Privacy Policy
Biti · Effective 11 September 2026 · Last updated 11 September 2026
Short version. Biti has no accounts, no ads, and no analytics or tracking SDK of any kind. Your learning progress and settings stay on your device. The app makes two kinds of network request: it downloads pronunciation audio automatically while you play, and it sends data to our backend only when you choose to submit feedback, report a translation, or enter an access code.
1. Who we are
This policy applies to the Biti mobile application, distributed on Google Play under the
package name com.wordmatch.biti. The person responsible for the processing
described here is Juraj Ostović, operating from Croatia in the European Union.
Privacy contact: juraj1180@gmail.com
This policy is a notice explaining how data is handled. Merely using the app is not treated as consent to data processing.
2. What stays on your device
Your learning progress, mastered words, unlocked content, chosen languages and settings are stored locally using the operating system's standard app storage. We do not receive or access any of it.
Pronunciation clips you have heard are also kept on your device, in the app's own storage rather than a temporary cache, so they keep working offline and are not downloaded twice. Clearing the app's data or uninstalling it removes everything in this section.
3. What the app sends, and when
Four activities involve a network request. The first happens automatically as you play; the other three happen only when you choose them.
| Activity | Data involved | Purpose and legal basis | Recipient and retention |
|---|---|---|---|
| Pronunciation audio (automatic) |
The IP address and ordinary network request information — request time, the requested file name and technical headers. The file name is a hash and does not contain the word in readable form. No identifier of you or your device is attached. | Playing the word you are learning. To avoid a pause before every word, the app downloads clips ahead of where you are, so requests occur while you play rather than only at the moment you tap. The legal basis is performance of the service you requested and our legitimate interest in operating the app. | Cloudflare, which hosts the audio in an R2 bucket and processes standard request logs under its own retention policy. We do not use these logs to identify you and do not combine them with anything else. |
| Sending feedback (only if you do) |
The message you write, the screen you were on, the category you picked, the language you are learning, your interface language, an optional context note such as the word you were on, and the time you pressed Send. | Reading and acting on your feedback. The legal basis is our legitimate interest in maintaining and improving the app. | Supabase. See retention in section 5. |
| Reporting a word (only if you do) |
The internal word and concept identifiers, the two languages, and the two words that were shown to you. | Correcting wrong translations and pronunciations. Same legal basis as above. | Supabase. See retention in section 5. |
| Entering an access code (only if you do) |
The code you typed. | Checking whether the code is valid. The legal basis is performance of the service you requested. | Supabase. See retention in section 5. |
The feedback message is free text. Please do not put your name, contact details or other personal or sensitive information into it — we do not need any, and the app works fully without you ever sending anything.
Like any internet request, all four reach the relevant provider with the IP address they came from. We do not use it to identify or track you, but we cannot claim it is never visible to the provider.
4. What the app does not do
- No user accounts and no sign-in.
- No advertising, and no advertising identifier is read or sent.
- No analytics, attribution, crash-reporting or tracking SDK is built into the app, and no profile is built about you.
- No contacts, photos, location, microphone or camera access.
- Your data is not sold, not shared with advertisers, and not used for profiling or automated decisions.
- The published app does not download code or content updates at runtime.
The interface fonts are bundled inside the app; they are not fetched from a font service while you use it.
5. How long submissions are kept
Feedback and word reports are kept while they are still useful for improving the app. There is no automatic deletion schedule configured, so entries remain until they are removed manually. We prefer to state this plainly rather than quote a retention period we do not actually enforce. Access codes are checked at the moment you enter them.
Downloaded audio clips live on your device until you clear the app's data or uninstall it.
6. Services we use
- Cloudflare hosts and delivers the pronunciation audio. See Cloudflare's Privacy Policy.
- Supabase stores optional feedback and word reports and validates access codes on our behalf. See Supabase's Privacy Policy.
- Google Play distributes the app and processes store-related data under Google's Privacy Policy, acting under its own terms for that processing.
- Expo / EAS is used to build the app. The published app contains no runtime update client, so Expo does not process end-user data while you use it. See Expo's Privacy Policy.
These providers process limited data only to provide, maintain and secure the functions described above, subject to their applicable contracts and legal obligations.
7. International data transfers
Biti is operated from Croatia in the European Union. Our service providers may process data outside Croatia, including outside the European Economic Area. Where personal data is transferred outside the EEA, the transfer relies on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or an adequacy decision. You may contact us for further information or a copy of the relevant safeguards.
8. Your rights
Subject to the conditions in the GDPR, you may request access to, correction or deletion of your personal data, restriction of processing and data portability, and you may object to processing based on legitimate interests. You also have the right to lodge a complaint with a data-protection authority. In Croatia this is the Croatian Personal Data Protection Agency (AZOP).
Because Biti creates no accounts and attaches no identifier to submissions, a report arrives with nothing tying it to a person, which can make a specific entry hard to locate. Write to the address above with enough detail to find it — roughly when you sent it and what it said — and we will act on your request for anything that can reasonably be identified as yours. We will not collect additional identifying data solely in order to identify you.
9. Age of users
Biti is intended for teenagers and adults rather than young children, and is not directed at children under 13. The age rating shown on the store listing is the one that applies. The vocabulary is everyday language chosen to be free of harmful content, there are no ads, and no account is required. Optional feedback should not contain personal information such as a name, contact details, school or location. If we learn that a report contains a child's personal data, we will delete it where required.
10. Security
All network requests are encrypted in transit using HTTPS. The feedback and report tables use database Row-Level Security that allows submissions to be inserted but not read back through the app's public key; stored entries are reachable only by the developer through the Supabase dashboard, and access is limited to maintaining and improving Biti.
11. Changes to this policy
We will update this policy before materially changing how the app processes data — for example if optional accounts or a subscription are added later. The dates at the top show when the current version took effect, and the current version is always the one published at this address.
12. Contact
For privacy questions or requests, email juraj1180@gmail.com.