Arooty Privacy Policy

Effective date: September 17, 2026

This Privacy Policy explains how Arooty collects, uses, stores, and shares personal data of users of the Arooty website and applications.

Arooty is an Arabic-language-learning application that includes an online dictionary, a structured course, spaced-repetition practice, user-created wordsets, personal learning statistics, and other related features.

The web version of the service is available at arooty.com. Mobile applications for iOS and Android are in development; the Android application is also planned for distribution through RuStore.

1. Who is responsible for processing your data

Arooty is operated by, and the controller of personal data is:

Artem Masoshin PR Beograd
Dechanska 8, sprat 2, Beograd (Stari Grad), Serbia
PIB (registration number): 115167669

The operator is a sole proprietor (preduzetnik) registered in Serbia.

For privacy-related questions and requests concerning your personal data rights, you can contact us at:

support@arooty.com

2. What personal data we collect

We collect only the data necessary to operate Arooty, keep the service secure, process payments, and provide the features you choose to use.

2.1. Account data

When you register for and use Arooty, we may process:

  • email address — required for standard registration;
  • password — stored only as a bcrypt cryptographic hash and never stored in plaintext or in reversibly encrypted form;
  • first name — optional;
  • last name — optional;
  • gender — an optional profile preference used only for account display and not for grammar-related features;
  • selected interface language;
  • a technical value used to procedurally generate an avatar.

Arooty does not support uploading a personal photo as an avatar. Avatars are generated automatically from a random seed value.

2.2. Sign in with Google

If you choose Sign in with Google, we receive from Google the information needed to create or match your account, including:

  • your email address;
  • basic Google profile information made available through the selected OAuth flow.

We do not receive your Google account password.

2.3. Session and device data

Each time you sign in, Arooty creates a session record. It may include:

  • a hash of the refresh token;
  • device name or description;
  • the platform used to sign in: web, iOS, or Android.

Refresh tokens are not stored in plaintext in the database.

Users can view their active sessions, revoke them individually, or terminate all active sessions at once.

2.4. Learning activity data

To provide learning features, Arooty stores information about how you use the application, including:

  • dictionary words you have studied;
  • lessons you have completed or are currently studying;
  • spaced-repetition review history;
  • review outcomes, including pass/fail results;
  • next review dates;
  • daily learning statistics;
  • the number of words learned and reviewed;
  • data used to calculate your study streak;
  • data used for charts and statistics in your dashboard;
  • the contents of your personal word library;
  • custom wordsets you create.

If you choose to mark a custom wordset as public, it becomes visible to other Arooty users as intended by that feature.

2.5. User-uploaded files

A signed-in user may upload one image or audio file of up to 5 MB, for example a custom cover image for a wordset they created.

These files are stored in Cloudflare R2 object storage.

Do not upload files containing another person’s personal data or other content that you are not entitled to use or share.

2.6. Contact form submissions

If you use the Contact us form, we receive:

  • your name;
  • your email address;
  • the text of your message.

These data are used to process the specific request and deliver it to the operator’s support inbox.

Submitting the contact form does not by itself subscribe you to marketing communications.

2.7. Waitlist

Before public registration opens, visitors may submit an email address to receive a notification when registration becomes available.

That address is used only for a one-time launch or registration-opening notification.

We do not use that address for general marketing unless the user separately opts in to such communications in the future.

2.8. Subscription and billing data

Arooty may store information needed to manage a subscription, such as:

  • selected plan;
  • subscription status;
  • cancellation date;
  • renewal date;
  • whether the subscription is currently active.

Arooty does not receive, process, or store bank card numbers or other payment-instrument details on its own servers.

Payment details are processed directly by the relevant payment provider or app store.

2.9. Technical data and error reports

For operation, security, and diagnostics, we may process:

  • standard web-server request logs;
  • technical request information;
  • error messages;
  • stack traces;
  • information about the environment, device, or request related to a technical failure.

An IP address may be processed as part of normal network communication with Arooty servers and Cloudflare infrastructure.

However, IP addresses are not stored as a separate user-facing field in Arooty’s main user database.

On the pricing page, Arooty may additionally use an IP address to determine a country in order to suggest an appropriate payment method and show an estimated Premium price in a local currency. This determination happens temporarily, at the time the page is requested, and is not stored as a separate field on the user's profile. You can always manually pick a different country in the checkout interface — the choice is not tied to your actual location.

2.10. In-app currency (Aroots)

Arooty includes an in-app currency ("Aroots") that a user earns by using the product — for example, by completing lessons, review sessions, extending a learning streak, or adding words to their library.

Aroots cannot be purchased with real money — they can only be earned through activity inside Arooty.

Accumulated Aroots can be redeemed for non-monetary in-app benefits, such as extra Premium days or temporary access to specific product features.

We store the Aroots balance and its earning/spending history as part of usage data (see section 2.4).

3. How we use personal data

We use personal data to:

  • create and maintain user accounts;
  • authenticate users and maintain active sessions;
  • provide the dictionary, lessons, spaced-repetition practice, and other learning functions;
  • save learning progress;
  • generate personal statistics, streaks, and charts;
  • save personal word libraries and custom wordsets;
  • publish a user-created wordset when the user chooses to make it public;
  • process support requests;
  • send a one-time notification to waitlist users;
  • send transactional emails, such as password-reset emails;
  • determine a country from an IP address to select a payment method and show a price in a local currency;
  • credit and debit the in-app currency (Aroots) balance for product usage and benefit redemption;
  • manage subscription status;
  • verify purchases and subscriptions made through payment providers and app stores;
  • protect the service against abuse, attacks, fraud, and unauthorized access;
  • diagnose errors, outages, and performance issues;
  • maintain and improve the stability and security of Arooty.

4. Legal bases for processing

If the General Data Protection Regulation (GDPR) applies to the processing of your data, we rely on the following legal bases.

4.1. Performance of a contract

We process data where necessary to provide the service you have chosen to use, including:

  • account data;
  • session data;
  • learning progress;
  • personal word library;
  • spaced-repetition data;
  • subscription status;
  • technical data without which the requested functionality cannot be properly provided.

Legal basis: Article 6(1)(b) GDPR.

4.2. Consent

For certain optional profile data, we may rely on your consent where providing that information is not necessary to use Arooty’s core functionality.

This may include optional profile fields where consent is the applicable basis for the specific processing.

Legal basis: Article 6(1)(a) GDPR.

You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

4.3. Legitimate interests

We may process a limited amount of data on the basis of our legitimate interests, in particular to:

  • keep the service secure;
  • prevent abuse and fraud;
  • protect infrastructure;
  • maintain technical logs;
  • diagnose errors;
  • operate Sentry error monitoring;
  • protect the rights and legitimate interests of the operator and users.

Legal basis: Article 6(1)(f) GDPR.

When relying on this basis, we consider the nature of the data, the necessity of the processing, and the potential impact on users’ rights and freedoms.

4.4. Legal obligations

In certain cases, we may be required to process or retain specific data to comply with applicable law, accounting or tax requirements, other mandatory recordkeeping obligations, or lawful requests from competent authorities.

Legal basis: Article 6(1)(c) GDPR, where applicable.

5. Who we share data with

We do not sell users’ personal data.

To operate Arooty, we use external service providers. They may access only the data reasonably necessary for the relevant function.

5.1. Hetzner Online GmbH

Purpose: server infrastructure and hosting of the primary database.

Arooty’s application servers and primary database are hosted in Hetzner Cloud in Germany.

5.2. Cloudflare, Inc.

Purpose:

  • DNS;
  • CDN;
  • bot protection;
  • DDoS protection;
  • processing network traffic at the edge;
  • Cloudflare R2 object storage for images, audio, and other static files.

Cloudflare may see technical data relating to incoming requests, including IP addresses and other network metadata.

5.3. Resend

Purpose: transactional email delivery.

Resend is used, among other things:

  • to send password-reset emails;
  • to deliver Contact us form submissions to the operator’s inbox.

Depending on the function, Resend may process an email address, name, and message content.

5.4. Paddle.com Market Ltd

Purpose: card payment processing and acting as Merchant of Record for applicable subscriptions.

Paddle is the legal seller for those transactions and independently processes payment and billing data under its own privacy policy.

Such data may include:

  • card number;
  • payment details;
  • billing address;
  • other information required by Paddle to complete the transaction.

Arooty’s servers do not receive bank card numbers or other payment-instrument details.

Arooty receives only the information required to determine and verify purchase or subscription status.

We may also share country information with Paddle (either determined from an IP address or manually chosen by you) to show an estimated Premium price in a local currency before a purchase is made, through Paddle's own price-preview functionality.

5.5. YooKassa

Purpose: processing subscription payments from users paying in Russian rubles.

Payment details are processed directly by YooKassa.

Arooty does not receive or store bank card numbers submitted to YooKassa.

5.6. Apple Inc.

For purchases made through the App Store, payment is processed by Apple.

Arooty receives only the information necessary to verify the purchase or subscription, such as a receipt or other verification token, and not bank card details.

5.7. Google LLC

Google may act in two separate roles:

Google Play — processes purchases made through Google Play. Arooty receives only the information needed to verify the purchase.

Google OAuth — acts as an identity provider for Sign in with Google and provides Arooty with the basic profile data and email address authorized by the user.

5.8. RuStore / VK

For purchases made through RuStore, payment is processed through RuStore’s infrastructure.

Arooty receives only the information necessary to verify the purchase, not bank card details.

5.9. Sentry / Functional Software, Inc.

Purpose: monitoring errors and crashes in the Arooty website and backend.

Sentry may automatically receive:

  • stack traces;
  • technical application parameters;
  • request information;
  • certain technical metadata associated with an error.

Before an error report is sent, known-sensitive fields — such as passwords, authentication tokens, API keys, and authorization/cookie headers — are automatically redacted. Other technical request metadata directly related to the failure may still be included.

5.10. OpenAI, L.L.C. and ElevenLabs Inc.

These services are used only in Arooty’s internal content-authoring workflow.

They may be used, for example:

  • to help prepare drafts of dictionary or course content;
  • to generate audio for learning materials.

These services are not directly invoked by Arooty end users and do not receive end-user account data through the product’s user-facing features.

They receive only internal content-authoring inputs needed for content creation, such as a word, a draft definition, or a sentence to narrate.

5.11. PostHog

Purpose: privacy-conscious product analytics — which pages are visited and how the product is generally used, so we can understand and improve it.

PostHog is only loaded, and only begins collecting any data, after a visitor explicitly accepts analytics cookies through the cookie banner shown on the site (see Section 7.3). Declining, or not responding to the banner, keeps PostHog fully disabled for that visitor — nothing is loaded or set.

When enabled, PostHog may process: pages visited, general device/browser information, and a pseudonymous identifier used to group a visitor's activity together. Our PostHog project is hosted in the EU (Frankfurt) region.

5.12. Data Processing Agreements

Where required, we rely on Data Processing Agreements with our service providers — either a provider's own standard DPA, accepted as part of using their service (as is standard practice for infrastructure providers such as Cloudflare, Sentry, Resend, OpenAI, and ElevenLabs), or equivalent contractual terms included in the provider's standard agreement (as with Hetzner).

6. International data transfers

Arooty’s primary application servers and primary database are hosted in Germany.

Some of our service providers are companies established outside the European Economic Area, including in the United States, or may process certain data through international infrastructure.

Depending on the provider and the nature of the processing, transfers outside the EEA should be carried out using an applicable lawful mechanism, such as:

  • an adequacy decision of the European Commission;
  • Standard Contractual Clauses (SCCs);
  • other GDPR-compliant mechanisms and supplementary safeguards where required.

Where a provider processes data outside the EEA, we rely on the safeguards included in that provider's own standard data-processing terms, such as Standard Contractual Clauses.

7. Cookies and similar technologies

Arooty uses two kinds of cookies/local storage: those necessary for the service to function, and optional analytics cookies that are only set if you agree to them.

We do not use advertising cookies.

7.1. Authentication cookies

Arooty uses cookies associated with the access token and refresh token to maintain a user’s authenticated session.

They are necessary for signing in and using protected functionality.

7.2. Interface-language cookie

Arooty uses a cookie to remember the interface language selected by the user.

7.3. Analytics cookies (optional, consent-based)

On your first visit, Arooty shows a cookie banner asking whether you agree to optional analytics cookies (PostHog — see Section 5.11).

If you accept, PostHog is loaded and may set cookies/local storage to recognize your browser across visits. If you decline, or close the banner without choosing, PostHog is not loaded and no analytics cookies are set.

You can change your choice at any time using the “Cookie preferences” link in the site footer.

7.4. Future changes

If Arooty introduces advertising technologies or other non-essential cookies beyond what is described above, we will update this Policy and, where required by law, request the appropriate user consent.

8. How long we keep data

We aim to retain personal data no longer than necessary for the purposes for which it was collected, taking into account legal, technical, and operational requirements.

8.1. Active account data

Core account data, learning progress, personal word library, and related account data are generally retained while the account exists and the data remain necessary to provide the service.

8.2. Account deletion requests

Arooty currently does not provide an automated self-service “delete my account” button.

If you want your account and associated personal data deleted, send a request to:

support@arooty.com

The request is handled manually.

Arooty may add a self-service account deletion flow in the future.

8.3. Backups

Arooty creates database backups from time to time for disaster recovery and technical-failure recovery purposes. An automated, fixed backup retention schedule has not yet been established; this section will be updated with a specific retention period once one is in place.

After data are deleted from the primary system, a copy may still exist in an existing backup until that backup is itself deleted or overwritten as part of normal operational practice.

8.4. Data that must be retained by law

Some records may be retained for longer where necessary to comply with mandatory legal, accounting, or tax requirements, resolve disputes, or establish, exercise, or defend legal claims.

9. Your rights

If the GDPR applies to the processing of your data, you may have the following rights.

9.1. Right of access

You may request confirmation of whether we process your personal data and obtain a copy of the relevant data.

9.2. Right to rectification

You may ask us to correct inaccurate or incomplete personal data.

9.3. Right to erasure

Where provided by law, you may request deletion of your personal data.

9.4. Right to restriction of processing

In certain circumstances, you may ask us to temporarily restrict the processing of your data.

9.5. Right to data portability

Where applicable, you may receive the data you provided to us in a structured, commonly used, machine-readable format and transmit those data to another controller.

9.6. Right to object

You may object to processing based on our legitimate interests where applicable grounds exist.

9.7. Right to withdraw consent

Where processing is based on consent, you may withdraw that consent at any time.

9.8. Right to lodge a complaint

If you believe your data are being processed in violation of applicable law, you have the right to lodge a complaint with the competent data-protection supervisory authority.

To exercise any of these rights, contact us at:

support@arooty.com

Before fulfilling a request, we may ask you to verify your identity by reasonable means so that we do not disclose or delete data at the request of an unauthorized person.

10. Children’s data

Arooty is an educational application and may be used by minors.

Arooty is not intended for use by anyone under the age of 16. The product does not currently include a built-in age-verification system, and we rely on users to accurately represent that they meet this minimum age when creating an account.

If the law of your country sets a higher minimum age, or requires the consent of a parent or legal guardian to use an online service at your age, you may only use Arooty with the involvement and consent of a parent or legal guardian, in accordance with that law.

If we become aware that we have collected personal data from a user under 16 without the consent required by applicable law, we will take reasonable steps to delete that data.

11. Data security

We use technical and organizational measures designed to protect personal data against:

  • unauthorized access;
  • accidental loss;
  • unlawful alteration;
  • disclosure;
  • destruction;
  • misuse.

In particular:

  • user passwords are stored as bcrypt hashes;
  • session refresh tokens are stored in hashed form;
  • card payment details are not processed by Arooty’s own servers;
  • infrastructure is hosted by specialized cloud providers;
  • Cloudflare is used for network protection, including DDoS and bot protection;
  • Sentry is used for technical error diagnostics;
  • users can revoke active sessions.

However, no method of transmission or storage can guarantee absolute security.

12. Public user wordsets

User content should not be considered public merely because it was created in Arooty.

If a user explicitly chooses the setting that makes a wordset public, that wordset becomes available to other users through the relevant product functionality.

Before enabling public visibility, make sure the wordset’s title, description, cover image, and other content do not contain information you do not want to disclose to other users.

13. Third-party payment services and app stores

When you purchase a subscription through Paddle, YooKassa, Apple App Store, Google Play, or RuStore, parts of the processing are carried out by the relevant company under its own responsibilities and privacy policy.

In particular, a payment provider or app store may independently determine which billing and payment information it needs to collect to process the transaction, prevent fraud, comply with legal or tax requirements, and issue refunds.

We recommend reviewing the privacy policy of the relevant payment service before making a purchase.

14. Automated decision-making

Based on the information currently provided, Arooty does not use users’ personal data for automated decision-making that produces legal effects or similarly significantly affects users within the meaning of Article 22 GDPR.

Learning algorithms, such as calculating the date of the next spaced-repetition review, are used solely to provide educational functionality.

15. Changes to this Policy

We may update this Privacy Policy from time to time, for example if:

  • Arooty’s functionality changes;
  • new service providers are added;
  • data-processing practices change;
  • new categories of cookies or analytics technologies are introduced;
  • changes in law require an update.

Where changes are material, we will take reasonable steps to inform users in an appropriate manner.

The current version of the Policy will be published on the Arooty website together with its effective date.

16. How to contact us

For questions about this Policy, the processing of personal data, or the exercise of your rights, contact us at:

Email: support@arooty.com

Data controller:
Artem Masoshin PR Beograd

Registered address:
Dechanska 8, sprat 2, Beograd (Stari Grad), Serbia