Privacy Policy

Controller

Pay Philipp Symicek
Am Mühlbergholz 23
38690, Goslar, Germany
Email:

What we process, and why

Account data

Email address and password (stored as a salted hash, never in plain text) when you sign up. Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR). Kept until you ask us to delete your account. Providing an email and password is required to create an account — without them, the service can't be used.

Sign-in cookies

A short-lived access token and an httpOnly refresh-token cookie keep you signed in. These are strictly necessary for the service to work, so no cookie-consent banner applies (Section 25(2) TDDDG). Legal basis: Art. 6(1)(b) GDPR. The refresh cookie expires automatically.

Learning progress

Lesson completion, spaced-repetition review state, XP, and streak data, tied to your account, so the app can schedule reviews and show your progress. Legal basis: Art. 6(1)(b) GDPR. Kept until account deletion.

Server logs

The hosting infrastructure keeps standard technical access logs (IP address, timestamp, requested URL) for a limited period to keep the service secure and investigate abuse. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

What we don't do

No analytics, advertising, or third-party tracking scripts run on this site today. No data is sold or used for advertising. If that ever changes, this page will be updated first.

Hosting

The app runs on a single server operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in a data centre in Germany, acting as a processor under Art. 28 GDPR. No other third party receives your data.

International transfers

All processing happens within the EU/EEA. No data is transferred to, or processed in, a country outside the EU/EEA. If that ever changes, this page will be updated first and, where the destination doesn't have an adequacy decision, only with appropriate safeguards (e.g. Standard Contractual Clauses) in place.

Your rights

Under the GDPR you have the right to access, correct, delete, or export your data, and to restrict or object to its processing. To exercise any of these, email the address above — there is no self-service account deletion yet. You may also lodge a complaint with your local data protection supervisory authority.

Automated decisions

The spaced-repetition schedule adjusts automatically based on your answers, but it only affects when a review is shown to you — it has no legal or similarly significant effect and involves no profiling under Art. 22 GDPR.

PolarLingo is a pre-launch personal project.