Privacy policy

Last updated: October 2026

1. Controller

PFH Studios
Owner: Paul Holzhauer
Herzogstraße 17, 84561 Mehring, Germany
Email: contact@pfh-studios.de

2. In short

Gapwise works without an account. The app contains no tracking, no analytics tools and no ads. Your word lists, progress and settings stay on your device.

Only if you allow the AI feature are photos, scans and PDFs sent to OpenAI's AI to read your list. On iPhones without Apple Intelligence, this also applies to the words that example sentences or memory hooks are written for. The transfer goes through a Supabase server in Frankfurt am Main, Germany. We do not store this content. Details are in section 5.

3. Study material, photos, scans and PDFs

When you pick a photo, scan a page or open a PDF, your word list is read from it. If you allowed the AI feature, this is done by OpenAI (section 5). Otherwise, or without an internet connection, the app reads the text with Apple's frameworks (Vision and PDFKit) directly on your device. The app does not store the images. Only the recognised list is stored, locally on your device.

Processing on your device provides the study features of the app (Art. 6 (1) (b) GDPR). Sending content to OpenAI only happens with your consent (Art. 6 (1) (a) GDPR, see section 5). Please only add material you are allowed to use. Photos should not show people who have not agreed to it.

4. Camera and photo access

For the camera, the app asks for permission before the first access. The camera is only used while you scan. You pick photos with Apple's photo picker. The app only receives the images you pick and has no access to your photo library. You can withdraw camera permission at any time in the iOS Settings under Gapwise.

5. AI features

5.1 Which features use AI. Reading word lists from photos, scans and PDFs is done by OpenAI's language model GPT-6 Luna. Example sentences and memory hooks are written on iPhones with Apple Intelligence (iPhone 15 Pro and newer) by Apple's language model directly on your device (Apple Foundation Models); no data leaves the device for this. On other iPhones, or when Apple Intelligence is turned off, they are also written by OpenAI's GPT-6 Luna.

5.2 Only with your consent. Before anything is sent to OpenAI for the first time, the app asks you. Nothing is sent to OpenAI without your consent. If you decline, the app reads your lists on the device. You can change your choice at any time in the app's Settings under "Read lists with AI". Withdrawing consent applies for the future. Processing that took place until then remains lawful.

5.3 What is sent. To read a list: the photo or scan (reduced in size, as JPEG), or the text and scanned pages of a PDF. For example sentences and memory hooks: the word, its meaning and the languages of the list. Neither your name nor an account, a device ID or your location is sent. For technical reasons, Supabase processes your IP address when the connection is made. It is only used briefly to limit abuse and is not stored with the content.

5.4 Recipients.

• Supabase, Inc., USA, as a processor. The request is received by a function on servers in Frankfurt am Main, Germany, and passed on to OpenAI. No content is stored there. Privacy: https://supabase.com/privacy
• OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, as a processor. OpenAI does not use data sent through the API to train its models and deletes it after 30 days at the latest; until then it is only kept to detect abuse. Privacy: https://openai.com/policies/privacy-policy

Data processing agreements under Art. 28 GDPR are in place with both providers. Processing in the USA is possible. It is based on the EU Commission's Standard Contractual Clauses (Art. 46 (2) (c) GDPR).

5.5 Legal basis. Sending your content to OpenAI is based on your consent (Art. 6 (1) (a) GDPR). You can withdraw it at any time with effect for the future by turning the feature off in the app's Settings. Reading your lists on the device is based on Art. 6 (1) (b) GDPR. Please do not photograph health data or other particularly sensitive information.

5.6 Labelling. AI-generated example sentences and memory hooks are labelled as such in the app. Lists read by the AI can be checked and corrected before you save them. AI results may contain mistakes. No automated decision within the meaning of Art. 22 GDPR takes place.

6. Notifications

If you allow it, the app sends local reminders, for example before a test or before your free trial ends. These notifications are scheduled on your device. No data is sent to us. You can turn notifications off in the app or in the iOS Settings.

7. Purchases and subscriptions

Purchases and subscriptions are handled by Apple's App Store (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland). We do not receive payment data. Through Apple, the app only learns whether a subscription is active and when it ends, so it can unlock the right features (Art. 6 (1) (b) GDPR). Apple's privacy policy applies: https://www.apple.com/legal/privacy/

Apple provides developers with aggregated statistics if you agreed in the iOS Settings to share data with app developers. These statistics do not identify individual people.

8. Contact by email

If you email us, we process your email address and the content of your message to reply (Art. 6 (1) (b) and (f) GDPR). We delete the data when it is no longer needed and no legal retention period applies.

9. Storage period and deletion

Your word lists and progress stay on your device until you delete them. For how long OpenAI keeps data, see section 5.4. You can delete individual study sets in the app. Deleting the app removes all of its data from the device.

10. No sharing

We do not sell data and do not show ads. Apart from the service providers named in section 5, and only if you allow the AI feature, we do not share data.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). You can withdraw consent at any time with effect for the future. Since we do not store your data on our own servers, this usually only concerns emails you have sent us.

12. Right to lodge a complaint

You can lodge a complaint with a data protection authority, for example the authority where you live or the authority responsible for us: the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

13. Children and teenagers

Gapwise is made for school students. We do not build profiles and do not store content on our own servers. Purchases go through Apple. The AI feature is only active if it was allowed in the app, and it can be turned off at any time in Settings. Anyone under 16 needs a parent's consent for it (Art. 8 GDPR). The app points this out, and if grade 3 to 6 is selected, the AI feature can only be turned on after an adult confirms it. Without AI, lists are read directly on the iPhone. Parents can control purchases with Family Sharing and "Ask to Buy".

14. Security

The app's data is protected by the data protection features of iOS, such as device encryption. Transfers to Supabase and OpenAI are encrypted with TLS.

15. Data protection officer

A data protection officer is not required under § 38 BDSG, as nobody is permanently engaged in processing personal data.

16. Changes

We update this policy when the app or the law changes. The version available in the app applies.

The German version of this policy is the binding one.