Privacy

Playing without an account

Your practice isn't sent to our servers. Your browser keeps a few small notes in its own storage: which words you keep missing, the level you picked, light or dark mode, and how a correct answer moves on. You can clear them any time by clearing this site's data in your browser. Like any website, our host logs each page request, including your IP address (see below).

What we store when you have an account

• Your email address, and your password in scrambled (hashed) form, never as plain text. Our login provider also records sign-in details such as the time of your last sign-in and your IP address.
• If you choose “Continue with Google”: the name, email address and profile picture link that Google shares with us. We never see your Google password.
• Your practice answers: for each answer, which word it was, what you picked, whether it was right, and when. This is what builds your progress page and your “Practise my mistakes” list.
• Your Customized Learning documents: the title, the text read from each document, the suggested topics, and which AI model read it and what that cost, plus your focus list. The original files are deleted straight after reading; if an upload is interrupted, the file is removed the next time you upload or when you delete your account.
• A count of your uploads (who and when), used for the daily limit.
• Login cookies that keep you signed in. There are no analytics, advertising or tracking cookies.

Nobody else can see your answers or your documents. The database only lets each account read its own.

Why we use it

• To provide the app you signed up for: your account, sign-in emails, saved answers, documents and focus list (GDPR Art. 6(1)(b), contract).
• To read a document you upload: it is sent to the AI only when you press “Read”. That is your choice, and you can withdraw it at any time by deleting the document (Art. 6(1)(a), consent).
• To keep the app safe and its costs under control: the upload count and short-lived request and sign-in logs (Art. 6(1)(f), our legitimate interest in preventing abuse).

Services that handle your data for us

• Supabase: accounts, login, the answer database, your Customized Learning documents and, briefly, uploaded files, on servers in Ireland (EU).
• Vercel: hosts the website. The app runs on servers in Dublin, Ireland; each request first passes through Vercel’s nearest edge server, which may be outside the EU. Vercel keeps technical request logs, including IP addresses, for 1 hour.
• Brevo: sends the sign-up confirmation and password-reset emails, so it sees your email address.
• Google: only if you choose “Continue with Google”, to sign you in.
• OpenRouter and Google Gemini: documents you upload to Customized Learning are sent through OpenRouter to Google’s Gemini AI model, which reads them and suggests topics. We ask OpenRouter to use only providers that keep no copy of your document (“zero data retention”), so it isn’t stored or used to train AI. Don’t upload documents with personal details.

OpenRouter is a US company, and OpenRouter and Google may process uploaded documents outside the EU (in the USA). OpenRouter protects the transfer with the European Commission’s standard contractual clauses (GDPR Art. 46).

Keeping and deleting your data

Uploaded files are deleted straight after reading. Upload counts older than 2 days are cleared out the next time anyone uploads. Everything else is kept for as long as you have an account. You can delete your account at any time on the Account page: this immediately and permanently removes your account, every answer you saved, your Customized Learning documents and focus list. Copies in our providers’ technical logs (request, sign-in and email logs) expire on those providers’ own schedules.

Your rights and contact

Under EU data protection law (GDPR) you can ask to see, correct or delete the data we hold about you, get a copy to take elsewhere, ask us to limit or stop using it, and withdraw your consent at any time. You can download your data and delete your account yourself on the Account page. For anything else, write to egle.pauk.ai@gmail.com; we reply within one month. You can also complain to your national data protection authority.