Privacy Policy

1. Who is responsible

The controller of your personal data is the operator of TheLernen named in our Impressum (thelernen.org/impressum), established in Poland. For any question about your data, or to exercise your rights, write to support@thelernen.org.

2. What data we process

Depending on how you use TheLernen:

• Learning without an account: a random session ID and device ID (stored in your browser and in our database), your learning progress and settings, and — if you set them — a nickname and avatar, plus streaks, Lerns, berries and shop items.
• With an account: your email address and a password stored only as a hash by Supabase Auth, or, if you sign in with Google, the email address and name Google shares with us. We also store your interface language so that emails reach you in it.
• What you enter: words and sentences you send to AI features, your texts in Writing Practice and AI conversations, your own decks and cards, posts on the feedback board, and messages to support. Deck files you import (for example from Anki) are read in your browser; only the text of the cards is sent to us — images and audio are not uploaded.
• Voice: speaking exercises use your browser's built-in speech recognition. Some browsers (for example Chrome and Edge) send the audio to their maker's servers to recognise it; TheLernen itself receives only the recognised text, never the recording. The microphone is used only while you press the microphone button.
• Payments: from Lemon Squeezy we receive your subscription status, plan, renewal date, customer ID and email address — never card details.
• Technical data: IP address, browser type and the pages you request (server logs), and crash reports from your browser.
• Only with your consent: analytics (PostHog, Google Analytics) and the Meta pixel — see section 4 and our Cookie Policy.
• Newsletter: your email address, if you subscribe on the blog.

3. Why we process it, and on what legal basis

Each purpose rests on one legal basis under Article 6 of the GDPR:

• Providing the service — your account, saving and syncing progress, the review schedule, leaderboard and friends, the AI features you use, PRO access: performance of our contract with you (Art. 6(1)(b)).
• Security, abuse prevention, fair-use limits, server logs and crash reports: our legitimate interest in a working, secure service (Art. 6(1)(f)).
• Streak reminders and the weekly summary email: our legitimate interest in helping you keep learning (Art. 6(1)(f)). You can object at any time — switch them off in Profile → Settings or with one click in any email.
• Analytics, the Meta pixel and personalised advertising: your consent (Art. 6(1)(a)), which you can withdraw at any time.
• Non-personalised advertising on public pages: our legitimate interest in funding the free content (Art. 6(1)(f)).
• Payment and accounting records: our contract with you and our legal obligations (Art. 6(1)(b) and (c)).
• Newsletter: your consent (Art. 6(1)(a)).

4. Who receives your data

We never sell or rent personal data. Other learners see your nickname, avatar, level and Lerns, streak and PRO badge on the leaderboard, in friend search and in friend lists, and posts you publish on the feedback board. Beyond that, these providers process data for us:

• Vercel Inc. (USA): hosts the website and processes every request (IP address, browser, requested page).
• Supabase Inc.: database and sign-in, on servers in the EU (Frankfurt, Germany). Stores your account, email, password hash, progress and settings.
• Cloudflare Inc. (USA): DNS for our domain and the anti-bot check on the sign-up form (Turnstile), which sees your IP address and browser. The site itself is not routed through Cloudflare.
• Sentry (Functional Software Inc., USA): crash reports from your browser — the error, the page and the browser type, with personal data collection switched off and no session recording.
• Resend (USA): sends our emails (reminders, weekly summary, replies to support). Receives your email address and the email content.
• Google Gemini API (USA): powers word explanations, examples, sentence and pronunciation checks and AI conversations, and receives the text you send to these features. We use Google's free API tier, under whose terms Google may use submitted content to improve its services and human reviewers may read it — please do not enter personal or sensitive information in AI features. See ai.google.dev/gemini-api/terms.
• Anthropic PBC (USA): produces the feedback in Writing Practice and receives the task and the text you wrote. See anthropic.com/legal/privacy.
• PostHog (EU servers): product analytics — loaded only after you choose "Accept all" in the cookie banner.
• Google Analytics and Google Tag Manager: traffic statistics — loaded only after you choose "Accept all".
• Meta Platforms (Facebook pixel): measures our marketing campaigns — loaded only after you choose "Accept all".
• Google AdSense: shows ads on public pages (blog, guides, course, level, topic and some dictionary pages), never inside the learning app and never to PRO subscribers. In the EU/EEA, the UK and Switzerland, Google first asks for consent through its own message and shows personalised ads only if you agree; otherwise non-personalised or limited ads. Personalised advertising can be turned off at adssettings.google.com.
• Lemon Squeezy LLC (USA): sells PRO as Merchant of Record and processes payments. For the purchase it is an independent controller under its own privacy policy (lemonsqueezy.com/privacy).

5. Transfers outside the EU

Several providers are based in the USA. Transfers rely on the EU Standard Contractual Clauses and, where the provider is certified, on the EU–US Data Privacy Framework.

6. Emails we send

Which emails you can receive, and how to stop them:

• Account emails (address confirmation, password reset): needed to run your account.
• Streak reminder: on days when you used TheLernen yesterday but not yet today, in the evening (around 17:00 UTC), never on Mondays.
• Weekly summary: on Mondays, if you were active in the last 30 days.
• Reminders and the weekly summary are on by default for accounts with an email address and come in your interface language. They contain no advertising. Switch them off in Profile → Settings → Account & sync → Email reminders, or with the one-click unsubscribe link in any of them.
• Payment emails are sent by Lemon Squeezy; replies to your support messages come from us.
• Newsletter: only if you subscribed on the blog. Every newsletter will carry an unsubscribe link.

7. How long we keep data

• Account and learning data: until you delete your account. Deleting it in Settings is immediate and removes your email address, progress and account data.
• Learning without an account: kept until you delete it (Profile → Settings → "Delete my account" also works without an account). We do not currently delete inactive guest data automatically.
• Payment and account audit records: as long as accounting, tax and dispute rules require (generally up to 5 years under Polish law). After you delete your account they are no longer linked to you.
• Server logs: a short time, as kept by our hosting provider.
• Crash reports: for the retention period of our Sentry plan.
• Analytics (only with consent): up to 12 months.
• Support messages and feedback posts: as long as needed to handle them; on request we delete them.
• Newsletter address: until you unsubscribe.
• AI response cache: stores AI answers by the requested word or sentence, not linked to you.
• Browser storage: until you clear it (Profile → Settings → "Clear app cache & reload").

8. Your rights

You have the right to access your data, correct it, delete it, restrict or object to its processing (including the reminder emails and anything based on legitimate interest), receive it in a portable format, and withdraw any consent at any time. Most of this works directly in the app: export your progress as JSON and delete your account under Profile → Settings; "Clear app cache & reload" there brings the cookie banner back. For anything else, write to support@thelernen.org — we answer within one month. You can also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or with the authority of the EU country where you live or work. We do not make automated decisions that have legal or similarly significant effects on you.

9. Children

TheLernen is for people aged 13 and over. If you are under 16 — the age of digital consent in Germany, Poland and several other EU countries — a parent or guardian must agree to your use of TheLernen and make the cookie choices for you. If we learn that a child under 13 has an account, we delete it. Parents can contact us at support@thelernen.org.

10. Security

Connections are encrypted (HTTPS), passwords are stored only as hashes, and card details never reach our servers. No system is completely secure; if a breach affects your data, we will inform you and the supervisory authority as the law requires.

11. Cookies and browser storage

What TheLernen stores in your browser, and which parts need your consent, is described in our Cookie Policy (thelernen.org/cookies).

12. Changes

When we change this policy, we update the date at the top. If a change affects how we use data you have already given us, we tell you in the app or by email before it takes effect.

13. Contact

support@thelernen.org. Operator details: thelernen.org/impressum.