Privacy

This is a translation of the German text. The German text is the binding one.

Welcome to WieGesagt. Behind the project is one person, Martin Purgat. Where “I” appears here, I mean exactly this person, the one responsible. I am committed to protecting your personal data and your right to privacy. This policy describes how I collect, use, disclose and protect your data when you use my language learning platform.

If you have any questions or concerns about this policy, write to me at [email protected].

2.1  Provided by you

I collect the following personal data, which you provide voluntarily when you:

• register an account: email address, username, password (encrypted)
• use my services: audio files, subtitle files, uploaded content
• save words: words, translations, context, timestamps
• contact me: name, email, message content

2.2  Collected automatically

When you use WieGesagt, I automatically collect certain information:

• Usage data: learning progress, playback position, listening time, use of features
• Device information: browser type, operating system, IP address
• Cookies and storage: session cookies (login), preferences in your browser's local storage. Visitor statistics are gathered without cookies.

2.3  Voice recordings (Repeat after me)

When you use the “Repeat after me” feature, your voice is recorded so that you get feedback on your pronunciation. Voice recordings are collected only with your explicit consent (microphone permission) and are subject to special protection. They are:

• sent only for immediate transcription to a specialised external speech recognition provider
• never stored permanently: the recording is processed solely for the immediate analysis and discarded afterwards
• never passed on to third parties, except to process the transcription
• transmitted encrypted (TLS)

No permanent audio archive comes into being. Since no recordings are stored, there is nothing you would have to delete afterwards. You can withdraw your consent to the use of the microphone at any time.

I use your data for the following purposes:

• Providing the services: audio playback, subtitle synchronisation, translations, pronunciation feedback
• Personalisation: saving your progress, your word lists and your settings
• Improvement: analysing usage patterns to improve features and the user experience
• Communication: service updates, answers to enquiries, support
• Security: detecting and preventing fraud, abuse and security incidents
• Legal compliance: meeting legal obligations and enforcing my terms of use

I use the following third-party services, which may collect and process your data:

• Analytics: a cookie-free analytics service for anonymised visitor statistics. Your IP address is sent to it for the analysis, but is not stored there permanently.
• Translation: an external translation service for translating words
• Speech recognition: an external speech recognition provider for transcribing audio files and analysing pronunciation
• AI language model: an external AI service that processes your questions to Bonnie and your texts in Writing and Conversation to produce answers and corrections. I do not store your questions to Bonnie.
• Sign-in through third parties: external single sign-on services, which are loaded only when you choose this sign-in method. These providers may then set their own cookies.
• Book metadata: an external catalogue service that is queried for titles and cover images when you upload (IP address and search term)
• Error diagnostics: an error and stability service that, when an error occurs, records technical data and a heavily masked snapshot (texts and media hidden)
• Notifications: your browser's push service, if you turn on push notifications
• Cloud storage: a cloud storage provider for storing uploaded files
• Hosting: hosting and infrastructure providers (locations in the EU and the USA)

These services have their own privacy policies, which I recommend you read. I share only the minimum data needed to provide my service.

I use cookies and similar tracking technologies for:

• Essential storage: required for authentication and core features
• Preferences: storing your settings and preferences (with consent)
• Analytics: a cookie-free analytics service for anonymised usage analysis. It sets no cookies and does no cross-site tracking, and therefore needs no consent. For the analysis, your IP address is sent to the service, but is not stored there permanently.

You can manage your cookie settings at any time on the cookie settings page. Rejecting non-essential cookies does not affect your use of the core features.

If you consent to session recording, a self-hosted recording tool (entirely on my own infrastructure) records your interactions with the app: clicks, mouse movements, scrolling behaviour and the pages you visit.

6.1  What I do not record

• input fields (email, password, settings)
• saved words and translations
• subtitle content and book pages
• pronunciation recordings (Repeat after me), which never leave your browser for replay purposes

6.2  Legal basis and retention

• Legal basis: Art. 6(1)(a) GDPR (consent)
• Retention period: 30 days, then deleted automatically
• Recipients: None. The data stays on my infrastructure.

6.3  Your rights

You can withdraw your consent at any time in the cookie settings, or request the deletion of all recordings through my GDPR export and deletion endpoint.

I store your personal data only for as long as necessary:

• Account data: user account, profile and settings, until your account is deleted
• Content: uploaded audio files and subtitles, until you delete them
• Voice recordings: audio snippets from Repeat after me. They are not stored, only processed transiently for the analysis and discarded immediately.
• Session recordings: recorded sessions, for 30 days and only with consent
• Usage logs: server logs and error traces, for 90 days
• Backups: mirrored databases, for a rolling 30 days

When these periods end, data is permanently deleted or fully anonymised.

As a resident of the EEA, you have seven rights under the GDPR (DSGVO), which I act on within 30 days:

1. Right of access: you can request a copy of all the personal data I store about you.
2. Right to rectification: you can have inaccurate or incomplete data corrected.
3. Right to erasure: you can request the deletion of your personal data (“right to be forgotten”).
4. Right to restriction: you can have the processing of your data restricted.
5. Right to data portability: you can receive your data in a machine-readable format.
6. Right to object: you can object to processing based on legitimate interests.
7. Right to withdraw consent: you can withdraw any consent you have given (for example to session recording), at any time and with effect for the future.

To exercise any of these rights, write to me at [email protected]. For requests relating to the GDPR, please put “GDPR request” in the subject line.

I use industry-standard security measures to protect your data:

• encryption in storage and in transit (TLS 1.2+, HTTPS)
• password hashing with bcrypt or Argon2
• regular security reviews and vulnerability scans
• access controls and authentication for all systems
• secure data centres with physical security measures

No method of transmission over the internet is 100% secure. Although I strive to protect your data, I cannot guarantee absolute security.

My service is not intended for children under the age of 14. I do not knowingly collect personal data from children under the age of 14. If you are a parent or guardian and believe that your child has provided me with personal data, please contact me straight away. I will delete the data without delay.

Your data may be transferred to and processed in countries outside your country of residence, in particular within the European Union and, through the service providers used, in the United States. I make sure that such transfers comply with the applicable data protection laws, and where necessary I use the standard contractual clauses approved by the European Commission.

I may update this policy from time to time. I will inform you of significant changes by:

• publishing the updated version with a new “Last updated” date
• sending an email notification in the case of significant changes
• showing a clearly visible notice in the service

Your continued use of WieGesagt after the changes take effect counts as acceptance of the updated policy.

For questions about this policy or about exercising your rights, I can be reached by email, usually within two working days and in any case within 30 days for GDPR requests.

• General and privacy: [email protected]

For requests relating to the GDPR, please put “GDPR request” in the subject line, so that I can deal with them faster.