Doe Normaal: Privacy Policy

Who is responsible

Codeswept LLC is responsible for your data (the "controller" under the GDPR). For any question or request about your data, email contact@codeswept.com.

What we collect

Your login:

• When you first open the app, an anonymous account is created automatically. This is a random ID, without a name or email address.
• If you sign in with email, we store your email address. Your password is handled by our login provider (Firebase); we never see or store it.

Your progress in the app:

• the Dutch level you chose;
• which profiles, polls and chat episodes you have finished;
• your choices in the app, such as poll votes, swiping left or right on the (fictional) dating profiles, and which chats you have read;
• how many exercises you answered and how many were correct;
• the words you looked up or learned;
• when each of these actions happened.

Technical data: when the app connects to our server or to the login service, your IP address and basic device information are used to make the connection, keep it secure and prevent abuse (for example, limiting how many requests one address can send). Our hosting providers may keep this in short-lived server logs.

Why we use it

• To provide the app: saving your progress and word list, syncing them between your devices and keeping you signed in. The legal basis is performing our agreement with you (GDPR article 6(1)(b)).
• To keep the app secure and prevent abuse. The legal basis is our legitimate interest in a safe, working service (article 6(1)(f)).

Where your data is stored

We use a small number of service providers that store or process data on our behalf:

• Render: runs our server, in Frankfurt, Germany.
• DigitalOcean: hosts our database, in Amsterdam, the Netherlands.
• Google Firebase Authentication: handles login (your account ID, email address and sign-in details).

Your progress and login session are also stored on your device, so the app works offline. This copy is removed when you delete the app.

Render, DigitalOcean and Google are US companies, and Firebase may process login data outside the European Economic Area, including in the United States. Where personal data is transferred outside the EEA, it is protected by the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

How long we keep it

• We keep your data for as long as you have an account.
• When you delete your account in the app, your progress is removed from our database and your login is deleted straight away. Copies in our backups are removed within 30 days.
• When you sign in after using the app anonymously, your anonymous progress moves into your account and the anonymous login is deleted.

Your rights

Under the GDPR you have the right to access your data, have it corrected, have it deleted, take it with you (data portability), restrict how we use it and object to how we use it. You can do most of this directly in the app, in the Ik tab, under Account settings:

• "Delete account" deletes all your data and your login.
• "Clear progress" resets your progress.

For anything else, email contact@codeswept.com.

You also have the right to complain to a data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl); elsewhere in the EU, the authority in your country.

Security

We take reasonable technical and organisational measures to protect your data. No system is perfectly secure.

Children

Doe Normaal is not meant for children under 16; some content is about dating. We do not knowingly collect data from children under 16.

Changes to this policy

If we change how we handle your data, we will update this policy and the date at the top.

Contact

Questions, requests or concerns about your privacy: contact@codeswept.com.