Language through Literature
Privacy
This describes what this service records about you, why, for how long, and what you can make it do. It is written from the code, not from a template — if something here is not true of the software, that is a bug and we want to know.
The short version
Your account is an email address and a password hash. Your reading record — the words you have marked, when you reviewed them, how far through each book you are — is stored as opaque data the server never opens. It does not parse your words, does not compute your progress, and does not need to: the application in your browser is the thing that understands the record. A breach of this database would leak a list of Russian words somebody is learning, and nothing else.
There is no advertising, no third-party tracker and no profiling, and no analytics service is used. Visits are counted here, on this server, as daily totals — no cookie, no identifier kept in your browser, and nothing that links you to yesterday. How that works is set out below, exactly. The offline edition of the reader sends nothing anywhere at all.
Controller
Tom Besinger, Mollardgasse 26 1060 Wien. Contact: [email protected]. No data protection officer is appointed; the processing does not meet the thresholds in Art 37 GDPR.
What is stored, and why
| Data | Why | Legal basis | Kept |
|---|---|---|---|
| Email address, optional name | To identify your account, sign you in, and reach you about it | Art 6(1)(b) — performance of the contract | Until you delete the account |
| Which reading room you opened the account in | One of two words, ru or de, recorded once when the account is made, so that we can tell how many people arrive through each room. It is not what you have read since, it opens nothing and closes nothing, and it is never used to decide anything about you | Art 6(1)(f) — knowing which of our own rooms brings readers in | Until you delete the account |
| Password hash (Argon2) | To let you sign in with a password. The password itself is never stored and cannot be recovered from the hash | Art 6(1)(b) | Until you delete the account |
| Sign-in and reset links | A hash of the token, the address it was sent to, the time, and the IP that requested it — so a link can be used once and abuse can be spotted | Art 6(1)(b) and 6(1)(f) — security | Consumed or expired, then cleared |
| Your reading record | So it survives a lost laptop and follows you between devices. Stored as opaque JSON the server does not interpret | Art 6(1)(b) | Until you delete the account |
| Entitlement — what you bought and until when | To know whether to open the library | Art 6(1)(b), and 6(1)(c) for records that tax law requires be kept | Account lifetime; billing records as long as the law requires |
| Request logs and rate-limit counters | To keep the service up and to stop somebody hammering the sign-in endpoint on your address | Art 6(1)(f) — legitimate interest in security and availability | Short-lived |
| Daily visit totals, and a same-day hash | To know how many people came, roughly how long they stayed, and which sites they arrived from — the host only, never the rest of the address. The totals are numbers only. The hash exists so one person is not counted twice on one day, and is described in full below | Art 6(1)(f) — legitimate interest in knowing whether the service is used at all, weighed against an interference we have made as small as it can be made | Totals indefinitely; hashes 30 days, and meaningless after one |
We do not ask for a date of birth, a postal address, a phone number, or anything about you beyond the address we write to. Payment details never reach this service.
Who else processes it
| Who | What for | What they see |
|---|---|---|
| Railway | Hosting and the database | Everything above, because it runs there |
| Cloudflare | DNS and the proxy in front of the site | Connection metadata — IP address, request paths |
| Resend | Sending sign-in, verification and reset emails | Your email address and the message |
| Paddle | Payment, as merchant of record | Your payment details and billing data. Paddle is a controller in its own right for that, under its own privacy notice |
Each is engaged under a data processing agreement, except Paddle, which is an independent controller for payment data. Where a processor transfers data outside the EEA, that transfer relies on the European Commission's Standard Contractual Clauses under Art 46(2)(c) GDPR.
How visits are counted
We wanted to know whether anybody was reading this without learning anything about who they were. So the counting is built to be incapable of it, rather than merely disinclined.
What is sent. When you close a page, your browser posts six things: the name of the screen you were on — read, words, course, and nothing more specific than that; which of the two reading rooms you were standing in, the Russian one or the German one, and nothing finer than that; how many milliseconds it had been open; the address of the page that linked you here, if there was one; which of twenty-six fixed things happened while you were there; and whether this browser had read here on an earlier day. Never a book, never a sentence, never a word you looked up, never an identifier. There is no third party involved and the request goes to this server only.
Those twenty-six things, in full. They are a closed list, and this is all of it: whether the reading page was opened at all; whether an instalment of a book was opened; whether the address you arrived on named a book itself; whether the page opened one word by itself to show you that it can; whether, unable to do that, it marked one word as an invitation instead; whether it looked for a word to mark and found none on your screen; which of the two invitations you were given, counted separately for each; whether a word was touched by you and gave its meaning; whether that happened after the page had shown you one; whether it happened after a word had been marked as an invitation; whether it happened after either of the two invitations, counted separately; whether a second word was touched; whether a sentence was asked for its translation; whether a word was taken into the practice deck; whether a word was marked as already known; whether a card offering the rest of the shelf was laid on the desk on your third evening; whether such an offer was shown because the count of opened lines had risen; whether one was shown at the end of a finished book; whether the course road's own counter plate was drawn; and whether the panel of prices was opened in front of you; whether the payment counter was opened after that; whether the payment counter refused to open; and whether you left this room for the other one by the list of rooms in Settings — which room you went to is not sent, only that you went; and whether a word list was carried away as a file, which the page it left from reports because a download leaves no page behind to report itself. The same twenty-six names for everybody, and no others are accepted — a twenty-seventh would need a change to the code and a change to this paragraph. Which word, which sentence and which book are not sent and are not kept; the counts say how many people found out that a word answers when you touch it, and nothing about what anybody read.
The referring address, and what becomes of it. Only the
host survives being received — youtube.com,
google.com — and everything after it is discarded before it is
looked at, stored, or logged. That matters: a referring address can carry the
words somebody typed into a search box, or the name of a private group they
were reading in. None of that is wanted and none of it is kept. What remains is
a count of how many people arrived from a named site on a given day, which is
the only question being asked. Most browsers now send only the origin anyway;
this is the same reduction, applied again at this end so it does not depend on
your browser's settings.
What is kept. One row per day, holding totals: how many pages were opened, how many different people opened them, which screens, how many arrived from each named site, how many of those twenty-six things happened, how many browsers had read here before, and how many visits fell into each of five length bands. Each of those totals is also kept for each of the two rooms separately, so that one room's readers are not invisible inside the other's — which room a visit happened in is the coarsest fact there is about it, and it is the only thing these two sets of totals differ by. Individual durations are not stored; they are put in a band and discarded. There is no event log, no session record, and no row anywhere that describes one visit.
How one person is told from two. This is the only hard part and it is solved the way Plausible and GoatCounter solve it. Each day a long random salt is generated and never written down anywhere permanent. Your IP address and your browser's user-agent string are combined with that salt and put through SHA-256, and only the resulting hash is stored. It answers exactly one question — "has this visitor already been counted today?" — and it can answer no other, because a hash cannot be reversed. Your IP address and user-agent are not stored. They are read from the request, mixed into the hash, and gone.
Whether you have been here before — and why we have to ask you. Because of everything in the paragraph above, this server cannot tell a returning visitor from a new one. It would like to know whether anybody comes back, and it has no way to find out: the material was destroyed at midnight. So the question is put to your browser, which already keeps a note of the days you have read in order to draw the thirty-day figure on your own desk, and has done since long before this was counted. Its answer is one word from a fixed list — first time, back within a week, back within a month, back after longer — together with a band for how many days in all. No date, no identifier and no count ever leaves your machine, nothing new is written to it, and what is stored here is a daily total of how many browsers said each word. It follows that the figure counts browsers: a phone and a laptop are two, and clearing your storage starts over. That is a worse measurement, and it is the one that can be taken without knowing anything about you.
Why it does not follow you. Tomorrow the salt is a different random value and the old one is destroyed. So today's hashes cannot be recomputed tomorrow, and the same person returning is a new visitor with a new hash that cannot be matched to the old one. There is no way to link two days, and it is not a policy that could be changed by a decision — the material needed to do it no longer exists. The hashes themselves are deleted after 30 days, by which time they have been meaningless for 29 of them.
What is not done. No cookie is set for this. Nothing is written to your browser's storage for this. No profile is built, no journey is reconstructed, nothing is shared with anyone, and none of it is or can be connected to your account, your email address, or your reading record — the counting has no idea whether you have an account at all.
The totals are visible to the operator and to nobody else. If you would rather not be counted even in this form, the reader honours your browser's Do Not Track and Global Privacy Control settings and sends nothing at all; turning JavaScript off has the same effect. Nothing about the service changes if you do either.
Cookies and similar
No advertising or analytics cookies are set, so there is no consent banner — because there is nothing to consent to. Counting visits sets no cookie and stores nothing in your browser, which is what keeps it outside the consent rule rather than an exemption from it. The application keeps your account session and your own settings in your browser's local storage. That is storage strictly necessary to provide a service you asked for, which §165(3) TKG 2021 and Art 5(3) ePrivacy exempt from consent. Cloudflare may set a cookie for security purposes on the same basis.
Your rights
You may ask for access to your data, correction, erasure, restriction, or a portable copy, and you may object to processing based on legitimate interest — Art 15 to 21 GDPR. Write to the address above.
Two of these you do not have to ask for. Export gives you your whole reading record as a file, from inside the application. Delete account removes the account and everything attached to it. Both are in the app; neither needs our involvement or our permission.
You may also complain to a supervisory authority. In Austria that is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna.
Automated decisions
None. Nothing about you is decided automatically, and nothing here profiles you. The scheduling of your flashcards is arithmetic that runs in your own browser on your own record.
Children
This service is not directed at children and no account is knowingly created for anyone under sixteen.
Last updated August 2026.