How Moien handles your data, why, and what you can ask us to do about it. Last updated 7 September 2026.
The controller for the processing described here is Kabil Jbeli, a private individual who builds and runs the Moien website and the Moien Android application.
Moien is a free project run by one person rather than a company, so it has no business premises to publish; e-mail is the way to reach the controller, and every request described in this notice is answered there. If a supervisory authority needs a postal address, it will be provided to them on request.
There is no Data Protection Officer. Moien does not meet the criteria in Article 37 GDPR that would require one.
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Your level, completed lessons, points, day streak and review schedule, stored in your browser's local storage or in the app's own storage. | So the course remembers where you are. | Not a transfer to us at all: the data never leaves your device. Storing it is strictly necessary to provide the service you asked for, so no consent is required under Article 5(3) of the ePrivacy Directive. | Until you press "Reset progress", clear your browser data, or uninstall the app. |
| If you sign in: your Google account's name, e-mail address, profile picture and user ID. | To identify your account so the right progress is loaded on each device. | Performance of a contract, Article 6(1)(b) GDPR. You asked for cross-device sync; an account is how it works. | Until you delete your account. Deletion is immediate and complete. |
| If you sign in: the same learning progress as above, copied to our database. | To merge and sync your progress between your phone and your computer. | Performance of a contract, Article 6(1)(b) GDPR. | Until you delete your account or reset your progress. |
| Advertising identifiers and cookies set by Google. | To show and measure the advertisements that pay for the course. | Consent, Article 6(1)(a) GDPR, collected through Google's consent message before any personalised ad is shown. You may refuse and still use every part of the app. | Set by Google; see their retention policy linked in section 6. |
| Server logs of our hosting provider, including your IP address, kept automatically when a page is served. | To deliver the site and to keep it secure and available. | Legitimate interests, Article 6(1)(f) GDPR: running a website securely. We do not read these logs to learn anything about you. | As retained by Firebase Hosting, typically a matter of days. |
We do not sell data, we do not build learner profiles, and we run no analytics of any kind.
This is the default. Your level, completed lessons, points and review schedule are written to your browser's local storage on your own device. Nothing is sent to us and we cannot see it. Pressing "Reset progress" on the About page, or clearing your browser's site data, removes it permanently.
Sign-in is entirely optional. When you use it, Google tells us your account's name, e-mail address, profile picture and a user ID, and we store your learning progress against that ID in a Cloud Firestore database hosted by Google in the European Union, in the multi-region eur3. Security rules on the database allow only you, signed in as yourself, to read or write your own record. We do not read individual records.
On the About page, signed in, "Delete account and data" removes your stored progress and your Moien account in one step. Your Google account itself is untouched; you are only removing Moien's copy and Moien's ability to identify you. The deletion is immediate and there is no backup from which we could restore it. You may also simply sign out, which leaves your cloud copy in place until you return.
Moien uses three Google services. Google acts as our processor for hosting and for the database, and as an independent controller for advertising.
Besides its own files and the advertising script, the app contacts our database only while you are signed in.
Your progress and your account are stored in the European Union. Google is a company established in the United States, so some support and administrative access from outside the EU cannot be excluded. Where that happens, Google relies on the European Commission's Standard Contractual Clauses and on the EU-US Data Privacy Framework. See Google's data processing terms.
Moien itself sets no cookies. It uses your browser's local storage for your progress, your chosen interface language, and, if you sign in, the token that keeps you signed in. None of that is advertising-related and none of it leaves your device except the progress you asked us to sync.
Advertising cookies and identifiers are set by Google, only after you consent through the consent message Google shows on your first visit in the EU, the EEA and the UK. You can change or withdraw that choice at any time from the same message, reachable from the privacy settings link Google places in the ad area, and through your Google ad settings.
Under the GDPR you have the right to:
Write to the e-mail address in section 1 and we will answer within one month. There is no charge.
If you think we have handled your data wrongly, please tell us first so we can put it right. You also have the right to complain to a supervisory authority, in Luxembourg the Commission nationale pour la protection des données:
CNPD, 15 boulevard du Jazz, L-4370 Belvaux, Luxembourg. cnpd.public.lu.
You may equally complain to the authority in the EU country where you live or work.
Moien is a language course suitable for all ages and is not directed at young children. Because sign-in relies on consent to a contract, we ask that anyone under 16 uses the app without signing in, which requires no personal data at all, or has a parent or guardian sign in on their behalf. We do not knowingly hold account data for a child under 16. If you believe we do, write to us and we will delete it.
There is no automated decision-making with legal or similarly significant effects, and no profiling. The placement test is a self-assessment: it suggests a starting level and you can override it on any level page.
The site is served over HTTPS only. Sign-in is handled by Google and we never see your password. Database rules restrict every learner's record to that learner. We hold no payment data and no special categories of personal data.
If this notice changes materially, the date at the top changes with it and the change is noted in the app's About page. Substantial changes affecting signed-in learners will be announced in the app before they take effect.
Questions or corrections about the Luxembourgish in the course are not a privacy matter and are best raised as an issue on the project's public repository, linked from the About page.
Last updated 7 September 2026.