The data controller responsible for processing under the GDPR is:
Hicham El Malki
Joachim-Biermann-Str. 5
60486 Frankfurt am Main
Germany
Email: hi.elmalki@hotmail.com
AWS AI Coach does not require registration, a username, or an email address. Your study progress (quiz results, flashcards, streaks, settings, your own flashcard photos) is stored exclusively on your device (in the app's local storage/files) and is never transmitted anywhere. There is no server on which we maintain a user profile about you.
Answers, streak counters, flashcard decks, your own flashcard photos, and local usage statistics (e.g. "how many coach requests this month") are stored exclusively on your device. This data never leaves your device unless you manually export it yourself (e.g. the usage-statistics export in Settings) and actively share the resulting file. Legal basis: Art. 6(1)(b) GDPR (performance of the contract / providing the feature you requested).
When you use the AI Coach (chat questions, automatic flashcard generation), your typed text and relevant study context (e.g. the current quiz question) are relayed through a server we operate (Cloudflare Worker, see 3.3) to the language-model provider OpenAI (OpenAI Ireland Limited / OpenAI, L.L.C., USA) to generate a reply. Our server merely passes the request through (a technical "pass-through") and does not permanently store the content of your messages. OpenAI's own privacy policy applies in addition. Legal basis: Art. 6(1)(b) GDPR, since you actively invoke this feature.
So that our OpenAI API key does not need to be stored inside the app itself, every AI request is routed through a server we operate at Cloudflare, Inc. This server uses Apple's "App Attest" technology (see 3.4) to verify the request comes from a genuine, unmodified installation of the app, then forwards the request unchanged to OpenAI. The content of your messages is not logged or stored in the process.
To prevent abuse of our server (and the resulting unnecessary cost), the app uses Apple's "App Attest" feature. Your device generates a cryptographic key pair used to sign each request to our server. Our server stores only a randomly generated key identifier and a public key for this purpose — this data cannot be linked to you personally and serves solely as a technical anti-abuse measure. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security of our service).
If you use voice input for the coach, your device microphone is activated. In the free tier, your speech is processed exclusively on-device by Apple's speech recognition (depending on device/language, Apple may process some of this on its own servers — Apple's own privacy terms then apply). On the Pro tier, you can optionally enable OpenAI's cloud-based speech recognition (Whisper); in that case your voice recording is transmitted to OpenAI via our server as described in 3.2, and deleted locally on your device right after transcription.
Free-tier users see ads served through Google AdMob. On first launch, we ask for your consent to the advertising identifier (App Tracking Transparency, "ATT") and, if you are located in the EEA, present a GDPR consent form (Google User Messaging Platform, "UMP"). If you consent, your device's advertising identifier (IDFA) is shared with Google (Google Ireland Limited and its ad partners) to show you more relevant ads. If you decline, ads are still shown (less targeted), without sharing the advertising identifier. You can change your decision anytime under "Privacy Settings" in the app. Legal basis: Art. 6(1)(a) GDPR (consent).
The Pro subscription and token packs are handled entirely through Apple's in-app purchase system (StoreKit). Payment data and receipts are seen only by Apple and are not collected or stored by us — we only receive the technical confirmation that a purchase is valid. Apple's own privacy terms apply in addition.
Reminders (e.g. daily study goal, streak warnings) are scheduled and triggered exclusively on your device. No data is transmitted to a push server.
| Recipient | Purpose | Data involved |
|---|---|---|
| OpenAI (OpenAI Ireland Ltd. / OpenAI, L.L.C., USA) | AI Coach, voice transcription (Pro, optional) | Chat text, optionally voice recording — not stored permanently |
| Cloudflare, Inc. (US/EU infrastructure) | Technical intermediary server (proxy) | App Attest keys, relayed request content (not stored) |
| Google Ireland Limited (AdMob, UMP) | Ad serving, consent management | Advertising identifier (IDFA), if consented |
| Apple Inc. / Apple Distribution International | App distribution, in-app purchases, device attestation, speech recognition, notifications | Purchase data, attestation data — per Apple's own terms |
OpenAI and Google process data (in part) in the United States. This transfer is based on EU Standard Contractual Clauses or comparable safeguards provided by each vendor. See OpenAI's and Google's privacy policies for details.
Local data stays on your device until you reset it in Settings or delete the app. The content of your AI requests is not stored on our server. The technical App Attest key persists until you reinstall the app.
Under the GDPR, you have the right to:
Since we do not maintain a user account, we cannot identify you via any identifier — most of your data lives exclusively on your device and can be viewed, exported, or deleted there directly (Settings → "Reset Progress", or by deleting the app).
Communication between the app and our server is encrypted (HTTPS/TLS). Access to our server is protected against abuse via Apple's App Attest mechanism.
AWS AI Coach is aimed at people preparing for a professional AWS certification and is not directed at children under 16.
We update this policy whenever the app or applicable law changes. The current version is always available at this address.
For privacy questions, reach us at hi.elmalki@hotmail.com.