Privacy Policy
Last updated 25 October 2026
In short
- Gerok is new, and anyone 18 or older can sign in with a Google account, an Apple account, or an email address and a password.
- We use your Google or Apple sign-in only to create and run your Gerok account, and keep a password only as a one-way hash, never the password itself.
- The stories you record are kept in your account until you delete them. To make their German version, ElevenLabs writes down what you said, OpenAI retells it in German at your level, and ElevenLabs reads the German aloud. From each story OpenAI then makes your lessons (its words, grammar, exercises and a short practice conversation, which ElevenLabs voices). When you say one of your sentences back in Shadowing, ElevenLabs writes down what you said, to show which words came through. When you tell a story again in Retell, ElevenLabs writes down what you said and OpenAI goes over it. When you answer by voice in a role-play, ElevenLabs writes down what you said and OpenAI replies. Those recordings, what you said and the chat aren't kept. If you use Language Studio to put something you wrote into German, OpenAI translates the text you send. If you use the grammar finder, OpenAI checks the sentence you send for the German grammar it takes and, when you ask, explains it. Neither is kept. If you ask for a picture of a story, OpenAI paints one from it, which is kept with the story. The words your lessons teach are each read aloud on their own by ElevenLabs, so you can hear how they're said: such a recording holds only the word, isn't linked to you, and is shared by everyone who learns that word, so it stays when your account goes.
- If you ask for it, ElevenLabs makes a copy of your voice from the recordings of the stories you've told, to read your new stories in German; you never have to record anything extra. It's kept until you delete it, at ElevenLabs too.
- If you talk with a friend in Gerok (Friends, which we're trying out with a few learners first): nobody can find you, only someone you send an invite link to, which works once, for a week. The voice messages you send in a talk, and what was written down from them, are kept so your friend can hear and read them, and so can you. Each message you send becomes a story in your friend's account, to learn as their own stories are: your recording, with what was written down from it and a title OpenAI writes for it, and so do theirs for you. A talk and the stories it became in both your accounts go when either of you removes the other, or you delete the story the talk is about; your friend can delete the stories you sent them, as any of theirs. ElevenLabs writes down what you say; OpenAI goes over it with you before you send it, and writes ways to answer your friend's at your level. What you say and don't send isn't shared, and goes when you say it again. If your friend has turned on reminders, their devices are told when a message from you comes, with your first name and the story's title. So that you can send your telling of a story from Retell rather than say it again, the latest one you recorded for each story is kept in your account (the recording and what was written down from it), replaced by the next, until you delete the story; your friend gets it only if you send it.
- If you subscribe to Gerok Plus, Polar sells it to you and takes the payment: we never see your card, only whether you're on Plus and until when.
- No ads, no tracking, no analytics, no selling your data.
- Before a new feature or provider receives your data, for example a new kind of lesson, we update this page first.
- You can delete your account and everything in it at any time, yourself, under Delete account in your account’s settings on gerok.app or in the iPhone app, or by writing to privacy@gerok.app. We delete every story with all that was made from it, your talks with friends and the stories you sent them, the copy of your voice at ElevenLabs, and the rest of your account. If you pay for Gerok Plus, it first stops renewing at Polar, so you’re never charged again, and if you signed in with Apple, we end that sign-in at Apple too.
1. Who we are
The controller responsible for your data under the EU General Data Protection Regulation (GDPR), for gerok.app and the Gerok service:
Aleksei ShlykWallstraße 18
10179 Berlin, Germany
Email: privacy@gerok.app
2. What we use and why
| What | Why | Legal basis |
|---|---|---|
| Account: your name, email address, profile picture and Google account ID from Sign in with Google, or your name, email address (which can be one of Apple’s private relay addresses) and Apple ID from Sign in with Apple, and the sign-in tokens they issue for your Gerok account; or, if you sign up with an email address, your name, that address, whether you’ve confirmed it, and your password as a salted one-way hash (scrypt) | Running your account | Contract, Art. 6(1)(b) GDPR |
| Sessions: a record of each sign-in with its IP address and browser | Keeping you signed in securely | Contract, Art. 6(1)(b) GDPR |
| Stories: the audio you record, its transcript with a time for every word, its German retelling, the German audio, the words picked from it to learn and, if you ask for one, a picture painted from it with a colour taken from that picture | Keeping your stories to learn from, making a German version at your level that you can read along with while it plays, and word cards from it | Contract, Art. 6(1)(b) GDPR |
| Settings: your German level (CEFR), the language you tell your stories in, and the style your pictures are painted in | Writing your German at the right level, writing down your recordings in the right language and explaining things in it, and painting your pictures as you like them | Contract, Art. 6(1)(b) GDPR |
| Practice record: when you told a story or finished a step, which step, and how many words it had, kept even after you delete the story | Showing your progress: your streak, your year of practice days, what you’ve done in all and the stamps you've collected | Contract, Art. 6(1)(b) GDPR |
| Your review: for each word, grammar pattern and sentence from your stories, how well you know it and when it's due again | Bringing back what you’ve learned in Today’s review, just before you’d forget it | Contract, Art. 6(1)(b) GDPR |
| Your voice, if you ask for a copy of it: a few of your story recordings that Gerok picks, a minute or two of you speaking (passed to ElevenLabs, which makes the copy), the copy and its ID, whether your new stories are read in it, and when you agreed | Reading your new stories in German in your own voice | Your explicit consent, Art. 6(1)(a) and Art. 9(2)(a) GDPR; withdraw it any time by deleting your voice |
| Your plan: whether you're on Gerok Plus, monthly or yearly, and when it renews or ends, as Polar tells us | Giving you what your plan includes | Contract, Art. 6(1)(b) GDPR |
| Daily use: how many stories, pictures, voice copies, role-play answers and retellings, and shadowing tries you started each day, and which day is yours now: when it began and the time zone it's counted in (such as “Europe/Berlin”) | Keeping to each plan's daily allowance | Contract, Art. 6(1)(b) GDPR |
| What our providers used each day in making things for you: how many characters were voiced, seconds of recording heard, words of text written and pictures painted, and for which feature. Never what was said or made. | Knowing what Gerok costs to run, so its plans and allowances stay fair | Legitimate interests, Art. 6(1)(f) GDPR |
| Talks with friends, if you have any: who you're friends with and the invites you made, your voice messages in each talk (the recording and what was written down from it), whether your friend has opened and played them, the quick reactions you give each other's messages, the stories your friend's messages became for you (with their recording and first name), and your latest telling of each story in Retell, to send to a friend | Letting you and a friend you chose talk to each other in German | Contract, Art. 6(1)(b) GDPR |
| Daily reminders, if you turn them on: your browser’s push address and keys, the hour you chose and your time zone, for each device | Sending the reminder at your hour, on days you haven’t practised yet, and telling you when a friend's message comes | Consent, Art. 6(1)(a) GDPR; turn them off any time in Settings |
| Technical logs: IP address, device and requests | Security and fixing errors | Legitimate interest in a secure, working service, Art. 6(1)(f) GDPR |
| Reports and blocks, if you make any: who you reported, why and the words you added, and who you blocked | Looking into reports of content that breaks the law or our terms, and keeping someone you blocked from becoming your friend again | Legal obligation under the EU Digital Services Act, Art. 6(1)(c) GDPR, and legitimate interest in a safe service, Art. 6(1)(f) GDPR |
| Messages you send us | Answering you | Contract or legitimate interest in answering you, Art. 6(1)(b) or (f) GDPR |
Cookies. Gerok sets only the cookies it needs to work: one that keeps you signed in, a short-lived one that secures the step where Google or Apple sends you back to Gerok, and one that holds your time zone (such as “Europe/Berlin”), so your practice days start at your own midnight. They are strictly necessary for the service you ask for (§ 25(2) TDDDG). We set no tracking or advertising cookies.
3. Signing in
When you choose “Continue with Google”, Google asks you to share your name, email address and profile picture with Gerok. Google handles that step as a separate controller under its own privacy policy. We ask Google only for this basic profile, not for access to your other Google data, and use it only to create and run your Gerok account.
Gerok’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don’t use it for advertising, sell it or share it with anyone except the providers in section 4 that run Gerok for us, or where the law requires it.
When you choose “Continue with Apple”, Apple asks you to share your name and email address with Gerok, and lets you hide your address behind a private relay address that forwards our emails to you. Apple handles that step as a separate controller under its own privacy policy, and we use what it shares only to create and run your Gerok account.
When you sign up with an email address and a password, we email you a link to confirm the address, and you can sign in once you have. If you forget your password, we email you a link to choose a new one. A confirmation link works for 24 hours and a password link for an hour; each works once. We send these emails only when you ask for them, through Cloudflare (section 4), and never send you marketing.
4. Who helps us
The providers below work only on our behalf and for the purposes on this page, under data processing agreements (Art. 28 GDPR). We don’t sell your data or use it for advertising, and we share it with no one else unless the law requires it.
| Provider | What for | Where and safeguard |
|---|---|---|
| Cloudflare | This website and the app, its database and file storage, sending the emails that confirm your address or let you choose a new password, and email forwarding | Worldwide; EU-U.S. Data Privacy Framework, Standard Contractual Clauses |
| ElevenLabs | Transcribing your stories, the sentences you say back in Shadowing, your retellings, your spoken answers in role-plays and your messages to friends; making a copy of your voice if you ask for one; reading the German aloud, and voicing the practice conversations and replies made from them | USA, the Netherlands and Singapore; EU-U.S. Data Privacy Framework, Standard Contractual Clauses |
| OpenAI | Retelling your stories in German, marking where the voice should laugh, whisper and so on, and making your lessons from them: the words worth learning with what they mean, the grammar you used, exercises, a short practice conversation with questions on it, and the replies and suggestions in a role-play about your story, going over a story you tell again, going over your messages to friends and writing ways to answer theirs; translating what you write in Language Studio, and finding and explaining the grammar a sentence you write in the grammar finder takes; and, when you ask for one, painting a picture of a moment from your story. OpenAI doesn’t train its models on this data. | USA; Standard Contractual Clauses |
| Polar | Selling you Gerok Plus as the merchant of record: the checkout, payment, invoices, tax and the page where you manage your subscription. When you start a checkout, Polar gets your name, email address and Gerok account ID; what you enter at the checkout, such as your card and billing address, Polar handles under its own privacy policy as a separate controller. | USA; EU-U.S. Data Privacy Framework, Standard Contractual Clauses |
| Your browser’s push service (Apple, Google or Mozilla, depending on your device) | Delivering your daily reminder, if you turned it on: its title and a line such as “8 cards from your stories”, sealed so only your device can read it | Depends on the service; usually the USA |
Ask us for a copy of the Standard Contractual Clauses (Art. 46(2)(c) GDPR). Providers can change as Gerok grows: we update this page before a new one receives your data. Emails you send us arrive in a mailbox hosted by Google.
5. How long we keep it
- Your account and everything in it: until you delete it, or ask us to. Deleted in your settings, it’s gone within minutes; asked by email, we do it within a month: your stories with their recordings, German versions, lessons, pictures and scenes; your talks with friends, their recordings, and the stories they became in both your accounts, as if you'd removed each friend; the stories you sent friends; the copy of your voice, at ElevenLabs too; your sign-ins and sessions; your settings, practice record, review, plan, daily use, what our providers used for you, and reminders. If you pay for Gerok Plus, it stops renewing at Polar before your account goes (it isn’t refunded for the time already paid for), and a sign-in with Apple is ended at Apple. The recordings of single words stay, as they hold only the word and belong to no one.
- Sessions: until you sign out, or until they expire 7 days after your last visit.
- Stories, their transcripts, German versions and pictures: until you delete the story or your account. ElevenLabs may keep what it processes as its data processing agreement with us allows; OpenAI keeps requests for up to 30 days to detect abuse, then deletes them.
- Your practice record: until you delete your account, so deleting a story doesn't undo a practice day or a stamp.
- Your review: until you delete the story it's from, or your account.
- Your plan, daily use and what our providers used for you: until you delete your account. Polar keeps payment records as tax law requires.
- Talks with friends, your messages in them and the stories they became in your friend's account (and theirs in yours): until either of you removes the other, or deletes the story the talk is about; when you delete your account, we delete what you sent your friends too. A story a friend sent you, you can delete as any other. A message you said and didn't send is replaced when you say the next.
- Reports and blocks: until your account or that of the friend they're about is deleted.
- Your voice: until you delete it on its page, or your account; we delete the copy at ElevenLabs then. Stories already read in it keep their sound until you delete them.
- Reminders: until you turn them off, your browser stops taking them, or you delete your account.
- Technical logs: at most 30 days.
- Emails: until answered, at most two years.
6. Your rights
You can get a copy of your data, correct or delete it, restrict its use, take it with you, and object to processing based on our legitimate interests (Art. 15–18, 20 and 21 GDPR). You can withdraw consent at any time, without affecting what was done before. You can also remove Gerok’s access to your Google account in your Google Account settings, or stop using Sign in with Apple for Gerok in your Apple Account settings, at any time.
You can delete your account yourself, under Delete account in your account’s settings. To use any of the other rights, or to have us delete it, write to privacy@gerok.app from your account’s email. We answer within one month.
You can also complain to a data protection authority, such as the one where you live or work, or ours: the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, datenschutz-berlin.de.
7. Adults only
Gerok is for adults. You must be 18 or older to use it.
8. Security
Connections are encrypted, your data is stored encrypted by our provider, and your account is private to you.
9. This website
gerok.app uses no analytics, third-party fonts or scripts, and sets only the sign-in cookies described in section 2. Cloudflare delivers it, briefly processing your IP address and request data to do so and to protect the site, our legitimate interest under Art. 6(1)(f) GDPR.
10. Changes
We update this policy as Gerok changes. The date at the top shows the current version, and if a change needs your consent, we ask you first.