Zinho Privacy Policy

Last updated: 26 October 2026

Zinho is an app for learning Brazilian Portuguese from short video clips. This policy covers the Zinho iPhone app and this website. We collect as little as we can, we do not sell data, and there are no ads inside the app.

Who is responsible

Luca Straßburger, Gropperstr. 62, 47807 Krefeld, Germany. Email: contact@zinho.app.

What stays on your device

Your saved words and review progress, your level, goals and interests, saved clips, watch history and reading settings are stored on your phone.

What we process, and why

• Clip feed (Supabase, EU): a random ID generated by the app and the IDs of the clips you watched, so you are not shown the same clip twice and the feed can adapt to your level. Legal basis: providing the service (Art. 6(1)(b) GDPR).
• Optional account (Supabase Auth, EU): if you sign in with Apple, Google or an email code, we store your email address (or Apple's private relay address) and a backup of your words, level and interests so you can restore them on a new phone. Sign-in codes are emailed via Resend. You can delete the account at any time in the app (Profile → Settings → Delete account); this deletes the account and its backup. Legal basis: Art. 6(1)(b) GDPR.
• Subscription (Apple, RevenueCat): payments are handled by Apple. RevenueCat receives an anonymous app user ID and your purchase status so the app knows whether Super Zinho is active. We never see your payment details. Legal basis: Art. 6(1)(b) GDPR.
• AI explanations (Google Gemini): when you ask for the AI explanation of a word or a clip, the word, its sentence or the clip text and title go through our server (a Supabase Edge Function) to Google's Gemini API, which writes the explanation. No account or device ID is sent with it. AI explanations can be wrong. Legal basis: Art. 6(1)(b) GDPR.
• Clip reports: if you report a clip (or it cannot be played), we store the clip, the reason and the random app ID, to fix or remove the clip. Legal basis: Art. 6(1)(f) GDPR.
• Server logs: when the app or this website talks to a server (Supabase; Vercel hosts this website), the server briefly processes your IP address and technical request data to deliver the response and keep the service secure. Legal basis: Art. 6(1)(f) GDPR.
• Product analytics (PostHog, EU servers in Frankfurt): we record how the app is used (for example: onboarding finished, clip watched, word looked up, review done, subscription started) together with a random ID, device type and app version, to find out what helps people learn and where the app gets in the way. If you are signed in, these events are linked to your account ID. There is no tracking across other apps or websites and no advertising ID. Legal basis: our legitimate interest in improving the app (Art. 6(1)(f) GDPR); you can object at any time by emailing us.
• Advertising measurement (Meta, Apple): we advertise Zinho on Facebook and Instagram. To learn which ads lead to installs and subscriptions, the app uses the Meta SDK, and RevenueCat reports trial starts and purchases to Meta. Your iPhone asks you first ("Allow tracking?"); only if you allow it is your advertising ID (IDFA) shared with Meta. If you decline, Meta only receives anonymous, aggregated measurements. You can change this any time in iOS Settings → Privacy & Security → Tracking. For ads in the App Store, Apple tells RevenueCat which search ad led to the install (Apple Ads attribution, no personal data). Legal basis: your consent (Art. 6(1)(a) GDPR) for tracking; otherwise our legitimate interest in measuring our advertising (Art. 6(1)(f) GDPR).

What we do not do

We do not collect your contacts, photos or location, we do not show ads inside the app, and we do not sell or rent data. Your advertising ID is only used if you allow tracking (see above).

YouTube

Clips are played with YouTube's embedded player. When a video plays, YouTube/Google may collect data under the Google Privacy Policy (https://policies.google.com/privacy). By using Zinho you also agree to the YouTube Terms of Service (https://www.youtube.com/t/terms). Videos belong to their creators; Zinho links back to each video and channel.

Speech

The "listen" buttons use your device's built-in text-to-speech. Nothing is sent to us.

Service providers

Supabase (database, sign-in and server functions, EU region), RevenueCat (subscription status), Apple (payments, Sign in with Apple, Apple Ads attribution), Meta Platforms (advertising measurement), Google (Sign in with Google, Gemini API, YouTube player), Resend (sign-in emails), PostHog (analytics, EU), Vercel (hosting of this website). The website uses no cookies, no analytics and no fonts loaded from third parties. Where a provider is based outside the EU, transfers rely on the EU Commission's standard contractual clauses or the EU-US Data Privacy Framework.

How long we keep data

Account data and backups until you delete your account. Watch history for the feed and analytics events for at most 24 months. Clip reports until they are handled. Server logs for a few days. Billing records as long as tax law requires (Apple keeps the payment records).

Your rights

You have the right to access, correct, delete and port your data, to restrict or object to its processing, and to complain to a data protection authority. Email contact@zinho.app and we will answer within a month. Because most data is linked only to a random app ID, please include that you use Zinho without an account if that is the case; we may ask for details to find your data. The data protection authority for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), but you can complain to any authority in the EU.

Children

Zinho is not directed at children under 13 and does not knowingly collect their data.

Changes

We will post changes here and update the date above.