Nito Privacy Policy

Last updated: 4 November 2026

Nito is an app for learning Spanish from short video clips. This policy covers the Nito app for iPhone and Android and this website. We collect as little as we can, we do not sell data, and there are no ads inside the app.

Who is responsible

Luca Straßburger, Gropperstr. 62, 47807 Krefeld, Germany. Email: contact@learnnito.com.

What stays on your device

Your saved words and review progress, your level, goals and interests, liked and saved clips, watch history, activity and reading settings are stored on your phone.

What we process, and why

• Clip feed (Supabase, EU): a random ID generated by the app and the IDs of the clips you watched, so you are not shown the same clip twice and the feed can adapt to your level. Legal basis: providing the service (Art. 6(1)(b) GDPR).
• Optional account (Supabase Auth, EU): if you sign in with Apple, Google or an email code, we store your email address (or Apple's private relay address) and a backup of your words, level and interests so you can restore them on a new phone. Sign-in codes are emailed via Resend. You can delete the account at any time in the app (Profile → Settings → Account → Delete account); this deletes the account, its backup, RevenueCat's record for the account and the analytics events linked to it. Your subscription itself is managed by Apple or Google Play and is not affected; you can also ask for deletion on the web at learnnito.com/delete-account. Legal basis: Art. 6(1)(b) GDPR.
• Subscription (Apple, Google, RevenueCat): payments are handled by Apple (iPhone) or Google Play (Android). RevenueCat receives an anonymous app user ID and your purchase status so the app knows whether Super Nito is active. We never see your payment details. Legal basis: Art. 6(1)(b) GDPR.
• AI explanations (Google Gemini): when you ask for the AI explanation of a word or a clip, the word, its sentence or the clip text and title go through our server (a Supabase Edge Function) to Google's Gemini API, which writes the explanation. No account or device ID is sent with it. AI explanations can be wrong. Legal basis: Art. 6(1)(b) GDPR.
• Clip reports: if you report a clip (or it cannot be played), we store the clip, the reason and the random app ID, to fix or remove the clip. Legal basis: Art. 6(1)(f) GDPR.
• Feedback and clip requests: if you send feedback in the app or ask for more clips with a word, we store your message or the word, the app version and the random app ID, to read and act on it. You decide what you write; please do not include personal data. Legal basis: Art. 6(1)(f) GDPR. Stored until handled, at most 24 months.
• Notifications: the daily reminder, the reminder before a free trial ends and the note that new clips for a word you asked for are in are scheduled on your phone itself (local notifications). No push service and no data on our side. You can turn them off in your phone's settings.
• Release waitlist (learnnito.com/get, Supabase, EU): if you join the list on this website, we store your email address, the time of signing up, the consent text you agreed to, whether you came from an iPhone, Android or another device, your browser's time zone and language (to know which store to tell you about and whether we ask you to confirm your address first) and, if present, where the link came from (for example Instagram). We use it only to email you when Nito is out on your store, plus a few launch updates. In the EU, the EEA, the UK and Switzerland we first send you one email to confirm your address (double opt-in). Emails are sent via Resend. Every email has an unsubscribe link, or write to contact@learnnito.com. Legal basis: your consent (Art. 6(1)(a) GDPR). Against abuse (someone entering many addresses), we keep a salted hash of your IP address for one day; it cannot be turned back into the address. We delete your address when you unsubscribe, after 30 days if a confirmation was needed and you did not confirm, and at the latest 6 months after the app is out on your store.
• Server logs: when the app or this website talks to a server (Supabase; Vercel hosts this website), the server briefly processes your IP address and technical request data to deliver the response and keep the service secure. Legal basis: Art. 6(1)(f) GDPR.
• Product analytics (PostHog, EU servers in Frankfurt): we record how the app is used (for example: onboarding finished, clip watched, word looked up, review done, subscription started, and error reports when something breaks) together with a random ID, device type and app version, to find out what helps people learn and where the app gets in the way. If you are signed in, these events are linked to your account ID. There is no tracking across other apps or websites and no advertising ID. You can turn analytics off (and on again) at any time in the app (Profile → Settings → Help → Usage analytics); from then on nothing is sent. Legal basis: our legitimate interest in improving the app (Art. 6(1)(f) GDPR); you can object at any time in the app or by emailing us.
• Advertising measurement (Meta, Apple): we advertise Nito on Facebook and Instagram and in the App Store. To learn which ads lead to installs and subscriptions, the app can use the Meta SDK (it logs that the onboarding and the tour were finished), hand an anonymous Meta ID and device identifiers (on iPhone the IDFV, on Android the Android ID and, if your phone allows it, the advertising ID; your IP address) to RevenueCat, which then reports trial starts and purchases to Meta, and, on iPhone, let Apple tell RevenueCat which App Store ad led to the install (Apple Ads attribution).
  • In the EU, the EEA and the UK, none of this starts until you say yes: after the onboarding the app explains what is measured, then your iPhone asks "Allow tracking?". Only if you choose "Allow" does it start, including the advertising ID (IDFA). If you choose "Ask App not to Track", the Meta SDK is not started and no identifiers are handed over. On Android the app asks you itself ("Allow" or "No thanks"); only "Allow" starts it.
  • Outside these regions, your iPhone asks "Allow tracking?" after the onboarding. Only if you allow it is your advertising ID (IDFA) shared with Meta; otherwise Meta gets the measurements above without it. On Android it starts without a question; whether your advertising ID is shared is up to your phone's ad settings.
  • You can turn this on or off at any time in the app (Profile → Settings → Help → Ad measurement) and the advertising ID in iOS Settings → Privacy & Security → Tracking, or on Android in Settings → Privacy → Ads. Turning it off stops it from that moment on.
  Legal basis: your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG); outside the EU, our legitimate interest in measuring our advertising (Art. 6(1)(f) GDPR).

What we do not do

We do not collect your contacts, photos or location, we do not show ads inside the app, and we do not sell or rent data. Your advertising ID is only used if you allow tracking, and in the EU advertising measurement only runs with your consent (see above).

YouTube

Clips are played with YouTube's embedded player. When a video plays, YouTube/Google may collect data under the Google Privacy Policy (https://policies.google.com/privacy). By using Nito you also agree to the YouTube Terms of Service (https://www.youtube.com/t/terms). Videos belong to their creators; Nito links back to each video and channel.

Speech

The "listen" buttons use your device's built-in text-to-speech. Nothing is sent to us.

Service providers

Supabase (database, sign-in and server functions, EU region), RevenueCat (subscription status), Apple (payments on iPhone, Sign in with Apple, Apple Ads attribution), Meta Platforms (advertising measurement), Google (payments on Android, Sign in with Google, Gemini API, YouTube player), Resend (sign-in and waitlist emails), PostHog (analytics, EU), Expo (delivery of app updates), Cloudflare (forwarding of emails to contact@learnnito.com), Vercel (hosting of this website). The website uses no cookies, no analytics and no fonts loaded from third parties. Where a provider is based outside the EU, transfers rely on the EU Commission's standard contractual clauses or the EU-US Data Privacy Framework.

How long we keep data

Account data and backups until you delete your account. Waitlist addresses until you unsubscribe, at the latest 6 months after the launch on your store. Watch history for the feed and analytics events for at most 24 months. Clip reports until they are handled. Server logs for a few days. Billing records as long as tax law requires (Apple and Google keep the payment records).

Your rights

You have the right to access, correct, delete and port your data, to restrict or object to its processing, and to complain to a data protection authority. Email contact@learnnito.com and we will answer within a month. Because most data is linked only to a random app ID, please include that you use Nito without an account if that is the case; we may ask for details to find your data. The data protection authority for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), but you can complain to any authority in the EU.

Children

Nito is not directed at children under 13 and does not knowingly collect their data.

Changes

We will post changes here and update the date above.