Privacy policy

Dhana — version of 11 October 2026

Dhana is a language-learning app. It is designed to know as little as possible about you: what you learn stays on your phone, and the server keeps only what it needs to recognise your account, know what you have paid for, and limit what it produces.

Who is responsible for your data

René Obe, publisher of Dhana.
Postal address: Schloßstraße 2, 53115 Bonn, Germany
Email: rene@perihelie-labs.net

Dhana has no data protection officer: its size does not require one. Requests are handled by the person above.

What Dhana does not do

It is shorter to start there, and it can be checked in the code, which is written without any of these components:

• no advertising, no advertising trackers;
• no audience measurement — no Google Analytics, no Firebase Analytics, nothing equivalent;
• no profiling, no automated decision about you;
• no selling or sharing of data for commercial purposes;
• no access to your contacts, your location, your photos or your microphone;
• no notifications.

What stays on your device, and never leaves it

Most of what you produce while using Dhana is stored in a local database on your phone. The server does not receive it, does not see it, and does not back it up:

• the cards you have opened, and your shelf;
• the words you review, the ones you set aside, the ones you mark as known;
• your whole review history and the schedule that follows from it;
• your collections, and your personal cards — their name, and what you say about them;
• the cards made from the texts you paste — the text, its translation, its words — and what you correct in them;
• the sentences you add to a card yourself, and the notes you write on it.

None of this leaves on its own. If you uninstall the app or lose your phone, this data is lost, because we have no copy of it — unless you have asked for a backup, which the next section describes. The app also lets you export it to a file that you keep wherever you like.

What the server keeps

Seven things, and nothing else. The first is there only if you asked for it, the third only if you bought something. Your messages and the texts you paste only pass through it.

Your backup, if you make one. Settings contains a button “Back up to the server”. As long as you have not touched it, the server has nothing of what you learn. When you touch it, the server receives a copy of what the previous section lists — your shelf, your flashcards and their schedule, your collections, your personal cards with their name and description, the cards made from your texts, your sentences and your notes — attached to your account, and replaced with each new backup. We do not read it and do not use it: it is a file we keep for you, and only you can take it back. It is erased with your account, immediately and with no backup copy.

Your account. At your first sign-in, Google sends us a stable identifier specific to Dhana, and your email address. We add the date the account was created; usage counters — the cards produced, the questions asked, the translations requested and the suggestions examined, to limit the cost of the service; numbers, never the text —; the list of cards you have taken, with their dates — this is the counter the app shows you: a card taken once does not count a second time, and to know that, the server has to remember which one it was —; your plan and its dates; what remains of your top-ups; and a single fact about your phone: whether it is one of Google's automated test devices (Firebase Test Lab), so that people can be counted apart from these robots. This list says which places, activities and works you have opened, and in which language; it says nothing about what you did with them. For a text you pasted, it holds a fingerprint of the text — computed from it, it cannot be turned back into it —, which is enough to keep the same text from counting twice. We receive neither your Google password, nor your contacts, nor the content of your Google account.

Your purchases, if you make any. When you buy a subscription or a top-up, Google Play gives the app a purchase token — a string of characters that identifies that purchase at Google, and nothing else. The app passes it to the server, which checks it with Google: which product, whether it has been paid, and until when a subscription runs. Only a purchase Google says is paid unlocks anything. The server keeps the token with your account, along with the product and the date: it is with this token that it asks Google, at the end of each period, whether the subscription has renewed. So that a purchase cannot be credited to another account, the app attaches to it a fingerprint of your account — computed from it, it tells Google nothing about you —, which Google returns to us with its answer. We receive neither your name, nor your card number, nor your bank details.

What remains of a deleted account, for twelve months at most. A fingerprint of the identifier Google had sent us — computed from it, it cannot be turned back into it —, your usage counters reduced to dates, without the name of any card, the status of your access with what remains of your top-ups, and your purchases — their token, the product, the date. No address, no backup, no list of cards. This is what keeps a deletion followed by a new sign-in from resetting the counters; if you come back, you find them again with your access and your purchases, and the trace is erased. Deleting the account does not cancel a subscription: cancel it first in Google Play.

Technical logs. The server keeps a log of what it does and what it refuses — a card written, a sign-in refused, a failure —, dated, with no IP address and without the text of your requests — for a pasted text, it may quote a word or a phrase from its card, never the text. It is used to diagnose failures and to spot abuse.

Searches that found nothing. When a search finds nothing, the word searched for is kept so that the catalogue can be completed. This record holds the word and the date, with no link to any account: we know that someone searched for “butcher's shop”, never who.

Reports. At the bottom of each card, a link lets you say that something is wrong with it, with a sentence if you want to explain; it can also start from a question, already filled in. The report records the card concerned, the date and your sentence — or, if it starts from a question, the item, your question and the model's explanation —, never your identifier. We will know that a card is wrong, never who said so. This is also why we cannot reply to you: so do not write a question in this field, write what is wrong.

Your messages. In the settings, “Contact us” lets you send us a message — a suggestion, a comment, a question. It goes with your account's email address, so that we can reply, the app version and the language pair you use. The server does not keep it: it forwards it to us by email, and the exchange then continues by email, as if you had written to us yourself.

The texts you paste. The server holds a text in memory until its card is written, and the card until the app comes to collect it — a quarter of an hour at most —, then forgets them. It never writes them to its disk. A question about that card sends the text again along with it; it too is forgotten once the answer is given.

What is passed on to third parties

A language model, at DeepSeek (People's Republic of China). This is the point that deserves your attention, and we would rather say it plainly. Four actions in the app send text to this provider:

• when you ask for a place or an activity the app does not know yet to be added, the word you typed is sent to it;
• when you ask for the translation of a sentence you want to add to a card, that sentence is sent to it;
• when you ask a question about a sentence or a word on a card, your question is sent to it, along with the card and the item concerned — and, if it is a sentence you wrote yourself, that sentence;
• when you paste a text to make a card of it, that text is sent to it — and again, with your question, each time you ask one about that card.

These requests carry no account identifier: the provider receives a text, not a person. They are nevertheless a transfer outside the European Union, to a country that is not covered by an adequacy decision of the European Commission. This transfer is necessary to provide the service you ask for: without it, the feature cannot exist. So do not write or paste anything confidential in these fields.

A second language model, at Zhipu AI — Z.ai (People's Republic of China). Every card produced is checked by two models that make different mistakes — in every language except Egyptian Arabic —, and this is the second one. It receives the card — sentences in the language being learned, and their glosses; for a text you pasted, the sentences of the text that the card quotes —, never anything that identifies you. It is the same transfer outside the European Union as above, for the same reason.

Wikidata, from the Wikimedia Foundation (United States). When you search for a film, a series or a book, the title you typed is sent to Wikidata to identify the work. Here again, a text with no account identifier.

Google Ireland Limited. Signing in to the app goes through your Google account. Google therefore knows that you sign in to Dhana, under its own privacy policy. We pass on to Google nothing of what you do in the app, apart from the fingerprint attached to a purchase (see above).

netcup GmbH (Germany). The server is hosted by this provider, which acts as a processor within the meaning of Article 28 of the GDPR, under contract. The data stays in Germany.

Zoho Corporation GmbH (Germany). Our email is hosted by this provider, which acts as a processor within the meaning of Article 28 of the GDPR, in the European data centres of its sister company Zoho Corporation B.V. (Netherlands). It receives the messages sent from “Contact us”, like any email addressed to us.

Google Play. If you buy a subscription or a top-up, payment is handled by Google Play, under its own privacy policy. We receive neither your name, nor your card number, nor your bank details: only what the paragraph on your purchases describes above.

The closed beta

To try Dhana before its release, you can join the Google group beta_test_dhana from the dhana.eu home page. This group is hosted by Google, and you join it with your Google account, under Google's privacy policy. We see the email address of that account there, and only that; the other members do not see it.

It is used for two things: writing to you with the link to install the test version, and opening that test to you on Google Play, which accepts the group's members as testers. It is used for nothing else. You can leave the group at any time from its page, and your address leaves it at once; we will remove the remaining members at the end of the closed beta.

Cards do not belong to you, and do not speak about you

A card produced at your request joins a shared catalogue and serves every user after you. It carries no trace of who asked for it, so deleting it would have no effect on your privacy. This is why cards are not erased when an account is: what you brought into being does not follow you, and does not point to you.

A card made from a text you paste is an exception: it is written for you alone, does not join the catalogue, and the server forgets it as soon as your phone has received it. It lives on your phone, and in your backup or your export if you make them.

On what legal basis

• Performance of the contract (Art. 6(1)(b) GDPR) for the account, sign-in, producing cards, translating your sentences, answering your questions, verifying your purchases and replying to your messages: without this processing, the service you ask for does not exist. The same goes for the closed-beta address, which you give us by joining the group to receive the invitation to the test.
• Legitimate interest (Art. 6(1)(f)) for the technical logs, the usage counters, the list of cards taken, what remains of a deleted account, the searches that found nothing and the reports: keeping the service available, preventing abuse, and correcting the catalogue where it is wrong or incomplete.
• A legal obligation (Art. 6(1)(c)) for what accounting rules require us to keep in the case of a subscription.

How long

• Account: until you delete it, or after twenty-four months without any sign-in — never while a subscription is running.
• Purchases: as long as your account exists; after it is deleted, twelve months, with what remains of it.
• What remains of a deleted account: twelve months, or until you come back.
• Backup: as long as your account exists, replaced with each new backup. It disappears with the account, at the same moment.
• Technical logs: thirty days.
• Pasted text, and its card: until the card is written and the app comes to collect it, a quarter of an hour at most; never on disk.
• Searches that found nothing: until they are reviewed, and at most twelve months.
• Reports: until the card is corrected, and at most twelve months.
• Messages: in our mailbox, for the duration of the exchange, and at most twelve months after the last email; the server does not keep them.
• Closed-beta address: as long as you are a member of the group, and at most until the end of the closed beta.
• Accounting records for a subscription: the period required by tax law.

Your rights

You have the right of access, rectification, erasure, restriction, objection and portability regarding the data that concerns you. To exercise them, write to the address given at the top of this page; you will receive a reply within one month.

Deleting your account is done directly, without writing to us: see the page for this purpose.

You may also lodge a complaint with a data protection authority — the one in your country of residence, or the one responsible for the controller.

Minors

Dhana is intended for people aged thirteen and over; under eighteen, with the agreement of a parent or guardian. We do not knowingly collect data about a child under thirteen.

Changes

This policy may change along with the app. Every version carries its date at the top.