Privacy Policy

1. Information We Collect

When you use TheLernen, we only collect essential data necessary to provide and improve the language learning experience:

• Account Details: If you create an account, we store your email address via Supabase Auth to secure your progress.
• Study Statistics: We save your study progress, including words studied, ratings (Again, Hard, Know, Easy), review intervals, and quiz history to calculate your spaced repetition schedule.
• Usage Logs: Standard anonymous metadata (such as browser type and language preference) is collected to ensure responsive performance across all viewports.

2. How We Use Your Information

We strictly use your personal data for operational purposes:

• To personalize and sync your language study progress across all devices.
• To run our spacing algorithm (SM-2) to tell you when words are due for review.
• To monitor application speed and protect the servers from abuse.

3. Data Security and Third Parties

We implement industry-standard database safeguards. We never sell or rent your personal data. Some pages carry advertising, and the ad network sets its own cookies — that is described below. We work with these providers:

• Vercel Inc. (USA): Hosts the application and processes every page request. Sees IP address, user agent, and request paths for ~30 days in operational logs. Bound by Vercel's Data Processing Addendum (EU Standard Contractual Clauses).
• Cloudflare Inc. (USA): Provides DNS, CDN, DDoS protection, and CAPTCHA (Turnstile). Sees IP address, user agent, and page paths. EU SCC + GDPR addendum in place.
• Supabase (EU region): Secure cloud hosting and password-encrypted database structures. Stores your email, encrypted password hash, study progress, and account metadata.
• Google Gemini API: Words are parsed and explained by serverless AI triggers. Google API terms state that prompt data sent through their developer APIs is not used for model training.
• PostHog (EU servers, GDPR-compliant): Anonymously measures which features help you learn most. Loaded only after you click "Accept all" in the cookie banner. Sets a first-party anonymous ID.
• Google Analytics and Google Tag Manager: Measure aggregate traffic (pages viewed, referrer, approximate region). These run in Google Consent Mode v2 with storage denied by default, so no analytics or advertising cookies are set until you choose "Accept all"; before that Google receives only a cookieless signal containing your IP address and the page URL.
• Lemon Squeezy (only for PRO subscribers): Acts as our Merchant of Record. Receives your email, billing country, and payment details to process subscription payments and issue VAT-compliant invoices. See Section 4 below.
• Meta / Facebook (only after "Accept all" consent): A small pixel measures conversion from our marketing campaigns. Sets cookies on the facebook.com domain. Loaded only after you accept analytics cookies.
• Google AdSense: Advertising is shown on our blog, guides and course landing pages (never inside the learning app itself). Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this and other websites. You can opt out of personalised advertising in Google Ads Settings (adssettings.google.com), or opt out of third-party vendor cookies at www.aboutads.info/choices. Where consent is required, these cookies are set only after you choose "Accept all" in the cookie banner.

4. Payment Data

If you upgrade to PRO, the following payment-related data is handled outside our database by Lemon Squeezy LLC (USA), our Merchant of Record:

• What we receive from Lemon Squeezy: subscription status (active / cancelled), plan type, renewal date, and a customer ID. We use this to grant PRO access and show your renewal status.
• What we DO NOT receive or store: your full card number, CVV, or expiration date. These never touch our servers.
• Retention: Subscription status data is kept for as long as your account is active plus 3 years for tax/accounting compliance (EU requirement). After that, it is anonymised or deleted.
• For Lemon Squeezy's own privacy practices, see https://www.lemonsqueezy.com/privacy.

5. Data Retention

We follow GDPR Art. 5(e) storage limitation — data is kept only as long as needed for its purpose:

• Account data (email, password hash, study progress, achievements): kept while your account is active, plus 30 days after deletion for technical cleanup.
• Server operational logs (Vercel): ~30 days, automatic rotation. Used for debugging and abuse detection.
• PostHog analytics (only with "Accept all" consent): up to 12 months. You can opt out anytime by clearing the dl_consent cookie.
• Webhook events and account audit log: 3 years after the event, as required by EU tax/accounting law (HGB §257, similar in PL/UA). After account deletion the personal link is severed (user_id set to NULL).
• AI response cache: indefinite — entries contain only the AI output, no personal data.
• Browser storage (localStorage cookies): kept until you clear it or use App Settings → Clear app cache.

6. Your Rights and Deletion

You have full ownership of your data. Under GDPR you have the right to access, correct, export, or delete your personal data. You can delete your account at any time — this instantly and permanently wipes your email address and all associated study progress from our database. To delete your progress or download your data backup, visit the App Settings page. Note: invoices and payment records may be retained for up to 3 years to comply with EU tax law, even after account deletion.

7. Contact Us

If you have any questions about this Privacy Policy or data security, feel free to contact us via the open feedback form or by email at: support@thelernen.org