. Speaking practice and speech recognition

For speaking practice, the App uses the speech recognition service built into your phone's operating system (Apple on iOS, Google on Android). Depending on your device and settings, speech may be processed on the device or by Apple or Google under their own privacy terms. The App asks for microphone permission before first use; you can withdraw it in your phone settings at any time.

The recognised text of your answers and the conversation context are sent to Google's Gemini models via Firebase AI Logic (see section 2) to generate the reply of your conversation partner and corrections. We do not store recordings or transcripts on our servers. Legal basis: your consent under Art. 6(1)(a) and Art. 9(2)(a) GDPR (the same consent as in section 2); speaking practice is only available after you give it.

5. Reminders and notifications

Deadline and daily reminders are local notifications created on your device; their content is not sent to us. Notifications on the lock screen show only a general text, not the content of your letter. The App does not send marketing push messages. Firebase Cloud Messaging is included in the App but does not register your device automatically. Legal basis: Art. 6(1)(b) GDPR and, where your permission is required, Art. 6(1)(a) GDPR. You can switch reminders off in the App settings or your phone settings at any time.

6. Abuse prevention (Firebase App Check)

To protect our AI functions from misuse — for example automated requests that do not come from the genuine App — we use Firebase App Check. It checks, with the help of the platform's attestation services (for example Play Integrity on Android, App Attest or DeviceCheck on iOS), that requests come from an unmodified copy of the App on a genuine device. Technical device and app information is processed for this. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is the security and availability of the service and preventing misuse.

7. Analytics and diagnostics — only with your consent

If — and only if — you agree in the App, we use Google Analytics for Firebase to understand how the App is used and to detect problems, for example which screens are used, app version, device type, approximate region derived from the IP address, and technical error information. This data is pseudonymous (linked to a random app-instance identifier, not to your name). Analytics is used without advertising features, and we do not combine it with other data to identify you. “Delete all my data” resets this identifier.

Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time in the App settings; this does not affect the lawfulness of processing before withdrawal. Without consent, no analytics or diagnostics data is collected.

8. Subscriptions and purchases

Klarineo Pro subscriptions and any free trial offered by the store are handled entirely by Apple (App Store) or Google (Google Play). We do not receive your payment card or bank details. The App only receives information from the store about whether a subscription or trial is active, so that Pro features can be unlocked. Legal basis: Art. 6(1)(b) GDPR. The stores process your purchase under their own terms and privacy policies.

9. What we do not do

• No advertising and no advertising identifiers.
• No tracking across other apps or websites.
• No sale or rental of your personal data.
• No account, password or email address required to use the App.
• No use of your letters to train AI models.

10. Recipients and international transfers

We use services of Google (Firebase, Firebase AI Logic / Vertex AI, Firebase Remote Config for app configuration such as the AI model version, Firebase Cloud Messaging, Firebase App Check and — with consent — Google Analytics for Firebase) as processors under data processing terms. For users in the EU/EEA the contracting party is generally Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may also be processed by Google LLC in the USA or in other countries.

For transfers to countries outside the EU/EEA, Google relies on the EU–US Data Privacy Framework where applicable and on the European Commission's Standard Contractual Clauses. Apple and Google also process data as independent controllers for their app stores and operating system services.

We do not pass your data to other third parties unless we are legally obliged to do so.

This website is hosted on GitHub Pages (GitHub, Inc., USA). When you visit it, GitHub processes your IP address and technical request data in server logs to deliver the site securely. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, available website).

11. Retention

• Letters, explanations, phrases and learning progress: stored only on your device until you delete them, use “Delete all my data” or uninstall the App.
• Content sent for analysis: processed by Google to create the response and not stored by us; Google may retain it for a limited time for security and abuse prevention under its terms.
• Notification token (only if push messaging is ever enabled): until you uninstall the App, use “Delete all my data” or the token is renewed.
• Analytics data (only with consent): retained for a limited period in Google Analytics for Firebase and then deleted automatically.
• Emails and messages you send us: as long as needed to answer your request and as required by law.

12. Your rights

Under the GDPR you have the right to:

• access the personal data we process about you (Art. 15 GDPR);
• rectification of incorrect data (Art. 16 GDPR);
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR);
• data portability (Art. 20 GDPR);
• object to processing based on legitimate interests (Art. 21 GDPR);
• withdraw consent at any time with effect for the future (Art. 7(3) GDPR);
• lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence or place of work.

Because the App works without an account and stores your content on your device, we usually cannot identify you or find data about you on our side. To delete everything the App has stored, open the App settings and choose “Delete all my data”, then uninstall the App. To exercise your rights or ask a question, contact us using the details below.

13. Contact

14. Minimum age

The App is intended for people aged 16 and over. We do not knowingly process data of children under 16. If you believe a child has used the App, please contact us.

15. Changes to this policy

We update this policy when the App or legal requirements change. The current version is always published on this page. Last updated: 22 October 2026.