OFO Labs
Back to Language Diary

Privacy Policy

Language Diary

Privacy Policy for Language Diary

Language Diary - AI Journal Published by OFO Labs

Last Updated: July 22, 2026 Effective Date: July 22, 2026

1. Controller

The controller responsible for data processing within the meaning of Article 4(7) GDPR is:

Publisher: OFO Labs (Faruk Orman) Location: Kiel, Germany, 24105 Contact: ofolabs@gmail.com

If you have any questions about this privacy policy or the processing of your data, please contact us at the email address above.

2. Overview

Language Diary is a language learning app that helps you improve your writing skills by keeping a diary in your target language. This privacy policy explains what data we process, why, and your rights under the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), the Telecommunications-Digital Services Data Protection Act (TDDDG), and the Digital Services Act (DDG).

We take the protection of your personal data very seriously. Your diary entries are private, and the app is designed with data minimization in mind.

3. Data We Process

3.1 Data Stored Locally on Your Device

The following data is stored exclusively on your iPhone using Apple's SwiftData framework. This data never leaves your device except as described in Section 3.2.

| Data | Purpose | Storage | |------|---------|---------| | Diary entries (original text) | Core app functionality | On-device only | | Corrected texts and explanations | Learning feature | On-device only | | Vocabulary items | Personal word bank | On-device only | | Review cards | Spaced repetition learning | On-device only | | Mistake patterns | Progress tracking | On-device only | | Language preferences | App personalization | On-device only | | Device token (anonymous UUID) | Rate limiting | On-device and backend |

We do not have access to this data. It is not backed up to our servers.

3.2 Data Transmitted to Third-Party Services

When you submit a diary entry for analysis, the following data is transmitted through our secure backend proxy to OpenAI for AI-powered text analysis:

| Data Sent | Purpose | Recipient | |-----------|---------|-----------| | Diary entry text | Correction, explanation, vocabulary extraction | OpenAI Ireland Ltd. via Cloudflare Workers proxy | | Selected mother tongue (language code only) | Generate explanations in your language | OpenAI Ireland Ltd. | | Selected target language (language code only) | Correct text in the right language | OpenAI Ireland Ltd. | | Anonymous device token (UUID) | Rate limiting, abuse prevention | Cloudflare, Inc. | | Subscription proof (Apple-signed transaction) | Verifying premium entitlement | Cloudflare, Inc. (verified, not stored) |

Important:

  • Your diary text is sent to OpenAI solely for the purpose of generating corrections, explanations, and learning materials.
  • OpenAI does not use data submitted via its API for training AI models. This is confirmed in OpenAI's API Data Usage Policy and our Data Processing Agreement with OpenAI.
  • Our backend proxy (Cloudflare Workers) does not store your diary text. It is a pass-through service that forwards your request to OpenAI and returns the response.
  • Cloudflare stores only anonymous device tokens, request counters, and short-lived subscription status flags (for rate limiting and entitlement checks) in its Key-Value storage. These records auto-expire within 7 days. No diary content is stored.

3.3 Data We Do NOT Collect

We do not collect:

  • Your name, email address, or any personal identifiers
  • Your location
  • Your contacts
  • Device identifiers beyond the anonymous UUID
  • Analytics or usage statistics
  • Advertising identifiers
  • Health, financial, or biometric data

We do not use any analytics SDKs, tracking pixels, advertising frameworks, or cookies.

3.4 Subscription and Payment Data

If you subscribe to Language Diary Premium, all payment processing is handled by Apple through the App Store. We do not receive or store your payment information (credit card numbers, billing address, etc.). Our backend receives only an Apple-signed confirmation of your subscription status to verify your entitlement to premium features; this confirmation contains no payment details and is not stored beyond a short-lived verification cache.

4. Legal Basis for Processing (Art. 6 GDPR)

| Processing Activity | Legal Basis | Explanation | |---------------------|-------------|-------------| | Local storage of diary entries | Art. 6(1)(b) GDPR | Necessary for the performance of the contract (providing the app's core features) | | Transmission of diary text to OpenAI for analysis | Art. 6(1)(b) GDPR | Necessary for the performance of the contract (AI-powered correction and explanation is a core advertised feature of the app) | | Anonymous rate limiting | Art. 6(1)(f) GDPR | Legitimate interest in preventing abuse and ensuring service availability | | Subscription verification | Art. 6(1)(b) GDPR | Necessary for the performance of the contract (verifying entitlement to paid features) |

For the processing based on legitimate interest (rate limiting), our interest in preventing abuse and maintaining service availability outweighs any impact on your privacy, as the device token is an anonymous UUID that cannot identify you personally.

5. Recipients and Sub-Processors

Your data is shared with the following recipients:

5.1 OpenAI Ireland Ltd. (AI Processing)

  • Role: Data processor
  • Purpose: Text correction, explanation generation, vocabulary extraction
  • Data received: Diary entry text, language codes
  • Data retention by OpenAI: Up to 30 days for abuse monitoring and compliance, then deleted. API data is not used for model training.
  • Location: Data may be processed in the United States
  • Safeguards: Standard Contractual Clauses (SCCs) per Art. 46(2)(c) GDPR, incorporated in OpenAI's Data Processing Addendum
  • Contact: OpenAI Ireland Ltd., 1st Floor, Burlington Plaza, Burlington Road, Dublin 4, Ireland

5.2 Cloudflare, Inc. (Backend Proxy Infrastructure)

  • Role: Sub-processor
  • Purpose: Hosting our backend proxy that routes requests to OpenAI; rate limiting and entitlement verification via Key-Value storage
  • Data received: Anonymous device token, request metadata, diary text (in transit only, not stored)
  • Data retention: Rate limit counters and verification flags auto-expire within 7 days. No diary content is stored.
  • Location: Requests are processed at the nearest Cloudflare edge location globally
  • Safeguards: Standard Contractual Clauses (SCCs) incorporated in Cloudflare's Customer Data Processing Addendum

5.3 Apple Inc. (App Distribution and Payments)

  • Role: Independent controller for App Store and payment processing
  • Purpose: App distribution, subscription management, payment processing
  • Data received: Handled independently by Apple per Apple's own privacy policy
  • Privacy policy: https://www.apple.com/legal/privacy/

6. International Data Transfers

Your diary text may be transferred to servers located outside the European Economic Area (EEA), specifically to the United States, when processed by OpenAI. These transfers are protected by Standard Contractual Clauses (SCCs) adopted by the European Commission pursuant to Art. 46(2)(c) GDPR, as incorporated into our Data Processing Agreements with OpenAI and Cloudflare.

You can request a copy of the applicable SCCs by contacting us at the email address in Section 1.

7. Data Retention

| Data | Retention Period | |------|-----------------| | Diary entries and learning data (on-device) | Until you delete them in the app or delete the app | | Data sent to OpenAI | Up to 30 days by OpenAI for compliance monitoring, then deleted | | Rate limit counters and verification flags (Cloudflare KV) | Auto-expire within 7 days | | Subscription status (on-device) | Duration of app installation |

You can delete all your data at any time via Settings > Data > Delete All Data within the app. Deleting the app from your device also removes all locally stored data.

8. Your Rights (Art. 15-22 GDPR)

Under the GDPR, you have the following rights:

  • Right of access (Art. 15): You can request information about the personal data we process about you. Since all diary data is stored locally on your device, you already have direct access to it.
  • Right to rectification (Art. 16): You can edit your diary entries directly in the app.
  • Right to erasure (Art. 17): You can delete individual entries or all data via the app settings. You can also request that we instruct our processors to delete any data they hold.
  • Right to restriction of processing (Art. 18): You can request restriction of processing under certain circumstances.
  • Right to data portability (Art. 20): You can export your entire diary in a structured, commonly used, machine-readable format (text or JSON) at any time via Settings > Data > Export Diary.
  • Right to object (Art. 21): You can object to processing based on legitimate interest (rate limiting). Contact us at the email address in Section 1.
  • Right to withdraw consent: Where processing is based on consent, you can withdraw consent at any time. This does not affect the lawfulness of processing based on consent before withdrawal.

To exercise any of these rights, contact us at the email address provided in Section 1. We will respond within one month as required by Art. 12(3) GDPR.

9. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement. The competent supervisory authority for our business is:

Unabhaengiges Landeszentrum fuer Datenschutz Schleswig-Holstein (ULD), Holstenstrasse 98, 24103 Kiel, https://www.datenschutzzentrum.de

A full list of German supervisory authorities is available at: https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html

10. Use of Artificial Intelligence

This app uses artificial intelligence (AI) provided by OpenAI to analyze your diary entries. Specifically, AI is used to:

  • Correct grammar and vocabulary in your target language
  • Generate explanations for mistakes in your mother tongue
  • Identify words from your mother tongue mixed into target-language text
  • Extract personal vocabulary and generate review cards
  • Identify recurring mistake patterns over time

In accordance with Article 50 of the EU AI Act (Regulation (EU) 2024/1689), we inform you that:

  • Text corrections, explanations, and vocabulary suggestions displayed in the app are generated by AI
  • The AI processes your diary text as input and produces structured corrections and explanations as output
  • AI-generated content is used in an assistive capacity to help you learn; it does not replace human judgment
  • No automated decisions with legal or similarly significant effects are made about you based on AI processing

11. Children's Privacy

Language Diary is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has submitted personal data through the app, please contact us so we can delete it.

12. Local Storage Under TDDDG

The storage of diary entries, vocabulary, review cards, and other learning data on your device using SwiftData is strictly necessary to provide the service you have explicitly requested (Section 25(2) No. 2 TDDDG). Therefore, no separate consent is required for this local storage.

13. Changes to This Privacy Policy

We may update this privacy policy from time to time. If we make material changes, we will notify you through an in-app notice. The date of the last update is shown at the top of this document. We encourage you to review this policy periodically.

14. Data Processing Agreements

We have entered into Data Processing Agreements in accordance with Art. 28 GDPR with the following processors:

  • OpenAI Ireland Ltd.: Data Processing Addendum (available at https://openai.com/policies/data-processing-addendum/)
  • Cloudflare, Inc.: Customer Data Processing Addendum (incorporated into the Self-Serve Subscription Agreement, available at https://www.cloudflare.com/cloudflare-customer-dpa/)

Impressum (Legal Notice per Section 5 DDG)

OFO Labs (Faruk Orman) Kiel, Germany, 24105 Email: ofolabs@gmail.com

Responsible for content per Section 18(2) MStV: Faruk Orman