Privacy Policy
Last updated: 26 September 2026
This Privacy Policy explains how GrammarBurst ("GrammarBurst", "we", "us") collects, uses, and protects your personal data when you use the GrammarBurst mobile app and this website. We follow the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). We designed GrammarBurst to collect as little as possible and to keep your learning data in the European Union.
1. Data controller
The controller responsible for your personal data is:
sydacos GmbH
Hasenböge 17, 21514 Klein Pampau, Germany
Email: contact@grammarburst.app
Full company registration details are listed in our Impressum.
2. What we collect and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account identity — email address, and the Apple or Google sign-in identifier you choose | Create and secure your account, sign you in | Art. 6(1)(b) — performance of a contract |
| Learning data — your writing submissions, quiz answers, diagnosed Grammar Bugs, Pattern Map, and review progress | Diagnose your recurring mistakes and build your personalized practice | Art. 6(1)(b) — performance of a contract |
| Subscription status — your entitlement and trial state | Provide paid features and enforce free-tier limits | Art. 6(1)(b) — performance of a contract |
| Product analytics (only if you say yes in the app) — pseudonymous identifiers linked to your account, feature events, and counts (no free text) | Understand which features help learners and improve the app | Art. 6(1)(a) — your consent; § 25(1) TDDDG for the identifier stored on your device |
| Crash diagnostics — technical error reports with personal data stripped out | Detect and fix crashes and defects | Art. 6(1)(f) — legitimate interest |
We do not collect voice or audio. GrammarBurst v1 works entirely with typed text. We never use your writing as a public example without your explicit permission.
3. How AI is used (transparency)
GrammarBurst uses artificial intelligence to analyze the English text you submit so it can identify recurring tense and preposition mistakes, explain the rule behind each one, generate practice, and give feedback. This processing is automated. In line with the EU AI Act's transparency principles, we want you to know clearly when AI is involved.
GrammarBurst is a learning aid. It does not issue certifications, official language-level assessments, or any decision with legal or similarly significant effects. AI output is a suggestion to help you learn, not an authoritative ruling.
4. Where your data lives
Your learning data — your writing, answers, Grammar Bugs, and review history — is stored in Amazon Web Services data centers in the Frankfurt, Germany (eu-central-1) region only. It is encrypted at rest with customer-managed keys and protected by point-in-time backups. Your learning text is never written to analytics or application logs.
5. Service providers (processors)
We share the minimum necessary data with carefully chosen providers who process it on our behalf under data-processing agreements. Where a provider is outside the EU/EEA, transfers are covered by the European Commission's Standard Contractual Clauses.
Clerk (authentication)
Manages sign-in and your account identity (email, Apple/Google sign-in identifier). Provided by Clerk, Inc. (United States) under Standard Contractual Clauses. When you delete your account, we delete your learning data first and then delete your Clerk user record.
Amazon Web Services (hosting & storage)
Hosts our backend and stores all learning data in DynamoDB in the eu-central-1 (Frankfurt) region, encrypted with customer-managed KMS keys. Provided by Amazon Web Services EMEA SARL.
OpenAI (AI processing)
Processes the text you submit to diagnose Grammar Bugs and generate explanations, exercises, and feedback. Provided by OpenAI under a data-processing agreement that prohibits using your data to train their models. Text is sent only from our secure backend, never directly from your device.
PostHog (product analytics — only with your consent)
Records structured product events — pseudonymous identifiers linked to your account, feature names, and counts only. Our analytics layer is built so that free text and your learning content can never be sent, so analytics never includes your writing. Hosted on PostHog's EU cloud. We switch this on only after you say yes to "Share usage data" in the app; until then the app creates no analytics identifier on your device and sends no events. Legal basis: your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG). You can withdraw your consent at any time in the app under Settings › Privacy › Share usage data. Withdrawal takes effect immediately for the future and does not affect the lawfulness of processing before it; events collected before you withdrew are kept only for the limited period described in section 6.
Sentry (crash reporting)
Receives technical crash reports to help us fix defects. We disable default personal-data capture and strip request bodies, cookies, and headers before reports are sent.
RevenueCat & Apple (subscriptions)
RevenueCat manages your subscription entitlement, keyed to your account identifier. Payments are processed by Apple through the App Store — GrammarBurst never sees or stores your payment card details.
Vercel (website hosting & web analytics)
This website is hosted by Vercel Inc. (United States; certified under the EU-U.S. Data Privacy Framework). When you visit, Vercel transiently processes your IP address and browser information to deliver the site securely. We also use Vercel Web Analytics to understand aggregate traffic to this website: it sets no cookies, stores nothing on your device, and does not follow you across sites. Visits are counted using a short-lived anonymized hash that is discarded within 24 hours, and we only ever see aggregate statistics such as page views and referrers — never a profile of you. Legal basis: our legitimate interest in measuring the reach of our website (Art. 6(1)(f) GDPR). You can object to this processing at any time at contact@grammarburst.app.
6. How long we keep your data
We keep your learning data for as long as your account is active. When you delete your writing history or your account, the associated data is removed as described below. Crash and analytics data are retained only for a limited period for diagnostics and product improvement.
7. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict, and port your personal data, to object to processing based on legitimate interest, and to withdraw any consent you have given at any time with effect for the future. GrammarBurst gives you direct control in the app:
- Export your data — download a complete JSON copy of your account and learning data from Settings.
- Delete your writing history — remove your submitted writing at any time from Settings.
- Delete your account — a single action that cascades: it removes your learning data and then deletes your authentication record, permanently and in full.
- Share usage data — switch product analytics on or off at any time under Settings › Privacy. Switching it off withdraws your consent with immediate effect for the future.
- Manage your subscription — through your Apple App Store account.
To exercise any right that isn't available in the app, contact us at contact@grammarburst.app. You also have the right to lodge a complaint with a supervisory authority, for example your local German state data protection authority.
8. Children
GrammarBurst is for users aged 16 and older. We set this minimum because the app processes personal data (your learner text and account details) and 16 is the age at which a person can consent to such processing themselves under Art. 8 GDPR as applied in Germany. We do not knowingly collect personal data from anyone under 16, and creating an account includes confirming that you meet this minimum age. If you believe someone under 16 has provided us with personal data, please contact us at the address below so we can delete it.
9. Changes to this policy
We may update this policy as GrammarBurst evolves. When we make material changes, we will update the date at the top of this page and, where appropriate, notify you in the app.
10. Contact
Questions about your privacy? Email us at contact@grammarburst.app.