Privacy Policy

Last updated: TBD before first public release

1. Introduction

Hermeno is a language-learning application that allows users to create and manage personal vocabulary, review learning material, import text from images, receive AI-assisted learning content, and participate in vocabulary quizzes.

This Privacy Policy explains how personal data is collected, used, stored, and shared when you use the Hermeno mobile application, related backend services, support services, and associated website pages.

Hermeno processes personal data only for defined purposes connected with providing, securing, supporting, and improving the service. This policy should be read together with the Hermeno Terms of Service and AI Notice.

2. Data Controller

The controller responsible for processing personal data in connection with Hermeno is:

[LEGAL OWNER NAME]
Operating under the name Hermeno
[POSTAL ADDRESS]
Germany

Email: [PRIVACY CONTACT EMAIL]

Website: https://hermeno.de

These details must be completed before the Privacy Policy is published.

3. Information We Collect

Depending on how you use Hermeno, we may process the following categories of information.

3.1 Account and profile information

• email address;
• username;
• optional display name;
• password in hashed form;
• email-verification status;
• account creation and update timestamps.

Hermeno does not store your password in readable form.

3.2 Authentication and session information

• random application-installation identifier;
• optional device name;
• authentication-session records;
• access-token and refresh-token information;
• session creation, expiration, revocation, and security information.

3.3 Learning information

• vocabulary entries;
• translations, explanations, and example sentences;
• vocabulary status and review scheduling;
• review history and learning progress;
• dashboard statistics;
• quiz content, quiz participation, and quiz results;
• language, theme, learning, and personalization settings.

3.4 Content submitted for OCR and AI features

• words, phrases, sentences, and longer text entered by the user;
• text extracted from images;
• images selected from the photo library or captured using the camera when the user activates an image-import feature;
• language selections and instructions required to generate translations, explanations, examples, vocabulary candidates, or quizzes.

Whether original images are retained after processing is still being verified and must be confirmed before public release.

3.5 Communications

When you contact support or use account-related email functions, we may process:

• your email address;
• the contents of your request;
• email-delivery and technical status information;
• verification, password-reset, and account-recovery communications.

3.6 Technical and security information

The backend may process technical information required to operate and protect the service, including:

• request identifiers;
• requested API path and HTTP method;
• response status;
• timestamps;
• security and error logs.

The exact log contents and retention period must be confirmed before public release.

4. Authentication

Hermeno uses account-based authentication to provide secure access to user data.

Authentication information may include:

• email address;
• hashed password;
• email-verification status;
• device identifier;
• optional device name;
• authentication sessions;
• access tokens;
• refresh tokens.

Hermeno implements email verification, password-reset functionality, account recovery, session revocation, and refresh-token rotation to improve account security.

Passwords are stored only as secure hashes and are never stored in plain text.

5. Learning Data

Hermeno stores learning-related information necessary to provide the application's educational functionality.

This may include:

• vocabulary;
• translations;
• explanations;
• example sentences;
• review schedules;
• review history;
• learning statistics;
• dashboard information;
• quiz participation;
• quiz results;
• personalization and learning preferences.

This information is associated with your account so that your learning progress can be restored across sessions.

6. Artificial Intelligence

Hermeno uses Google Gemini to provide AI-assisted language-learning features.

Depending on the feature being used, user-provided text and, where applicable, images may be transmitted to the AI provider for processing.

AI functionality currently includes:

• OCR-assisted vocabulary extraction;
• translations;
• explanations;
• example sentences;
• vocabulary enrichment;
• quiz generation.

Hermeno also maintains a shared AI-response cache to reduce repeated requests, improve response times, and lower operating costs.

AI-generated content should always be reviewed by the user, as it may occasionally contain inaccuracies or incomplete information.

7. OCR Processing

Users may import text by selecting an image from the photo library or capturing a new image with the device camera.

The submitted image is processed to extract textual content which can then be converted into vocabulary, translations, explanations, or other learning material.

The exact retention period for uploaded images is currently under implementation review and will be confirmed before the first public release.

8. Transactional Emails

Hermeno uses Resend to deliver transactional emails required for account functionality and security.

These communications may include:

• email-verification messages;
• password-reset messages;
• account-recovery messages.

These emails are sent to operate and protect the user's account. Hermeno does not send marketing emails as part of the current MVP.

9. Data Storage and Security

Hermeno applies technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure.

These measures include:

• password hashing;
• short-lived access tokens;
• rotating refresh tokens;
• email verification;
• password-reset controls;
• authentication-session management;
• encrypted HTTPS communication in production;
• secure storage of authentication tokens on supported mobile platforms.

No method of transmission or storage is completely secure. Hermeno therefore cannot guarantee absolute security, but reasonable safeguards are applied according to the nature of the service and the data processed.

The specific retention periods for individual data categories, including logs, backups, and cached AI content, must be finalized before the first public release.

10. Data Sharing

Hermeno does not sell personal data.

Personal data is shared only where necessary to provide the requested functionality, maintain the service, or comply with legal obligations.

Depending on the feature being used, information may be processed by carefully selected service providers, including:

• Google Gemini, for AI-powered language-learning features;
• Resend, for transactional emails such as email verification, password reset, and account recovery;
• Hosting and infrastructure providers responsible for operating Hermeno's backend services.

Hermeno does not use advertising networks or third-party analytics platforms in the current MVP.

Personal information may also be disclosed if required by applicable law or to protect the security, integrity, or legal rights of Hermeno and its users.

11. Your Rights

If the General Data Protection Regulation (GDPR) applies to you, you may have the following rights:

• access your personal data;
• request correction of inaccurate data;
• request deletion of your personal data;
• request restriction of processing;
• receive your personal data in a portable format where applicable;
• object to certain processing activities;
• withdraw consent where processing is based on consent.

Requests may be submitted using the contact information provided in this Privacy Policy.

You may also lodge a complaint with the competent data protection authority if you believe that your personal data is being processed unlawfully.

12. Account Deletion

Hermeno allows users to delete their account directly from within the application.

After deletion is requested, account-related information is removed in accordance with the application's deletion process.

Certain technical records or backups may remain temporarily where necessary for security, disaster recovery, or legal compliance. Such information is retained only for the period reasonably required for those purposes.

13. Children's Privacy

Hermeno is designed for general language learning and is not specifically directed at young children.

If we become aware that personal data has been collected from a child in violation of applicable law, reasonable steps will be taken to remove such information.

Parents or legal guardians who believe that a child has provided personal information may contact us using the details provided below.

14. Changes to this Policy

This Privacy Policy may be updated from time to time to reflect changes in Hermeno, legal requirements, or our processing activities.

The "Last updated" date at the beginning of this document will always indicate the most recent revision.

Material changes may also be communicated through the application where appropriate.

15. Contact

Questions regarding this Privacy Policy or the processing of personal data may be directed to:

Hermeno

Website: https://hermeno.de

Privacy email: [PRIVACY CONTACT EMAIL]

Support email: [SUPPORT EMAIL]

The contact details above must be completed before the first public release.