Privacy Policy

1. What data we process

We process the following data:

• account data, i.e. the e-mail address and password. The password is stored solely as a secure cryptographic hash;
• data on the use of the application, such as learning progress, settings and your own word sets;
• Premium data, such as status and access period, received in connection with payment handling by Paddle;
• technical data, such as IP address and browser type, recorded in server logs and used, among other things, to ensure security and detect abuse.

We do not store payment card data. Data needed for payment is transferred directly to Paddle.

2. Controller and contact

The controller of personal data is Marcel Plona, operating under the name “Chompiko”.

Correspondence address: ul. Bema 6/21, 18-300 Zambrów, Poland

E-mail: [email protected]

Phone: +48 888 035 111

The rules for using the Service are set out in the separate Terms of Service.

3. Purposes and legal bases

We process data for the following purposes:

• creating and operating the user account and performing the contract, under Article 6(1)(b) GDPR;
• providing and handling Premium access, under Article 6(1)(b) GDPR;
• ensuring the security of the Service, preventing abuse and protecting against unauthorized access, under Article 6(1)(f) GDPR;
• keeping statistics on the use of the Service and improving it, under Article 6(1)(f) GDPR.

Providing an e-mail address and password is necessary to create an account. Not providing this data makes it impossible to use features that require signing in.

Full text of the regulation: Regulation (EU) 2016/679 (GDPR).

4. Cookies and local data

We use only the cookies necessary for the Service to work properly, in particular to keep you signed in. We do not use advertising cookies or cookies for tracking users.

The application may also store data locally in the browser, in particular learning settings and materials downloaded for offline mode. Data stored locally is not transferred to our server unless the user uses a feature that requires synchronization.

5. Visit statistics

To analyze the use of the Service we use Umami, an analytics tool designed with privacy in mind.

Umami does not use cookies to analyze visits. Depending on the configuration, information such as the number of visits, pages visited, approximate location and device type may be processed. We use this data solely to analyze how the Service functions, how popular its features are, and to improve it.

6. E-mail messages

We use the e-mail address solely in connection with the operation of the account and the provision of services. This includes in particular messages concerning the account, security, payments, Premium and material changes to the Service.

We do not send marketing messages without the consent required by law.

7. Who we share data with

We share data only with entities whose involvement is needed for the Service to work:

• Paddle.com Market Ltd, which as Merchant of Record handles Premium sales, payments and related settlements. Paddle is a separate controller of the data it processes on its own account;
• Railway Corp. (USA), which provides hosting for the Service, its database and the visit statistics tool;
• Cloudflare, Inc. (USA), which stores and delivers the Service's media files, such as images and pronunciation recordings. When these files are loaded, it processes technical data such as the IP address;
• Resend (Plus Five Five, Inc., USA), which sends the Service's emails, such as email address confirmations and password setup links;
• public authorities, where the obligation to transfer data results from the law.

Where a transfer of data outside the European Economic Area is required in connection with the use of our providers' services, it takes place on the basis of standard contractual clauses approved by the European Commission or another equivalent mechanism provided for in the GDPR.

Paddle, as Merchant of Record, processes buyers' data in accordance with its own privacy policy.

8. Retention period

We keep account data until the account is deleted, unless further storage is required by law or necessary to establish, exercise or defend legal claims.

We keep Premium and payment data for the period necessary to operate the account, handle settlements and fulfil legal obligations.

We keep technical data for the period necessary to ensure the security of the Service and detect abuse, but no longer than is necessary for those purposes.

9. Your rights

Under the GDPR you have the right to:

• access your data;
• rectify your data;
• erase your data;
• restrict processing;
• data portability;
• object to processing based on the controller's legitimate interest.

You may also request erasure of your data, except where further storage is required by law or necessary to establish, exercise or defend legal claims.

You also have the right to lodge a complaint with the competent supervisory authority, in Poland this is the President of the Personal Data Protection Office. If you live in another EU country, you may contact the supervisory authority competent for your place of residence.

To exercise your rights, write to [email protected]. We respond without undue delay, as a rule within one month of receiving the request.

10. Data security

The connection to the Service is encrypted with HTTPS. Passwords are stored solely as secure cryptographic hashes. Access to data and infrastructure is limited to what is necessary for the Service to work properly.

11. Age of users

The Service may be used by a person of any age. For minors, the parent or legal guardian is responsible for the use of the Service.

12. Changes to the Privacy Policy

We inform users of material changes to the Privacy Policy through the Service or by e-mail.