Zimo – Privacy Policy
Last updated: 7 September 2026
1. Who is responsible
The controller for the processing of your personal data within the meaning of the General Data Protection Regulation (GDPR) is:
Lumen Haendler, trading as Lumen Haendler Software Engineering
Kirchstraße 20, 88699 Frickingen, Germany
Email: contact@zimo-characters.com
Phone: +49 176 87800025
We have not appointed a data protection officer; we are not required to.
This policy covers the Zimo mobile application and the website at zimo-characters.com.
2. What we collect, why, and on what legal basis
2.1 Account data
When you create an account we store your email address and an internal user identifier. If you sign in with Apple or Google, we additionally receive the name and profile picture that the respective provider passes to us; you can see and control what is shared in your Apple or Google account settings.
Purpose: to create and operate your account and to make your learning progress available across devices.
Legal basis: Art. 6(1)(b) GDPR — performance of the contract you enter into by registering.
Passwords are never stored in readable form. Authentication is handled by Supabase (see Section 4); we never see your password.
2.2 Learning data
Every time you add a character or answer a review, we store which character it was, which learning stage you reached, and when. This history is what the spaced-repetition schedule is built from — it decides which character is shown to you next and when.
We also store your current level and, if you write them, your personal notes on individual characters.
Purpose: to provide the learning function, which cannot work without a record of what you have already learned.
Legal basis: Art. 6(1)(b) GDPR.
The learning schedule adapts to your answers. This is automated processing, but it is not automated decision-making within the meaning of Art. 22 GDPR: it decides when a flashcard reappears, and has no legal or similarly significant effect on you.
2.3 Subscription data
If you purchase Premium, we store whether and until when your access is active. The purchase itself is processed by Apple or Google; we never receive your payment details. RevenueCat manages the subscription state on our behalf and receives your internal user identifier for that purpose (see Section 4).
Purpose: to unlock the paid content for you and to keep that access correct when a subscription renews, lapses, or is refunded.
Legal basis: Art. 6(1)(b) GDPR.
2.4 Push notifications
If you allow notifications, your device generates a push token that we store. We use it to remind you when characters are due for review.
Purpose: to send the reminders you asked for.
Legal basis: Art. 6(1)(a) GDPR — your consent, given through your device's notification permission. You can withdraw it at any time in your device settings, with effect for the future; we then stop sending and remove the token.
2.5 Onboarding questionnaire
When you first sign in, we ask a few questions about your level of Chinese, why you are learning, how much time you want to spend, and whether you already know Pinyin. Your answers are stored with your account.
Purpose: to understand where learners get stuck. Only a small fraction of our users get past the first level, and these answers are the clearest indication we have of who stops and why. We use them to decide what to build next.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in developing the App. You can object to this processing at any time (Art. 21 GDPR, see Section 8); we will then delete your answers.
The stored answers do not influence how the App behaves. The one answer that does — whether you already know Pinyin, which decides if we show you a short tutorial — is evaluated on your device before your answers are sent to us.
2.6 Technical data when using the API
Every request the App makes to our own interface at zimo-characters.com is recorded by our hosting provider: time, method, path, response status, and the IP address of your device. If a request fails, our own error log may additionally contain your internal user identifier, and — in the case of a failed profile update — the display name or questionnaire answers that were being written.
Purpose: to operate the service, to detect faults, and to defend against misuse.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in a functioning and secure service.
2.7 Website
The website at zimo-characters.com is a set of static pages. It sets no cookies, uses no analytics, and embeds no third-party content that would load from another server. Our hosting provider records the same technical data as described in 2.6.
3. What we do not do
We do not use analytics or tracking services. We do not use advertising identifiers. We do not create profiles for marketing purposes, and we do not sell or rent personal data. The App requests no access to your microphone, camera, contacts, or location.
4. Who receives your data
We use the following processors. Each acts on our instructions under a data processing agreement pursuant to Art. 28 GDPR.
Supabase (Supabase, Inc., United States) — authentication, database, and file storage. Receives all of the data described in Section 2. Processed in the AWS region eu-central-1 in Frankfurt, Germany.
Vercel (Vercel, Inc., United States) — operates our interface. Receives the technical data described in Section 2.6, and whatever data a given request processes. Processed in the region fra1 in Frankfurt, Germany.
RevenueCat (RevenueCat, Inc., United States) — manages subscriptions. Receives your internal user identifier and the state of your purchases and entitlements. Processed in the United States.
Expo (650 Industries, Inc., United States) — dispatches push notifications. Receives your push token and the text of the notification. Processed in the United States.
Push notifications are delivered to your device by Apple (APNs) on iOS and Google (Firebase Cloud Messaging) on Android. These services necessarily receive the push token and the notification.
Apple and Google are not our processors where they sell you a subscription through the App Store or Google Play, and where you sign in with your Apple or Google account. In those cases they act as controllers in their own right and their own privacy policies apply.
5. Transfers outside the EU
Supabase and Vercel process your data in Frankfurt, Germany. Their parent companies are established in the United States, which means access from outside the EU cannot be ruled out — for example by support staff. RevenueCat and Expo process data in the United States.
For these transfers we rely on the standard contractual clauses adopted by the European Commission, which form part of the data processing agreements referred to in Section 4. You can request a copy from us at the address in Section 1.
We deliberately do not rely on a provider's certification under the EU-US Data Privacy Framework alone: such certifications must be renewed annually and can lapse without notice.
6. How long we keep your data
Your account data, learning history, subscription state, and notes are stored for as long as your account exists. When you delete your account, they are deleted with it — see Section 7.
The technical data described in Section 2.6 is kept for one day: both our hosting provider and our database provider delete their logs after 24 hours.
7. Deleting your account
You can delete your account at any time in the App: starting from your profile, choose Delete account. Deletion is immediate and cannot be undone: your learning history, your notes, your profile, and your sign-in are removed.
Deleting your account does not cancel an active subscription. Billing is handled by Apple or Google, not by us — cancel it separately in your App Store or Google Play account settings.
Your record with our subscription provider RevenueCat is deleted together with your account. This does not affect the purchase itself, which is held by Apple or Google — if you subscribe again later, you can still restore it.
Deletion happens in steps: first your data, then your sign-in, then your subscription record. If a step fails, the App tells you where it stopped — your data is already gone at that point, and tapping delete again completes the removal. We consider it more important that you know the true state than that the message sounds tidy.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased (Art. 17) — the fastest route is the delete function described in Section 7;
- restrict processing (Art. 18);
- receive your data in a portable format (Art. 20);
- object to processing based on our legitimate interest (Art. 21);
- withdraw consent you have given, with effect for the future (Art. 7(3)) — for notifications, by turning them off in your device settings.
To exercise any of these, write to contact@zimo-characters.com. We will respond within one month.
You also have the right to lodge a complaint with a supervisory authority (Art. 77). The authority responsible for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart, Germany
You may also complain to the authority where you live or work.
9. Children
Zimo is not intended for children under 16. You must be at least 16 years old to create an account; see Section 2 of our Terms of Service. If you believe a child under 16 has created an account, please contact us and we will delete it.
10. Security
Data is transmitted over encrypted connections and stored on servers operated by our processors in Frankfurt, Germany. Access to the production database is limited to what the application needs to function.
No system is perfectly secure. We recommend you do not rely on the App as the only record of anything important to you.
11. Changes to this policy
We will update this policy when the way we process data changes — for example when we add a service provider. The date at the top shows the current version. If a change materially affects you, we will inform you in the App or by email.
12. Contact
Lumen Haendler, trading as Lumen Haendler Software Engineering
Kirchstraße 20, 88699 Frickingen, Germany
Email: contact@zimo-characters.com
