Privacy policy

1. Who is responsible?

The controller is:

We are not required to appoint a data protection officer (Art. 37 GDPR, § 38 BDSG): fewer than 20 people are regularly involved in the automated processing of personal data.

2. In short

• We use no analytics, advertising or tracking tools and no tracking cookies.
• We only use cookies that are technically necessary – for signing in and for remembering your chosen course.
• We do not sell personal data and do not use it for advertising.
• Your account and learning data are stored in a database in Frankfurt (EU).

3. Visiting the website (server logs)

When you open a page, your browser sends technical data to our hosting provider Vercel: IP address, date and time, the page requested, the referring page, browser and operating system. We need this data to deliver the website, keep it secure and fix errors. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). On our plan (Vercel Pro, without extended log retention) these logs are kept for one day (Vercel documentation on log retention); after that they are no longer available to us.

4. Cookies and local storage – why there is no cookie banner

The public pages of this website (home page, course pages, guides, legal pages) set no cookies. In the app, and when you sign in, we store only the following on your device:

All of these are strictly necessary to provide the service you have asked for: without them you could not stay signed in, switch between your courses, keep your display settings or use the app offline. Storing such information does not require consent (§ 25(2) no. 2 TDDDG in Germany, Art. 5(3) of the ePrivacy Directive, and regulation 6(4)(b) of the Privacy and Electronic Communications Regulations 2003 in the UK). We do not use analytics, marketing or other non-essential cookies or similar technologies, so we do not need to ask for consent and there is no cookie banner. If that ever changes, we will ask for your consent before anything non-essential is stored. The processing of the sign-in data itself is based on Art. 6(1)(b) GDPR (contract).

5. Your account

To use the app you create an account with your name, email address and a password, or with “Sign in with Google”. We send you a link to confirm your email address. Passwords are stored only as a salted hash. Sessions are stored without your IP address or browser details. To protect sign-in and registration against abuse, we count attempts per IP address for a short period (rate limiting). Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in secure accounts (Art. 6(1)(f) GDPR).

Sign in with Google. If you choose it, you are redirected to Google (Google Ireland Limited; for users in the UK, Google LLC). We ask only for the standard permissions “openid”, “email” and “profile”. Google then tells us your Google account ID, your name, your email address and whether it is verified, and a link to your profile picture. We store the Google account ID with your account; if the account is newly created through Google, we also take over your name, email address and the picture link. We do not store Google access tokens and do not use any other Google services. If an account with the same confirmed email address already exists, the Google sign-in is linked to it. Google’s own privacy policy applies to the sign-in at Google.

6. Learning data

The app stores your answers, review schedule, error log, progress per subject, settings and any reports you send about a question. This is necessary to provide the adaptive practice you have bought (Art. 6(1)(b) GDPR). The review schedule is calculated automatically; it only decides when a question is shown again and has no legal or similarly significant effect on you (no automated decision-making within the meaning of Art. 22 GDPR).

We use reports, and learning data in aggregated form, to find and correct faulty questions and to improve the course (Art. 6(1)(f) GDPR).

7. Purchases and payment

When you buy a course, we pass your email address (to prefill the checkout), your internal account ID and the course to Stripe. Card and bank details go directly to Stripe; we never receive them. From Stripe we receive the payment status and a payment reference. We store the course, the date of purchase, your access period and the payment reference.

Before payment you agree to immediate access and confirm that you lose your right of withdrawal once access has begun. We store this declaration with its wording version and a timestamp as proof (Art. 6(1)(c) and (f) GDPR; how long: section 11).

Withdrawing from a contract. You can use “Withdraw from contract here” (/withdraw) without signing in. We store your name, the email address for the confirmation, what you tell us about the contract (if you are signed in: the purchase you choose, with course, date of purchase and payment reference, and your account ID), the date and time we received your withdrawal, and how we dealt with it. We use this data to process your withdrawal, to send you the acknowledgement of receipt required by law (§ 356a BGB) and to be able to prove both later. To find the purchase, we may compare the email address you give with our customer accounts; the result is only visible to us. To protect the form against abuse we use a hidden field and the time the form was open, and we count submissions per IP address for one hour in the server’s memory only – IP addresses are not stored. Legal basis: our legal obligations (Art. 6(1)(c) GDPR) and our legitimate interest in establishing, exercising or defending legal claims and in protecting the form (Art. 6(1)(f) GDPR). How long we keep it: section 11.

Stripe Managed Payments. We sell our courses through Stripe Managed Payments; the checkout shows the purchase as “Sold through Link”. The service is provided by Stripe’s affiliate Sold through Link, LLC, which is the merchant of record for these transactions: it charges your payment method, calculates and pays the sales tax (such as VAT), sends you the receipt and invoice, and handles transaction support, refunds and payment disputes (Stripe Managed Payments terms, “Sold through Link” terms). The data you enter in the checkout (for example name, email address, billing address and payment details) is processed by Stripe and Link for these purposes as separate controllers under their own privacy policies (Stripe privacy policy, Link privacy policy). According to Stripe, it acts as merchant of record on our behalf and shares your order information with us so that we can fulfil your order (Stripe Privacy Center, “What is ‘Sold through Link’?”). You can contact Stripe’s data protection officer at dpo@stripe.com.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legal obligations to keep accounting records (Art. 6(1)(c) GDPR).

8. Emails and reminders

We send emails through Resend from its EU region (Ireland). Emails needed for your account and purchases – confirming your address, resetting your password, confirming a purchase – are part of the contract (Art. 6(1)(b) GDPR); the acknowledgement of a withdrawal is required by law (Art. 6(1)(c) GDPR). Study reminders by email or push notification are sent only if you switch them on, and you can switch them off at any time in the settings (Art. 6(1)(a) GDPR). Push notifications are delivered through the push service of your browser’s provider.

9. Contacting us (email and contact form)

You can contact us by email or with the contact form. The form asks for your email address and your message; your name is optional. When you send it, we receive these details together with the time of sending. The form is delivered to our mailbox as an email through our email service provider Resend (EU region, Ireland), with your address set as the reply address so that we can answer you directly. Our mailbox is hosted by Microsoft (Outlook.com; Microsoft Ireland Operations Limited). The form stores nothing in our database and sets no cookies; to keep out spam it uses a hidden field that people leave empty and the time at which the form was opened.

We use your details only to answer your message. Legal basis: Art. 6(1)(b) GDPR where your message concerns a contract with us or steps before one (for example a question about buying a course), otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We delete messages once the matter is closed, unless we must keep them by law (for example as business correspondence).

10. Service providers and transfers outside the EU

We use the following providers. Where they process data on our behalf, we have data processing agreements with them (Art. 28 GDPR).

Some providers are based in the USA. All of them are certified under the EU–US Data Privacy Framework and its UK Extension (Art. 45 GDPR); Vercel and Resend also use the European Commission’s Standard Contractual Clauses (Art. 46 GDPR). You can check the certifications in the Data Privacy Framework list.

11. How long we keep data

• Server logs: see section 3.
• Sign-in sessions: up to 30 days after your last activity, or until you sign out.
• Account and learning data: while your account exists. You can delete your account at any time in the account settings of the app; this deletes your learning data, access rights and sessions. Reports you sent about questions are kept without any link to you.
• Purchase consents and withdrawals: kept after you delete your account, because we may need them to establish, exercise or defend legal claims (Art. 17(3)(e) GDPR) – until the end of the third year after the year in which you gave the consent or sent the withdrawal (regular limitation period, §§ 195 and 199 BGB). Withdrawals sent without signing in are kept for the same period. They are then deleted automatically.
• Records we must keep by law: for the periods required by German tax and commercial law (§ 147 AO, § 257 HGB) – 8 years for accounting vouchers such as payment and payout records, 10 years for books and records, 6 years for business correspondence. Stripe and Link keep their own payment records under their own obligations.

12. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict processing, to data portability and to withdraw consent at any time with effect for the future (Art. 15–20 and 7(3) GDPR). You can download your data (account, course access, consents, withdrawals sent while signed in and learning progress) as a JSON file in the app under Account → “Download my data”; for withdrawals sent without signing in, or any other request, email marc.cherier@outlook.de.

Right to object: where we process data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You can also complain to a supervisory authority, for example in the country where you live. The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI), Alt-Moabit 59–61, 10555 Berlin. In the United Kingdom, the authority is the Information Commissioner’s Office (ICO).

13. Changes

We update this policy when our services or the law change. The current version is always available on this page; see also our terms and conditions.