Skip to Content
← gramba
Support Get the app
Privacy

Privacy Policy

Last updated: 1 August 2026

This Privacy Policy explains how Gramba processes personal data when you use the Gramba app or this website. It applies in addition to the Swiss Data Protection Act (DSG) and, for users in the EEA, the EU General Data Protection Regulation (GDPR).

In short: Gramba stores your account, your rooms and your exercise progress. We show no ads, use no third-party analytics or tracking, and never sell or share your data for advertising.

1. Controller

Gramba, a sole proprietorship owned by Michael Habegger, Rietstrasse 25, 8634 Hombrechtikon, Switzerland. Email: support@gramba.app.

2. Data we process

Account data: email address, display name, reminder preference and account settings. Passwords are stored only as salted hashes. If you use Sign in with Apple or Google Sign-In, we receive a verified identity token — we never see your password.

Learning data: the rooms you belong to, the practice topics created in those rooms (including topic briefs and any lesson photos attached by the room owner), and your exercise progress — which exercises you answered and whether you were correct.

Notification data: if you enable push notifications, a device push token and a log of when reminders were sent and opened — solely to make reminders work and improve their timing.

Subscription data: if you buy a paid plan, your current plan and subscription status. Payment itself is handled entirely by Apple (App Store) or Google (Google Play) — we never see your payment details.

Technical and support data: server logs kept briefly for security and troubleshooting, and the content of support requests you send us.

3. Purposes and legal bases

Providing the app (account, rooms, daily sessions, progress): performance of the contract, Art. 6(1)(b) GDPR.

Push reminders: your consent via the system notification permission, Art. 6(1)(a) GDPR — revocable at any time in your device settings.

Security, troubleshooting and abuse prevention: legitimate interest, Art. 6(1)(f) GDPR.

Communication and legal obligations: Art. 6(1)(b), (c) and (f) GDPR.

4. AI-generated exercises

When a practice week is generated, the topic brief and any attached lesson photo are transmitted — encrypted — to our AI provider Anthropic, PBC (USA), whose Claude models create the exercises. This content is used only for that generation. We never send your name, email address or learning progress to the AI provider, and Anthropic does not use content submitted via its API to train its models. Answering exercises involves no AI call at all: grading is a pure lookup against the stored solution.

5. Recipients and processors

We do not sell your data. We use a small number of carefully selected providers that process data on our behalf and on our instructions:

  • Hetzner Online GmbH (Germany): hosting and data storage; servers in the EU.
  • Anthropic, PBC (USA): AI exercise generation (see section 4).
  • Expo (650 Industries, Inc.) (USA): delivery of push notifications, together with Apple (APNs) and Google (FCM) notification services.
  • Apple Inc.: Sign in with Apple, push delivery and App Store purchases.
  • Google LLC: Google Sign-In (if you use it), push delivery on Android and Google Play purchases.

6. International transfers

Your data is primarily stored in the EU (Germany). Some providers (notably Anthropic, Expo, Apple, Google) process data in the USA. We base such transfers on appropriate safeguards, in particular the EU Commission Standard Contractual Clauses and, where applicable, the EU-US and Swiss-US Data Privacy Framework.

7. Retention and deletion

We retain your data for as long as your account exists. You can delete your account at any time in the app (Profile → Delete account); this permanently removes your account, your progress and the rooms you own. Technical logs are kept only briefly.

8. Security

Data is transmitted encrypted (TLS). Passwords are stored as salted hashes, and access to production systems is limited to the necessary minimum. As with any online service, absolute security cannot be guaranteed.

9. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You may withdraw any consent at any time with effect for the future. Contact us at support@gramba.app. You may also lodge a complaint with a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EEA your local data protection authority.

10. Students and minors

Gramba is designed to be used in language classes, including by learners under 18. We deliberately collect only the minimum needed for practice (email, display name, progress) and show no advertising of any kind. Learners under 16 should use Gramba only with the consent of a parent or guardian, or within a school context where the school has obtained the necessary consents.

11. Room owners see progress

If you join a room, the room owner (e.g. your teacher) can see your display name and your completion progress for that room’s practice weeks. They cannot see your email address or your activity in other rooms. You can leave a room at any time.

12. Cookies / website

This website uses only strictly necessary cookies. See our Cookie Policy.

13. Changes

We may update this Privacy Policy. The current version is always available here; we will notify you of material changes in an appropriate manner.