Legal
Privacy Policy
This policy explains what Tokay collects, why, and what you can do about it. It covers the Tokay mobile app and the Tokay website. We have tried to write it in plain language rather than legal boilerplate.
The short version: we collect the minimum needed to run an account and a learning history. We do not use advertising, we do not track you across other apps or websites, and we do not sell your data to anyone.
1. What we collect
| Data | When | Why |
|---|---|---|
| Email address | You register | Identifies your account and is how we would contact you about it |
| Username and display name | You register | Shown on your profile and on the leaderboard |
| Password | You register | Stored only as an Argon2 hash. We never store or can read your actual password |
| Account identifier | Automatically | A random internal ID that links your data together |
| Learning data | As you use the app | Saved words, saved articles, reading progress, quiz attempts, bookmarks, XP and your language and difficulty settings |
| Usage records | As you use AI features | Which AI operation ran and when, so we can apply daily limits fairly and control cost |
| Subscription status | If you subscribe | Whether your subscription is active and when it renews, so paid features work |
What we do not collect
- No advertising or cross-app tracking identifiers.
- No location data.
- No contacts, photos, microphone or camera access.
- No payment card details — see section 4.
2. Why we use it, and our legal basis
Under the GDPR we rely on the following bases:
- Performance of a contract. Running your account, saving your learning progress, and delivering the features you subscribed to.
- Legitimate interests. Keeping the service secure, preventing abuse, and applying usage limits so that one account cannot exhaust a shared resource.
- Legal obligation. Keeping records we are required to keep, such as those relating to a purchase.
We do not use your data for automated decision-making that produces legal effects.
3. AI processing of text
Tokay uses Google's Gemini models to simplify articles, translate text and define words. When you use one of these features, the relevant text — the article passage, or the word you tapped along with its sentence — is sent to Google for processing and the result is returned to you.
Do not paste sensitive personal information into features that send text for processing. We keep a record that the operation happened, for the usage limits described above.
4. Who we share data with
We share data only with the service providers needed to operate Tokay, and only what each one needs. We do not sell personal data, and we have never done so.
| Provider | What they receive | Purpose |
|---|---|---|
| Fly.io | All application data | Hosting and database. Our primary region is Frankfurt, Germany |
| Google (Gemini API) | Text you submit for simplification, translation or lookup | AI processing |
| RevenueCat | Your account identifier and purchase events | Subscription management |
| Apple | Payment details, which they process directly | In-app purchases. We never see or store your card details |
Some of these providers may process data outside the European Economic Area. Where that happens, transfers are covered by the European Commission's Standard Contractual Clauses or an equivalent safeguard.
5. How long we keep it
- Account and learning data — for as long as your account exists.
- Usage records — retained to operate daily limits and understand cost.
- Purchase records — retained as long as required for tax and accounting.
When you delete your account, the data described in section 6 is removed.
6. Deleting your account
You can delete your account at any time from inside the app: Settings → Delete account. You will be asked for your password to confirm.
Deletion is immediate and permanent. It removes your account record, your saved words and articles, your reading and quiz history, your bookmarks and your usage records. It cannot be undone and we cannot restore a deleted account.
Deleting your account does not cancel a subscription. Apple does not allow an app to cancel a subscription on your behalf. If you subscribed, cancel it separately in the App Store under your Apple Account subscriptions, or you will continue to be billed.
You can also request deletion by emailing flegmate00@gmail.com from your registered address.
7. Your rights
If you are in the EEA or the UK, you have the right to:
- access the personal data we hold about you;
- correct data that is inaccurate;
- delete your data (see section 6);
- restrict or object to certain processing;
- receive your data in a portable format;
- lodge a complaint with your national data protection authority.
If you are a California resident, you have comparable rights under the CCPA/CPRA, including the right to know, delete and correct, and the right to opt out of sale or sharing. As stated above, we do not sell or share personal information for cross-context behavioural advertising, so there is nothing to opt out of.
To exercise any of these, email flegmate00@gmail.com. We will respond within 30 days.
8. Security
Passwords are hashed with Argon2 and are never stored in a readable form. All traffic between the app and our servers is encrypted with HTTPS. Sign-in tokens are held in the iOS Keychain. Access to the production database is restricted to the operator.
No service can promise perfect security. If a breach affects your personal data and is likely to present a risk to you, we will notify you and the relevant supervisory authority as required by law.
9. Children
Tokay is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has created an account, contact us and we will delete it.
10. Contact and changes
Questions, requests or complaints: flegmate00@gmail.com.
Data controller: Máté Horváth, Tihanyi Árpád út 65, 9023 Győr, Hungary.
If we change this policy in a way that materially affects you, we will update the date at the top of this page and notify you in the app before the change takes effect. Continuing to use Tokay after that means you accept the updated policy.