Privacy Policy

Who controls your data

Kakapo is operated by Basecube s.r.o., Company ID 24475211, registered office at Příčná 1892/4, Nové Město, 110 00 Prague 1, Czech Republic. Basecube s.r.o. is the data controller for the Kakapo app and website.

Privacy questions and data requests can be sent to developer@kakapo.study.

Data we process

• Account data: Firebase user ID, email address and, when provided by a sign-in service, name and profile image.
• Learning content: decks, vocabulary cards, translations, examples, notes, imported text, optional images, language preferences and learning progress.
• Learning activity: reviews, study sessions, spaced repetition state, streaks, XP and feature usage.
• AI inputs and outputs: words, text, images or audio you submit to request card suggestions, transcription, pronunciation or other AI-assisted features, together with the generated result and usage records.
• Subscription data: product, entitlement, purchase status and transaction identifiers. Kakapo does not receive your full payment-card number.
• Device and diagnostics: device and app version, installation or push token, IP address, request and security logs, crash reports and performance information.
• Website and waitlist data: email address, launch notification consent, language and level selections, optional questionnaire answers, campaign parameters, referral information and advertising click identifiers.
• Communications: support messages, privacy requests and information you include in them.

Why we use data and our legal bases

Website storage, analytics and advertising

Analytics and advertising measurement are separate optional choices. Kakapo does not load the related measurement SDKs until you allow the relevant category. Refusing either category does not prevent you from using the website, joining the waitlist or using Kakapo.

If you allow analytics, Google Analytics may receive the page and referrer, browser and device information, approximate location derived from IP address, campaign parameters and Kakapo events such as starting or completing onboarding. Funnel events may include the selected language, level or goal, but browser events do not contain the plain-text waitlist email.

If you allow advertising measurement, Google advertising signals, Meta Pixel and TikTok Pixel may be used for campaign attribution and conversion measurement. Advertising consent is not required for analytics and can be changed independently.

If you submit the waitlist after allowing advertising measurement, Kakapo may send Meta and TikTok a matching server-side conversion containing a hashed email, IP address, user agent, page URL, click identifiers and measurement-cookie identifiers. This is used only for attribution and campaign measurement.

Open Privacy on the website to change either choice. On withdrawal, Kakapo updates the relevant consent signals, removes the related first-party measurement cookies it can access and reloads without SDKs that are no longer permitted. Your browser or the provider may control additional third-party storage, which you can also remove through browser settings.

AI-assisted features

When you request an AI feature, the submitted content is sent to the configured AI provider only to produce the requested result. Depending on the feature and current configuration, providers can include OpenAI, OpenRouter or Microsoft Azure. Do not submit sensitive personal information in prompts, cards, images or audio.

AI suggestions can be inaccurate and should be reviewed. Kakapo does not use AI features to make decisions that produce legal or similarly significant effects about you.

Service providers and recipients

• Google Firebase and Google Cloud for authentication, hosting, databases, storage, messaging, analytics and infrastructure.
• Apple and Google for sign-in, app distribution and store purchases.
• RevenueCat for subscription entitlement infrastructure.
• Stripe for website checkout where offered.
• Sentry for application error and performance monitoring.
• Resend for requested launch, support and privacy-related email delivery.
• OpenAI, OpenRouter and Microsoft Azure for configured AI-assisted features.
• Google Analytics, Meta and TikTok for optional website measurement after consent.

We may also disclose limited information to professional advisers, authorities or other parties where required by law, needed to protect users and the service, or connected with a business reorganisation. We do not sell personal information.

International transfers

Some providers operate outside the European Economic Area, including in the United States. Where required, transfers rely on an applicable adequacy decision, the European Commission's Standard Contractual Clauses or another lawful transfer safeguard. You can contact us for information about the safeguard applicable to a particular provider.

How long we keep data

• Account content and learning progress are kept while the account is active and removed when the account is deleted, subject to limited backups and legal exceptions.
• Waitlist records are kept to deliver the requested launch notification and for a limited period afterward to administer the offer, then deleted or anonymised when no longer needed.
• Optional analytics and advertising identifiers follow the durations listed above and provider-side retention settings.
• Security rate-limit records are short-lived; application and security logs are retained only as long as needed to investigate reliability, fraud or security events.
• Payment and transaction records may be retained for the period required by tax, accounting, fraud-prevention and consumer-protection laws.
• Support and privacy-request records are kept as needed to answer the request and demonstrate that it was handled.

Your rights

Depending on applicable law, you can request access, correction, deletion, restriction or portability of your personal data, object to processing based on legitimate interests and withdraw consent at any time. Withdrawing consent does not affect processing that was lawful before withdrawal.

Account export and deletion are available in the Kakapo profile. For website waitlist data or if you cannot access the app, email developer@kakapo.study from the relevant address. We may request reasonable information to verify identity and normally respond within one month.

You also have the right to lodge a complaint with the Czech Office for Personal Data Protection, Úřad pro ochranu osobních údajů, or another competent supervisory authority. See uoou.gov.cz.

Security

We use managed authentication and infrastructure, encryption in transit, access controls, App Check and abuse-prevention measures. No system is completely secure, but we limit access and review the safeguards appropriate to the service and the data involved.

Changes and contact

We may update this policy as Kakapo and its providers change. The date at the top identifies the current version. Material changes will be communicated through an appropriate website, app or email notice.

Contact: developer@kakapo.study.