Privacy Policy

Introduction

Ulusoy Apps Oy (“we”, “us”, “our”) is committed to protecting your privacy in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and other applicable laws. This Privacy Policy applies to the Finish it mobile app for iOS and Android (the “app”) and to the website finnishit.ulusoyapps.com. It describes what we collect, why we collect it, how we use and share it, what other learners can see, and your rights.

1) Data Controller

2) Legal Bases for Processing

• Contract performance: Providing your account, the learning features (including AI feedback on your speaking and writing), the community features you choose to use, and your purchases.
• Legitimate interests: Keeping the app and its community safe (security, fraud and abuse prevention, content moderation, handling reports), improving the quality of learning content, keeping shared learning content available to other learners, analytics for product improvement, and performance monitoring. We balance these interests against your rights.
• Legal obligation: Tax and accounting, handling notices of illegal content under the EU Digital Services Act, and responding to lawful requests from authorities.
• Consent: Push notifications (your device’s notification permission), the iOS tracking permission, website cookies, and optional marketing communications. You can withdraw consent at any time (see section 14).

3) Categories of Personal Data We Process

• Identity and contact: Name, email address, and your Firebase user ID. If you sign in with Google or Apple, the basic profile they share with us (with Apple, this may be a private relay email address).
• Authentication data: Email and password (handled by Firebase Authentication; we never see your password) and the sign-in tokens Google or Apple issue.
• Account and profile: Display name, profile photo or avatar, the languages you learn and use the app in, your level, and your onboarding answers.
• Learning activity: Progress and study days, vocabulary cards and reviews, practice and question history, saved and liked items, settings, and usage limits.
• Content you submit to AI features: Your written answers, spoken answers (audio), chat and conversation messages, topics and prompts you choose, and text you ask us to translate.
• Community content: Practices created from your choices that are added to a shared community library, and your likes (see section 5).
• Feature Board content: Feature requests, comments, and votes you post, with the display name shown next to them (see section 5).
• Reports: Reports you send about content, and reports other users send about content you posted (see section 6).
• Purchase metadata: Subscription status and entitlement checks via RevenueCat, the App Store, and Google Play, linked to your Firebase user ID. We do not process card numbers.
• Technical data: Device model, operating system, app version, app language, security signals from Firebase App Check, a Firebase installation ID, and a push notification token.
• Analytics data: Screen views, in-app events, sessions, and app opens, sent to Google Analytics for Firebase and to Amplitude. Analytics may be linked to your Firebase user ID and to user properties such as subscription tier, learning language, and locale.
• Advertising identifier (iOS only, with your permission): If you allow tracking in the iOS prompt, Google Analytics for Firebase may collect your device’s advertising identifier (IDFA) to measure how people find and use the app. If you do not allow it, the identifier is not collected. We do not show ads.
• Crash data: Crash and error reports, device model and operating system, and stack traces via Firebase Crashlytics. These reports do not contain your answers or messages.
• Feedback emails: If you send feedback from the app, your email app sends a message from your own address to our team, including the device model, operating system, app version, and app language, so we can reproduce issues.

4) How We Use Your Data

• Create and authenticate your account and manage sessions.
• Provide and personalize learning features across speaking, writing, reading, listening, vocabulary, grammar, and more.
• Generate exercises, feedback, translations, and audio with Google Vertex AI (Gemini) and Google Cloud Translation.
• Show content you share to other learners and let them like it (section 5).
• Handle reports, fix errors in learning content, moderate community content, and act on abuse (section 6).
• Manage subscriptions with RevenueCat and verify purchases with Apple and Google.
• Send the notifications you allowed, such as study reminders.
• Analyze usage and performance (Google Analytics for Firebase, Amplitude) and improve reliability (Firebase Crashlytics).
• Protect the service (Firebase App Check, fraud and abuse prevention).
• Answer your support and feedback messages.
• Comply with legal obligations.
• Marketing: We do not sell personal data. Promotional messages are sent only with your consent.

5) Content Visible to Other Learners

• Community libraries: When you create some practices (for example reading texts, dialogues, speaking and writing prompts, image descriptions, and form-filling practices), the result may be added to a shared library for the language you study. Other learners can open it, like it, and see how many times it was liked and viewed. These items do not show your name or profile. They keep an internal reference to your account so the app can mark them as yours; other learners cannot see it. Please do not include personal information in the topics or text you enter.
• Likes: Like counts are public. The app does not show other learners who liked an item.
• Feature Board: Feature requests (title and description) and comments are visible to every user, together with your display name and its initials. Vote counts are public; who voted is not shown.

6) Reporting and Moderation

• Reports: You can report community items, feature requests, and comments, for example because they are offensive or spam, or because they contain a grammar error, wrong teaching content, or something that needs an editorial review. We store the reported item, the reason you chose, any note you add, the time, and your user ID. We review reports and may correct, hide, or remove content, or restrict an account that breaks our rules. We do not tell the author who reported their content.
• Automated checks: Feature requests and comments are checked automatically before they are published, which may use Google Vertex AI, to keep offensive content off the board. If your text is not accepted, you can edit it, or contact us to ask for a human review.
• Notices of illegal content: Anyone can report illegal content to us at info@ulusoyapps.com.

7) Data Sharing and Processors

We share data only as needed to operate the app, under appropriate contracts (for example data processing agreements and Standard Contractual Clauses):

• Google Firebase: Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Analytics, Crashlytics, App Check, Remote Config, Cloud Messaging, and Installations.
• Google Cloud Vertex AI (Gemini): Processes the text and audio you submit to AI features to generate exercises, feedback, conversations, and speech. Under Google Cloud’s terms, Google does not use this content to train its models.
• Google Cloud Translation: Processes text you choose to translate.
• Amplitude: Product analytics, stored in Amplitude’s EU data center.
• RevenueCat: Subscription management and entitlement checks.
• Apple and Google: Sign in with Apple, Google Sign-In, App Store and Google Play purchase processing and receipts.
• Shorebird: Delivers app updates; no user content is uploaded.
• Other learners: Only the content described in section 5.
• Authorities: When required by law.
• Other infrastructure providers as necessary and under contract.

8) International Transfers

• AI features use Vertex AI’s global endpoint, so Google may process a request in any of its data centers, including outside the EU/EEA. When a data center is overloaded, some requests are retried in another region, which can be in the United States.
• Our backend functions run mainly in Google Cloud regions in the EU. Two scheduled content jobs run in the United States; they do not process personal data.
• Google Analytics for Firebase, Crashlytics, RevenueCat, and Shorebird may process data outside the EU/EEA. Amplitude stores analytics in the EU.
• Transfers outside the EU/EEA are protected by the European Commission’s Standard Contractual Clauses and, where the recipient is certified, the EU–US Data Privacy Framework.

9) Retention

• Account, profile, and learning activity: Kept until you delete your account.
• Feature Board requests and comments: Deleted with your account. You can delete your own comments at any time.
• Community library items: Kept after you delete your account, because other learners use them. They never show your name; the internal reference to your account described in section 5 remains.
• Reports: Reports you file are deleted when you delete your account. A report about content you wrote is kept as our moderation record for as long as we need it to moderate the service and to handle legal claims; when you delete your account, your user ID and the copy of your text are removed from it.
• Audio (speaking): Not stored by us after evaluation.
• Purchases and entitlements: As required by the stores and by law.
• Analytics and crash data: According to the retention settings of Firebase and Amplitude.
• Support emails: As long as needed to handle your request.

10) Cookies and Tracking

Website: Functional and analytical cookies; preferences are managed via the cookie banner.

Mobile app: No cookies. The app uses Google Analytics for Firebase, Amplitude, and Firebase Crashlytics. It contains no advertising SDKs and shows no ads.

iOS tracking permission: On iOS, the app asks whether you allow tracking. If you allow it, the advertising identifier may be collected as described in section 3. You can change your choice at any time in iOS Settings > Privacy & Security > Tracking.

11) Your Rights (GDPR)

• Access, rectification, and erasure
• Object to or restrict processing (including analytics)
• Withdraw consent
• Data portability
• Lodge a complaint with the Finnish data protection authority, the Office of the Data Protection Ombudsman (tietosuoja.fi)

AI feedback, scores, and level estimates are learning aids only. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

To exercise your rights, contact us at: info@ulusoyapps.com

12) Children

The app is not intended for children under 13. If you believe a child under 13 has given us personal data, contact us and we will delete it.

13) Security

• TLS encryption in transit.
• Firebase App Check.
• Database security rules that limit each account to its own private data.
• Least-privilege access controls and periodic reviews.
• Crash logs limited to diagnostics.

14) How to Manage Your Choices

• Delete your account in the app: Settings > Delete account. This removes your sign-in account, profile, learning activity, Feature Board requests, comments, votes, and likes. Community library items stay, as described in sections 5 and 9. You can also email us to delete your account.
• Delete your own Feature Board comments at any time.
• Report content from within the app.
• Turn notifications off in your device’s settings.
• Change the iOS tracking permission in iOS Settings > Privacy & Security > Tracking.
• Deny microphone permission to disable speaking features.
• Object to analytics by emailing us; we will stop associating analytics with your user ID.
• Unsubscribe from marketing emails to withdraw consent.

15) What We Do Not Collect

• Payment card numbers
• Precise location, contacts, photos from your photo library, or health data
• Data for targeted advertising: we show no ads and do not sell personal data

16) Updates

We may update this policy. Updates will be posted in the app and on this website, with a new “Last Update” date.

Contact

Ulusoy Apps Oy

Email: info@ulusoyapps.com

Phone: +358 45 877 2230