This policy explains which personal data wobbles, our web app for visual vocabulary learning, processes, why, and what rights you have under the EU General Data Protection Regulation (GDPR).
1. Controller
NextMotive (sole proprietorship), Raiffeisenplatz 5, 69221 Dossenheim, Germany
Email: support@wobbles.app
Contact form: wobbles.app/contact
Full details: Imprint.
2. What we process, and why
Visiting the website
The website is delivered by Cloudflare. To deliver its pages and protect them from attacks, your browser's IP address and the details of each request (address requested, time, browser type) are processed; we don't keep them. The fonts and icons come from our own site, so opening wobbles sends no request to Google or another third party.
Legal basis: our legitimate interest in a reliable, secure website (GDPR Art. 6(1)(f)).
Account and sign-in
When you sign in with Google, we receive your name, email address and profile picture to create and recognize your account.
Legal basis: performance of the contract (GDPR Art. 6(1)(b)).
Learning data
Your spaces, words, review progress, settings (such as your time zone) and AI Assist reports.
Legal basis: performance of the contract (GDPR Art. 6(1)(b)).
Security records
When you sign in, we record your IP address and browser type to protect accounts and detect abuse.
Legal basis: our legitimate interest in a secure service (GDPR Art. 6(1)(f)).
Analytics, cookies and browser storage
With your consent, we record which pages and features are used, to improve wobbles. Without it, we only count how often each page is opened per day, without any identifier or IP address. You can change your choice anytime with the "Cookie" link in the footer, and we keep a record of your choice as proof.
Your browser also stores what the app needs to work: the app's own files, so it loads fast and works offline; a sign-in cookie and app preferences once you sign in; your cookie choice with a random ID, once you make one; and what you ask for, such as an offer code from a link or a dismissed install hint. We use no advertising cookies.
Legal basis: your consent (GDPR Art. 6(1)(a)) for analytics; our legitimate interest in knowing which pages are used (Art. 6(1)(f)) for the anonymous page counts; our legal obligation to prove consent (Art. 6(1)(c)); strictly necessary storage (§ 25(2) TDDDG, Art. 6(1)(b)).
Paid plans
Payments are processed by Stripe, which collects your payment and billing details directly; we don't receive your card details. We share your email address and account ID with Stripe to link the subscription to your account, and email you a contract confirmation and, if you withdraw, a receipt.
Legal basis: performance of the contract and our legal obligations (GDPR Art. 6(1)(b) and (c)).
AI Assist
When you use AI Assist, the vocabulary entries it works on, their languages and a pseudonymous identifier are sent to an AI provider, which returns suggestions.
Legal basis: performance of the contract (GDPR Art. 6(1)(b)).
Contact form
When you write to us through the contact form, we receive your name, email address and message and, if you're signed in, which account sent it. We use them only to answer you, and your message is emailed to our support inbox.
Legal basis: our legitimate interest in answering your request (GDPR Art. 6(1)(f)); where it concerns your account or a paid plan, performance of the contract (Art. 6(1)(b)).
3. Recipients
We don't sell your data. We share it only as far as needed with:
- Cloudflare, Inc. (USA), to deliver the website, as our processor.
- Google Ireland Limited, for sign-in.
- Stripe Payments Europe, Ltd. (Ireland), for payments.
- OpenAI Ireland Ltd. and Anthropic Ireland, Limited (Ireland), for AI Assist, as our processors.
- Scaleway SAS (France), to send emails (subscription emails, and contact form messages to our support inbox), as our processor.
Some of them or their affiliates may process data outside the EU/EEA, in particular in the USA. Such transfers are based on an adequacy decision (EU-U.S. Data Privacy Framework) or the EU Standard Contractual Clauses.
4. How long we keep data
- Account and learning data: while your account exists, then deleted after a 30-day grace period.
- Security records: 30 days after your last activity.
- Analytics data: 180 days.
- Consent records: as long as we need them to prove your choice.
- Contact form messages: one year after you sent them.
- Payment and contract records: as long as commercial and tax law requires (up to 10 years).
5. Your rights
You have the right to access, correct and delete your data, to restrict or object to its processing, to data portability, and to withdraw consent at any time with effect for the future. We don't make decisions about you based solely on automated processing (GDPR Art. 22). To use your rights, email support@wobbles.app; you can also delete your account yourself from Account.
You can complain to a data protection authority, for example the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg.
Providing your data is voluntary, but without sign-in data we can't provide an account, and without payment data no paid plan. wobbles is only for people aged 16 or older, and paid plans only for people aged 18 or older.
6. Changes
We update this policy when our processing changes; the date at the top shows the current version.