Privacy

Data controller

The data controller is the individual identified in the legal notice, who determines the purposes and means of processing and is the point of contact for any question concerning it. Correspondence sent to avc.lleida@gmail.com reaches that person directly.

Read the legal notice

Personal data processed

• Account data: your email address, your name, your timezone and, where you registered with a password, a cryptographic hash of that password. The password itself is never stored.
• Where you signed in with Google: the profile image URL provided by Google. It is stored but is not displayed anywhere in the application.
• Preferences: your reading levels, the topics and musical genres you selected, artists marked as favourites or excluded, the number of tasks constituting a completed day, and your light or dark theme setting.
• Activity records: the days you completed and when, the suggestions shown to you or skipped, and items saved for later.
• Vocabulary: the words you saved and the translations you recorded for them.
• Content you create: text written in exercises and any voice recordings you made.

No payment details are processed, as the service is provided without charge. No advertising and no profiling of any kind are used. Analytics are used only where you have agreed to them, and are described under Cookies below.

Legal basis for processing

Processing is necessary for the performance of the contract between you and the controller, under article 6(1)(b) of the GDPR: an account is required to record your progress, and your preferences are required to select what is suggested to you. Your email address is additionally processed to verify that the address belongs to you, which prevents registration in your name by a third party.

Recipients

Your data is disclosed to the following recipients and to no others:

• Mailgun receives your email address for the sole purpose of delivering the message that verifies it. No other data is transmitted to them.
• Google Cloud Translation receives the German text you submit for translation: a word from your vocabulary list, or a title. It does not receive your name, your email address or any other identifying information. Where that service is unavailable, MyMemory is used as a fallback and receives the same text on the same terms.
• Google receives the fact of your authentication, where you chose to sign in with Google. Where you registered with a password, Google is not involved at any point.
• The publisher of any item you open. Each suggestion is a link to a newspaper, broadcaster or YouTube, and following it constitutes an ordinary visit to that publisher's site, on which they receive the same information as from any other visitor. Two sources are displayed within this site in an embedded frame; those sources set their own cookies, which the controller can neither read nor prevent.
• Google Analytics, but only if you agreed to it, and only then. It receives the pages you open and the ordinary technical details of a web request. It does not receive your name, your email address or anything you have written or saved.

That list is exhaustive. Your data is not sold, and no information concerning you is transmitted to any party for advertising purposes.

Cookies

Two cookies are strictly necessary and are always set. The first maintains your signed-in session. The second expires after ten minutes and exists solely so that authentication with Google can determine whether you intended to create an account or to access an existing one. Neither is used to track you.

A third is set only if you agree to it. Google Analytics is asked for on your first visit and is not loaded at all unless you say yes, so nothing reaches Google before you answer. You may change your mind at any time using the Cookies link in the footer, which deletes the cookie it set.

Retention

Your data is retained until you delete it. No record expires automatically: a vocabulary list created in January remains available in December, which is the purpose of keeping it. Deleting your account erases all of it at once.

One category is retained beyond account deletion, and is disclosed here for transparency. Where text is translated, the translation is stored so that the same text need not be translated, and paid for, more than once. Those records contain the text alone: no account identifier, no name, no list and no reference to the person who requested it. They cannot be attributed to you, which is why account deletion does not remove them.

Your rights

Under the GDPR you hold the following rights, none of which is subject to a charge:

• Access: to obtain a copy of the data held about you. Most of it is visible in the application; the remainder will be provided on request.
• Rectification: to have inaccurate data corrected. Your name and timezone may be amended in Settings; any other correction will be made on request.
• Erasure: no request is necessary. Settings, then Account, then Delete your account. Deletion is immediate and no copy is retained.
• Portability: to receive your data in a structured, machine-readable format, on request.
• Objection and restriction: to object to the processing described here, or to request that it be restricted.
• Complaint: you may lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (aepd.es), or with the supervisory authority of your country of residence. You are encouraged to raise the matter first at avc.lleida@gmail.com.

Security

The site is served exclusively over HTTPS. Passwords are stored as bcrypt hashes and cannot be recovered, by the controller or by anyone else. The database is not reachable from the internet, and the component of the application holding your data is not addressable from a browser. Backups are taken daily and retained for no longer than fourteen days.

Minimum age

This service is not directed at children. Spanish law requires a minimum age of 14 to consent to the processing of personal data by a service of this kind. If you are under that age, please do not create an account.

Changes to this notice

Any amendment to this notice will be reflected in the date shown above. Material changes, such as a new recipient of your data or a new purpose for processing it, will be notified to you by email rather than left for you to discover here.