Privacy Policy

Last updated: July 14, 2026

Controller

The controller responsible for data processing in connection with the Loomika mobile application ("the app") and this website is:

Dorian Müller, DMC App Studio
Ulmenweg 12, 36154 Hosenfeld, Germany
Email: dmc.app.studio@gmail.com

Overview

Loomika is designed to work locally first: your flashcards, decks, study progress, and settings are stored on your device and stay there unless you sign in and enable Cloud Sync, use cloud AI features, or explicitly export data. Below we explain each processing activity, its legal basis under the GDPR, and how long data is kept.

1. Data Stored Locally on Your Device

Decks, cards, media attachments (including audio you record with the microphone and photos you attach), study progress, statistics, and app preferences are stored locally on your device. Audio recordings and images are only created when you actively use these features. Your year-of-birth selection is stored on the device only as a derived age category and is never uploaded.

Legal basis: Not applicable — this data does not reach us. It remains under your control and is deleted when you delete it in the app or uninstall the app.

2. Account & Cloud Sync (optional, 13+)

If you create an account, we use Firebase Authentication (Google Ireland Ltd.) to sign you in with email/password or Google Sign-In. This processes your email address and, with Google Sign-In, your name and profile picture. Account creation is only available to users aged 13 or older.

Cloud Sync is an optional feature for Loomika Unlimited subscribers. When enabled, your decks, cards, study progress, and media attachments (images/audio) are stored on Google Cloud Firestore and Firebase Storage so they can be synced across your devices.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract you enter into by creating an account and subscribing).

Retention: Until you delete your account. The "Delete Cloud Account" option in Settings permanently deletes your authentication account, all synced data, and all uploaded media. See our Account Deletion page for details.

3. AI Features

Loomika's AI card generation can use Google Gemini (via Firebase AI, Google Ireland Ltd.). When you use this feature, the text prompts and images you submit are sent to Google for processing. Loomika also offers an on-device AI model that processes prompts entirely locally. Cloud AI features are only available to users aged 13 or older and are used only when you actively trigger them.

Translation and text recognition (OCR) use Google ML Kit and run entirely on your device — this data is not sent to any server.

Legal basis: Art. 6(1)(b) GDPR (providing the feature you request).

Retention: We do not store your prompts. Google's processing is governed by the Firebase Data Processing Terms.

4. Crash Reporting

We use Firebase Crashlytics to collect crash reports so we can fix bugs. Crash reports include device model, operating system version, app version, crash stack traces, and a pseudonymous installation identifier. This data is pseudonymous — we cannot directly identify you from it, but it is not fully anonymous.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in providing a stable, error-free app).

Retention: Crash data is retained by Firebase for 90 days.

We also use Firebase App Check to protect our backend from abuse; it verifies app integrity and does not build user profiles.

5. Advertising (Google AdMob)

The free version displays ads through Google AdMob. In the European Economic Area and the UK, we show a consent dialog (Google User Messaging Platform) before any ad-related data is processed. Personalized ads — which involve device identifiers and advertising IDs — are only shown if you consent. You can change or withdraw your choices at any time via "Privacy Options" in the app's Settings.

For users under 16, ad requests are tagged for restricted data processing; for users under 13, ads are additionally limited to child-appropriate content and are never personalized.

Users with the Ad-Free or Unlimited subscription see no ads.

Legal basis: Art. 6(1)(a) GDPR (your consent) for personalized advertising; consent can be withdrawn at any time with effect for the future.

6. In-App Purchases (RevenueCat)

We use RevenueCat, Inc. (USA) to manage subscriptions. RevenueCat processes purchase receipts and a pseudonymous app user ID from the app stores. Payment details are handled exclusively by Google Play / Apple; we never see them.

Legal basis: Art. 6(1)(b) GDPR (processing your purchase).

Retention: Purchase records are kept as long as required for the subscription to function and for statutory record-keeping obligations.

7. This Website

This website is hosted on Vercel (Vercel Inc., USA). When you visit it, the server processes your IP address and standard request data (browser type, time of access) in server logs for delivery and security purposes. Fonts are served locally from our own hosting — no requests are sent to third-party font services. The website sets no cookies and uses no analytics.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating a secure website).

International Data Transfers

Google and RevenueCat may process data on servers in the United States. These transfers are safeguarded by the EU-U.S. Data Privacy Framework and/or EU Standard Contractual Clauses (Art. 46 GDPR).

Your Rights

Under the GDPR you have the right to:

• Access (Art. 15) — obtain a copy of your personal data
• Rectification (Art. 16) — correct inaccurate data
• Erasure (Art. 17) — delete your data (in-app: "Delete Cloud Account" and "Delete Local Data")
• Restriction of processing (Art. 18)
• Data portability (Art. 20) — export your data using the app's export feature
• Object (Art. 21) — object to processing based on legitimate interests
• Withdraw consent (Art. 7(3)) — e.g. via "Privacy Options" in Settings, with effect for the future
• Lodge a complaint (Art. 77) with a supervisory authority — for us, the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), Wiesbaden, Germany

Children's Privacy

Loomika can be used by children. To protect younger users, the app asks for the year of birth on first launch: users under 13 cannot create accounts or use cloud AI features, and only see non-personalized, child-appropriate ads. We do not knowingly collect personal data from children under 13. The age information itself is stored only on the device.

Data Security

Local data is protected by your device's security measures. Cloud data is stored on Google Firebase infrastructure with access restricted to your authenticated account. We do not sell your data or share it with third parties for their own marketing purposes.

Changes to This Policy

We may update this Privacy Policy from time to time. We will post the new version on this page and update the "Last updated" date.

Contact Us