Privacy policy

Who is responsible?

1001.digital UG (haftungsbeschränkt), Martinshof 6, 83626 Valley, Germany, is responsible for personal data processed by Minki. Contact us at minki@1001.digital for privacy questions or requests. This policy covers minki.club, app.minki.club and the Minki apps.

Learning without an account

You can use Minki without creating an account. Decks, learner profiles, review history and downloaded media are stored on your device. Requests to download shared library content still reach our servers. Like other web requests, these contain technical information such as your IP address, request time and browser or app information.

The marketing site stores your language choice in the minki_site_language cookie. The learning app uses local storage for offline learning and essential session information when you sign in. We do not use advertising trackers or marketing analytics on these sites.

Accounts, optional sync and sharing

If you create an account, we process your email address, account identifier, authentication records and device sessions. Passwords are stored as hashes. When you enable sync, we store learner profiles, decks, cards, learning progress and associated media so they can be available across your devices.

Profile-transfer invitations involve the information needed to move the selected learner to the recipient you approve. Anyone with a public deck link can read and redistribute that deck. A profile you transfer to another account becomes part of that recipient’s account; deleting your own account does not delete that transferred profile. Avoid putting sensitive information about other people in learning content.

Apple, Google and passkeys

When you choose Apple or Google sign-in, we receive the provider’s account identifier, email address when supplied, and the credentials needed to verify your sign-in. Apple can supply a private relay email address instead of your personal address. Apple authorization credentials may be stored encrypted so we can revoke the authorization when you disconnect it or delete your account. Google sign-in does not give Minki access to your Gmail, Google Drive or Google Play purchase history.

For passkeys, we store the credential identifier and public key needed to verify a sign-in. Your private key stays with your device or credential provider. Minki does not receive your fingerprint or face scan. Apple, Google and your passkey provider process information under their own privacy policies.

Optional AI conversations

When an eligible learner uses in-app voice, their audio and selected study-card content are sent to OpenAI for processing. Minki does not store raw audio or full transcripts. We retain the short AI-generated recap, referenced cards and technical usage metadata. Captions are transient. OpenAI processing and retention depend on our configured API project; absence of recordings in Minki does not mean a provider retains no data.

External assistant connections let the chosen host receive the learner-authorized deck content and learning context. Those hosts have their own privacy policies and retention rules. Conversational AI is optional, can be disabled per learner and does not change FSRS scheduling or create grades. Younger-child voice remains unavailable until the required safeguards and consent are supported.

Payments and service measurement

Apple, Google Play and Stripe process purchases through their respective payment systems. Minki retains verified transaction identifiers, account bindings and entitlement records for delivery, restoration, refunds and fraud prevention. Minki does not receive full card details. Payment providers process their own billing data under their privacy policies.

We record minimal first-party events in parent purchase flows to measure offer conversion, renewals, refunds and restore reliability. Voice cost records contain durations and token counts, not conversation transcripts. Identifiable operational usage and measurement records are retained for 90 days before deletion or aggregation. Financial records may be retained longer where legally required and separated from deleted learning accounts.

Why we process data

We process account, authentication, sync, sharing and transactional email data to provide the service you request (Article 6(1)(b) GDPR). We process necessary connection and security information to operate the service, prevent abuse and investigate failures (Article 6(1)(f) GDPR). These are our legitimate interests. You do not have to create an account; account features require the information necessary to operate them. Contacting support involves processing your message to respond to your request.

Service providers and international processing

We use Hetzner for hosting, Cloudflare for network delivery and object storage, and Resend for transactional emails such as verification, account security and invitations. These providers receive the information required for their service. We do not sell personal data.

Some providers and the sign-in providers operate internationally, including in countries outside the European Economic Area. Applicable transfer safeguards can include an adequacy decision or EU standard contractual clauses. Contact us for information about the safeguards applicable to your data and copies where available. Data may also be disclosed when required by law.

Retention and deletion

We keep account and synced learning data while needed to provide your account. Authentication challenges expire and are consumed when used. Technical security records are retained only while needed to operate, protect and investigate the service. Legal obligations can require longer retention of particular records.

You can delete your account in Minki’s account settings, or request deletion by email. Account records are deleted and stored media and Apple authorization revocations are queued for cleanup; failures are retried. Recovery backups can retain prior copies until they are replaced or no longer needed for recovery and security. Local device data is separate: remove it in the app or remove the app/browser storage if you want to erase it. Data transferred to another account or independently held by other users is not removed by deleting your account.

Your rights

Subject to the GDPR’s conditions, you can request access, correction, deletion, restriction and portability, and object to processing based on legitimate interests. Where processing is based on consent, you can withdraw it for the future. Contact minki@1001.digital; we may need to verify that the request comes from the account holder.

You can complain to a data protection supervisory authority, including the Bavarian State Office for Data Protection Supervision (BayLDA). Minki does not make automated decisions that produce legal or similarly significant effects about you. If we change how we process data, we will update this policy and provide any notice required for that change.