Privacy Policy

1. Controller

The data controller is: Devcode LTD, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Email: [email protected]. Company Number: 14284192.

Devcode LTD provides services to users in the European Union and complies with both UK GDPR and EU GDPR where applicable.

2. Data we collect

We process only the data necessary to operate the app:

• Email address (if you create an account – optional)
• Anonymous user ID (assigned on first app launch)
• Device identifier (for app operation and troubleshooting)
• Purchase information and subscription status (processed by RevenueCat)
• App usage interactions: learning progress, session duration – no personal notes or content
• Crash reports and error logs (anonymised, processed by Firebase Crashlytics)
• Google account information (email address and basic profile) when you choose to sign in with Google

3. Third parties

We use the following third-party services:

• RevenueCat, Inc. (USA): subscription and in-app purchase management. Privacy policy: https://www.revenuecat.com/privacy
• Google LLC / Firebase Crashlytics (USA): crash reports and app stability monitoring. Privacy policy: https://firebase.google.com/support/privacy
• Google LLC / Google Sign-In (USA): when you choose to sign in with Google, we receive your email address and basic profile information via Google OAuth. This data is used solely to create and authenticate your account. We do not use Google user data for advertising, profiling, or AI/ML model training. We do not share Google user data with third parties. You may revoke access at any time via your Google Account settings at https://myaccount.google.com. Privacy policy: https://policies.google.com/privacy
• Meta Platforms, Inc. (USA): Meta integration is currently inactive (App ID not configured). This policy will be updated when activated.

4. Legal basis

Contract performance (Art. 6(1)(b) GDPR): data necessary to provide the app and subscription.

Legitimate interests (Art. 6(1)(f) GDPR): operating, securing and improving the app (e.g. crash analysis).

Consent (Art. 6(1)(a) GDPR): for optional account registration.

5. Retention

Account data is retained while the account is active and deleted within 30 days of account deletion.

Anonymous usage data and crash logs are deleted after 12 months at the latest.

Purchase records are retained in accordance with applicable tax retention requirements (up to 7 years).

6. Your rights

You have the following rights under GDPR:

• Access (Art. 15): request a copy of the data we hold about you.
• Rectification (Art. 16): correct inaccurate data.
• Erasure (Art. 17): delete your data (see also Section 7).
• Data portability (Art. 20): receive your data in machine-readable format.
• Object (Art. 21): object to processing based on legitimate interests.
• Restriction (Art. 18): restrict processing in certain circumstances.
• Lodge a complaint with a supervisory authority: primarily the UK Information Commissioner's Office (ICO) at https://ico.org.uk; EU users may also contact their national data protection authority.

7. Delete your account and data

You can delete your account at any time in the app: Profile → Settings → Delete account. All personal data is permanently removed within 30 days.

Alternatively, contact us by email: [email protected]

8. EU Representative (Art. 27 GDPR)

As a UK-based company processing data of EU residents, we are evaluating our obligations under Art. 27 GDPR regarding the appointment of an EU representative. This policy will be updated accordingly.

10. Google User Data

Our app uses Google Sign-In (OAuth 2.0), which allows users to authenticate using their Google account. This section specifically describes how we handle data received from Google APIs.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Data accessed: email address and basic profile information (name) from your Google account
• Purpose: solely to create and authenticate your Vatra account. No other use.
• Storage: stored securely on our servers. Retained while your account is active and deleted within 30 days of account deletion.
• Sharing: not shared with any third parties, advertisers, or data brokers.
• Advertising and AI/ML: Google user data is never used for advertising, remarketing, profiling, or training AI or machine learning models.
• Revoke access: you may revoke Vatra access to your Google account at any time at https://myaccount.google.com/permissions

11. Contact

Privacy enquiries: [email protected]