Your data, in plain words.

The short version

• You can learn without an account. Then your progress stays in your browser. We only receive what any website needs to load a page, error reports when the app breaks, and the question reports you choose to send.
• With an account we store your email, a scrambled form of your password and your progress, so it can follow you to other devices.
• No ads, no analytics, no tracking, no third-party cookies. We never sell or share your data for marketing.
• You can download everything your account holds, or delete it, from the Account page at any time.

Who is responsible

The controller under the General Data Protection Regulation (GDPR) is:

For anything about your data, write to hello@languvia.app.

Visiting the site

The app is hosted by Vercel Inc. (USA). Our server functions run in Frankfurt, Germany, and static files are delivered from Vercel’s network of servers worldwide, usually the one nearest to you. To deliver a page, Vercel processes your IP address, the address of the page, the time, and the browser information your browser sends. Vercel keeps these request logs for a short time for operation and security. Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).

Fonts and pronunciation recordings come from our own site, not from other services. If a recording can’t be played, the app falls back to your browser’s built-in German voice. Some browsers, such as Chrome with its “Google” voices, send that text (a sentence from the course) to the browser maker’s servers to speak it.

What is stored in your browser

Your progress (words, reviews, points, settings), a list of reports waiting to be sent while you are offline, sync status and whether you closed a notice are kept in your browser’s local storage. A service worker keeps a copy of the app so it works offline. Signed-in users also get one cookie, pl_session, which keeps you logged in until 30 days after your last visit.

All of this is needed for the service you asked for, so it needs no consent (§ 25(2) no. 2 TDDDG). None of it is used to track you. It stays until you reset the app in Settings, log out, or clear your browser’s data for this site.

Your account

Accounts are for people aged 16 or older. When you sign up we store:

• your email address;
• your password, only as a salted scrypt hash, which can’t be turned back into the password;
• when you signed up, last logged in and confirmed your email address;
• for each device you are logged in on, when the session started, when it was last used and when it ends;
• your synced progress and settings.

We use this to provide your account and keep your progress in sync (Art. 6(1)(b) GDPR). The database runs on Railway (Railway Corp., USA), on servers in the Netherlands.

Your data is kept until you delete your account. Logged-out and expired sessions are removed within a day. Our backups cover the last seven days, so after you delete your account its data is gone from them within about a week.

Emails we send you

We only email you about your account: once after you sign up, to confirm your address, and when you ask to reset your password. No newsletters or marketing. Resend (Resend, USA) delivers these emails for us, so it receives your email address and the message. Each email holds a link; we keep only a scrambled form of it, for a week (confirmation) or an hour (password reset), and delete it once it is used or expired. Legal basis: providing your account (Art. 6(1)(b) GDPR).

Reporting a question

When you report a question, we store the question, your answer, the category you chose, your optional comment, the page and the app version, and, if you are signed in, a link to your account so you can follow the report. We use it to fix the course (Art. 6(1)(f) GDPR). Please don’t put personal details in comments.

A report is deleted 12 months after it is resolved. If you delete your account, your reports lose the link to it and your comments, and only the question and your answer are kept until then.

Protection against abuse

To stop password guessing, mass sign-ups and spam, we count requests per IP address and, for logins and password resets, per email address. These counters are deleted within two days (Art. 6(1)(f) GDPR).

Error reports

When something breaks in the app or on the server, we store the error message, where it happened, the page address without anything after the “?”, the app version and how often it happened. No IP address, account or device identifier is stored with it. Entries are deleted 14 days after the error was last seen. When a new kind of error appears, we send ourselves an email about it through Resend (Resend, USA). Legal basis: our legitimate interest in a working app (Art. 6(1)(f) GDPR).

Service providers and transfers outside the EU

Vercel (hosting), Railway (database and backups) and Resend (email) process data only on our behalf, under data processing agreements (Art. 28 GDPR). They are based in the USA, so data may be accessed from there. Vercel and Resend are certified under the EU–US Data Privacy Framework (Art. 45 GDPR). For Railway, and in addition for the others, transfers rely on the EU Standard Contractual Clauses in each provider’s agreement (Art. 46 GDPR).

Your rights

You have the right to:

• get a copy of your data (Art. 15) and take it elsewhere (Art. 20): use “Download my data” on the Account page;
• have your data deleted (Art. 17): use “Delete account” on the Account page;
• have wrong data corrected (Art. 16) or its use restricted (Art. 18);
• object to uses based on our legitimate interest (Art. 21);
• complain to a data protection authority (Art. 77), for example the one where you live, or ours: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach (www.lda.bayern.de).

For anything you can’t do in the app, email hello@languvia.app.

We make no automated decisions about you and build no profiles.

Changes

We update this page when the app changes how it handles data. The date at the top shows the latest version.