Privacy Policy – Makker

1. Introduction & Full GDPR Compliance Commitment

RettSync (“we,” “us,” “our,” or “Company”) operates the Makker language learning platform across all distributions (the “Platform,” “App,” or “Service”). We are 100% committed to compliance with the European Union General Data Protection Regulation (GDPR / Regulation (EU) 2016/679), Danish Data Protection Law, Apple App Store Review Guidelines, and Google Play Data Safety policies.

We enforce strict data minimization: we collect only what is strictly necessary to deliver live, interactive language learning, and we never monetize, broker, or sell personal data.

2. Legal Basis for Data Processing (GDPR Art. 6)

We process your personal data under the following strict legal grounds:

• Explicit Consent (Art. 6(1)(a)): For capturing microphone audio during user-initiated speaking practice and serving personalized ads via Google User Messaging Platform (UMP).
• Contract Performance (Art. 6(1)(b)): To deliver real-time AI conversational dialogue, interactive pronunciation scoring, user authentication, and subscription tier allowances.
• Legal Obligations (Art. 6(1)(c)): To comply with mandatory statutory, tax, and regulatory obligations in Denmark and the EU.
• Legitimate Interests (Art. 6(1)(f) & Recitals 47/49): To prevent fraud, protect infrastructure against bot farming and abuse, perform cryptographic hardware attestation, and maintain platform security.

3. Legitimate Interest Lawful Basis for Device Attestation & Anti-Fraud Defense

Pursuant to Recital 47 of the GDPR ("The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned") and Recital 49 (network and information security), RettSync asserts its Legitimate Interests under Article 6(1)(f) to process technical security signals:

• Cryptographic Hardware Attestation: Interfacing with Apple DeviceCheck and App Attest APIs to verify that requests originate from untampered physical devices.
• Device Fingerprinting: Hashing vendor identifiers (IDFV) and OS build markers to ensure each physical device claims promotional starter points only once (device_trials registry).
• IP Rate Limiting & Hashing: Generating SHA-256 cryptographic hashes of incoming IP addresses (ip_trials) to prevent coordinated network-level bonus farming and brute-force attacks.
• Normalized Email Hashing & Blacklisting: Normalizing registered email addresses to detect multi-account farming, and screening domains against automated disposable/burner email blacklists.

4. What Data We Process

Account & Authentication Information

• Email address (for authentication and cloud synchronization)
• Display name and avatar selection (optional)
• Hashed passwords (managed securely via Firebase Authentication; never accessible in plain text)
• Account creation timestamp and localized target language preferences

Voice Audio & Speech Practice (AI & Microphone Protections)

Data Linked to Your Identity

• Account & Authentication: Email address, Name (optional), Firebase UID, Google/Apple ID.
• Financial & Subscriptions: App User ID and purchase history via RevenueCat.

Data Not Linked to Your Identity (Unlinked Data)

• Usage & Diagnostics: Device Model, OS Version, App Version, and anonymous crash telemetry.
• Advertising Identifiers: IDFA/AAID (used by Google AdMob on Free Tier).

Data We Do NOT Collect

• ❌ Location Data: Makker is 100% location-free. We do not access GPS, beacons, or cellular geolocation.
• ❌ Biometric Identifiers: We do not create, store, or extract voiceprints, facial geometry, or biometric templates.
• ❌ Contacts & SMS: We never access your address book, SMS logs, or phone calls.
• ❌ Financial Payment Data: All in-app subscriptions and payments are handled exclusively by Apple (App Store) or Google (Google Play). We never receive or store your credit card numbers.

5. Data Retention & Erasure Schedule

6. Your Legal Rights Under GDPR (Articles 15–22)

We fully uphold your rights under EU and international privacy regulations:

• Right to Access (Art. 15): Request confirmation and a copy of personal data processed by us.
• Right to Data Portability (Art. 20): Export your complete profile and learning data in JSON format directly in the app (Profile -> Data & Privacy -> Export My Data).
• Right to Rectification (Art. 16): Update or correct inaccurate profile details.
• Right to Erasure (Art. 17): Request total deletion of your profile and cloud data (Right to Be Forgotten) via Profile -> Data & Privacy -> Delete Account.
• Right to Revoke Consent: Withdraw microphone permissions or analytics tracking at any time via in-app settings (Profile -> Data & Privacy -> Revoke AI Voice Consent).

To exercise any of these rights, contact us at makker@rettsync.com.

7. Third-Party Data Processors

We share minimal necessary data with verified, GDPR-compliant service providers under strict Standard Contractual Clauses (SCCs):

• Firebase / Google Cloud: Cloud database, authentication, hosting, and crash analytics. (Firebase Privacy)
• Google Gemini AI: Ephemeral speech evaluation and conversational simulation. (Google Privacy)
• RevenueCat: In-app subscription infrastructure and receipt validation. (RevenueCat Privacy)
• Google AdMob / UMP: Rewarded video ads for Free Tier users. (AdMob Privacy)
• Apple App Store & Google Play: In-app transaction billing and payment execution.

8. Advertising and GDPR Consent (Google UMP)

We use Google AdMob to display advertisements to free-tier users.

For Users in the European Economic Area (EEA) and UK: We strictly rely on Google's User Messaging Platform (UMP) to gather and manage your consent. Upon launching the app, the CMP dialog will explicitly ask for your consent before serving personalized advertisements. If you decline, you will only receive non-personalized ads. You may manage or revoke your consent at any time via the in-app Privacy Settings.

9. Strict Limitation of Liability ($10.00 USD Cap)

10. Age Rating & Children's Privacy (Strict 18+ Barrier)

Makker is strictly intended for adult learners aged 18 and older. We do not knowingly collect personal data from anyone under the age of 18. If we discover an account created by a minor, it will be deleted immediately.

11. Contact Information & Supervisory Authority

Data Controller:
RettSync
CVR: 46142306
Copenhagen, Denmark
Email: makker@rettsync.com | contact@rettsync.com

Lead Supervisory Authority:
Datatilsynet (Danish Data Protection Agency)
Carl Jacobsens Vej 35, 2500 Valby, Denmark
Website: www.datatilsynet.dk