Privacy Policy for the LearnShift App
As of: 15 August 2026. This English version is provided for convenience; the German version prevails.
1. Controller
The controller for data processing in the LearnShift app is Lean Shift UG (haftungsbeschränkt), Im Kleff 29, 58762 Altena, Germany, kontakt@lean-shift.com, represented by managing director Matthias Sperling. This policy applies to the LearnShift app on all platforms on which we offer it; the website lean-shift.com is covered by the separate privacy policy in the imprint.
2. Overview
LearnShift is a learning application that works without an account and without signing in. The learning content is installed with the app; learning happens entirely on the device. The app contains no analytics tools, no tracking libraries and no advertising. The only data transfer is the licence activation (section 4).
3. What the app stores locally
Stored locally on the device: learning progress (flashcard reviews, exam attempts, badges, vocabulary state), settings, and, after an activation, the licence status including the licence key and the purchase email address it contains. Deletion happens through the app's deletion features or by uninstalling.
4. Licence activation and purchases through Google Play
The app's only network connection to us is the activation and deactivation of a licence, caught up on the next start if activation happened offline. The app transmits the licence key, a randomly generated device identifier (a UUID with no link to person or hardware) and the product identifier to our licence server, operated on the infrastructure of Cloudflare, Inc. as a processor; any transfer to third countries is safeguarded by EU standard contractual clauses. The licence key itself carries the email address given at purchase. On the licence server, each device's activation is recorded, including this email address and the device identifier, to enforce the licence's device limit. The legal basis is performance of the contract (Art. 6(1)(b) GDPR). The licence server processes IP addresses only briefly to protect against abuse and deletes them automatically (Art. 6(1)(f) GDPR). Content from the app is never transmitted. Purchases through Google Play: if you instead buy a paid tier directly in the app through Google Play, the data transfer works differently. When you purchase, the app sends Google a pseudonymous account identifier (a hash of the device identifier, never the identifier itself) and receives a purchase receipt (purchaseToken) from Google. The app then transmits this purchase receipt, the app's package name and the device identifier to our licence server. Our licence server verifies the purchase server-side with Google (Google Play Developer API) and then issues the licence. We store a hash of the purchase receipt (never the receipt itself), together with the licence identifier, licence tier, product name and package name, for six years. We do not process an email address through this purchase path. The legal basis for verification and issuance is performance of the contract (Art. 6(1)(b) GDPR). If Google reports a cancellation with refund or a revoked purchase, our licence server blocks the corresponding licence; the legal basis for this is our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR). To renew an active licence, the app checks again with our licence server on its own. For the purchase itself, Google acts as the store's independent provider: your purchase contract is with Google Commerce Limited (Ireland), Google displays the price and handles payment, and cancellation and refunds are processed through Google Play. Google's own privacy policy applies to this in addition.
5. Retention and deletion
The licence record on the licence server exists for the duration of licence administration. You release the device assignment via the app's licence deactivation; we carry out the complete deletion of your licence record including the email address on request to kontakt@lean-shift.com, unless statutory retention obligations prevent it. You delete all locally stored data on your device yourself; section 3 names the ways.
6. Device backup on Android
The Android version of LearnShift is excluded from automatic device backup: its data directory is not backed up into a Google account. You alone trigger a backup of your learning progress via the export function.
7. Your rights
You have the rights under Art. 15 to 21 GDPR: access, rectification, erasure, restriction of processing, data portability and objection. You also have the right to lodge a complaint with a data protection supervisory authority, such as the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia. For all requests, contact kontakt@lean-shift.com.
8. Changes
We publish changes to this policy at this address and point them out in the app or in the store listing.