Picamoi is a mobile app for learning Finnish. This policy explains what
personal data the app collects, why, who we share it with, and the choices and
rights you have. We keep data collection to the minimum needed to run the app.
Data controller: Pohjakoodi (toiminimi), business ID (Y-tunnus)
3636403-3, Finland. Contact:support@pohjakoodi.fi We are established in Finland, so our lead supervisory
authority is the Finnish Data Protection Ombudsman.
This page is available in English, Finnish and Turkish. All
language versions describe the same practices; if you spot a difference between
them, please tell us and we will correct it.
1. Data we collect
Account & sign-in
Device identifier. On first launch the app creates an
anonymous account tied to a random identifier stored on your device. You can
use the app this way without giving us any personal details.
Email address — only if you choose to create or link an
account (by email + password or a one-time sign-in link). We use it to
identify your account and to send you the sign-in link.
Password — if you set one, we store only a salted hash
(bcrypt), never the password itself.
Google sign-in — only if you choose it. Google sends us a
signed identity token for your Google account. It contains your Google
account id and email address, and may also carry your name and profile
picture; of these we use and store only the account id and the email
address, and only to create your account and sign you in. We never receive
your Google password, we do not read anything else in your Google account,
and we do not share this data with third parties.
Learning profile & progress
Your chosen interface/translation language, target level (CEFR), daily
goal, time zone, and the topics you pick.
Your study progress: exercise and exam answers, results, streaks, and
session counts, so the app can track your learning.
YKI writing submissions (AI evaluation)
If you use the optional AI feedback on a YKI writing task, the text you
write is sent to our AI provider (Anthropic) to generate feedback, and we
store the submission and its feedback so you can review it.
Please write practice answers only. These are free-text
fields, so what ends up in them is your choice. Do not include information
you would not want stored: your address or ID numbers, and in particular
data about health, religion or beliefs, ethnic origin, political opinions,
trade union membership, or sex life or sexual orientation (what the GDPR
calls "special categories"). The app repeats this reminder on the writing
screen. We do not ask for such data and do not use it for any purpose; if
you include it anyway, you can have it removed at any time (section 6).
Purchases
If you buy credits, we store the purchase on your account: which credit
pack, how many credits it added, when, and the reference of the store event
it came from. We keep the same record when credits are spent or refunded, so
that your balance can always be explained. We do not receive
or store your card number or billing address — those stay with Google
Play.
Technical
Basic timestamps (account created, last sign-in) and, if you enable
reminders in a future version, a notification token. We do not
use third-party analytics, advertising, or tracking SDKs.
2. How we use your data
To provide the app: save your progress, sync it across sign-ins, and
generate learning feedback.
To sign you in and secure your account.
To operate, debug, and improve the service.
We do not sell your personal data or use it for advertising.
AI writing feedback is automated, and it decides nothing
The score, level estimate and corrections you get on a writing task are
produced automatically by an AI model. They are practice feedback: an estimate
of how your text might be graded, generated to help you study.
They are not an official YKI result, they are not sent to any
authority, and they have no legal effect on you and no comparable significant
effect: they do not decide your access to the app, to a paid feature, to an
exam, or to anything outside the app. Nothing about your account changes based
on the result. If you disagree with a piece of feedback, you can ignore it,
submit again, or email us and a human will look at it.
3. Legal bases (GDPR)
Where the EU General Data Protection Regulation applies, we process your data
on these bases: performance of a contract (providing the app and
your account), your consent (optional features such as AI writing
feedback and reminders, which you can withdraw), and our
legitimate interests (keeping the service secure and reliable).
4. Who we share data with
We use a small number of service providers ("processors") who handle data only
on our instructions:
Neon — database hosting (EU region).
Render — application/server hosting.
Cloudflare — DNS and the network layer in front of our
API. Requests from the app pass through it, so it handles connection data
such as your IP address, and it protects the service against attacks and
abuse.
Sentry — error monitoring, so we learn when the server
breaks. It receives technical crash reports. We have deliberately turned off
the setting that would send request contents, headers or cookies with those
reports.
Anthropic — AI model that generates writing feedback;
receives the writing text you submit for evaluation. Under Anthropic's API
terms and published data-retention policy, API inputs are not used to train
their models, and for the model we use prompts and outputs are not retained
after the response, except where they must keep data to comply with law or
to investigate misuse.
Resend — sends the sign-in email; receives your email
address.
Google Play — app distribution and payments. When you buy
credits, Google Play takes the payment; we never see your card details.
RevenueCat — checks that a purchase made through Google
Play is genuine and tells our server which account to credit. It receives
your account identifier (a random ID, not your name or email address) along
with the purchase itself: which credit pack, when, and whether it was later
refunded. We use it only to add the credits you paid for, and to remove them
again if the purchase is reversed.
5. International transfers
We aim to host data in the EU. Some processors (for example our AI provider)
may process data outside the EU/EEA; where they do, transfers are covered by
appropriate safeguards such as the EU Standard Contractual Clauses. You can ask
us for a copy of the safeguards that apply to a given transfer by emailing
support@pohjakoodi.fi.
6. Data retention
We keep your account and learning data for as long as your account exists.
If you delete your account, we delete your personal data (see section 8).
Sign-in email links expire quickly and are single-use.
YKI writing submissions. The text you submit for AI feedback
and the feedback itself are kept for as long as your account exists, so that you
can look back at earlier submissions and see how your writing has progressed. We
do not delete them on a timer. If you want them removed sooner, you can delete
your account (section 8), or email
support@pohjakoodi.fi and ask us to delete your
writing submissions while keeping the rest of your account.
7. Your rights
Subject to applicable law (including the GDPR), you can request to
access, correct, delete,
export, or restrict/object to the processing of
your personal data, and to withdraw consent at any time. To
exercise these rights, email
support@pohjakoodi.fi, preferably from the email
address on your account so that we can confirm the request is yours. We answer
without undue delay and in any event within one month; if a request is unusually
complex we may extend that by up to two further months and will tell you why
within the first month. Exercising these rights is free of charge. You also have
the right to lodge a complaint with your local data protection authority (in
Finland, the Office of the Data Protection Ombudsman, tietosuoja.fi).
8. Deleting your account
You can permanently delete your account and all associated data at any time:
In the app: open the menu (☰) and choose
“Delete account”, then confirm.
By email: if you can't access the app, write to
support@pohjakoodi.fi from your account email
and ask us to delete your account. We will verify and delete it.
Deletion removes your account and all personal data we hold about you
(profile, progress, and any writing submissions). This cannot be undone.
9. Children
Picamoi is not directed to young children. Where we rely on consent for an
online service, the age at which a child can consent on their own is set by
national law: it is 13 in Finland (Data Protection Act
1050/2018, section 5) and between 13 and 16 elsewhere in the EU. Below that age,
a parent or guardian must consent. We do not knowingly collect data from
children below the applicable age; if you believe a child has given us data,
email support@pohjakoodi.fi and we will delete
it.
10. Security
We use industry-standard measures (encryption in transit, hashed passwords,
access controls). No method of transmission or storage is 100% secure, but we
work to protect your data.
11. Changes to this policy
We may update this policy. Material changes will be reflected by a new
effective date at the top of this page.