Privacy Policy

Who we are

Übungszeit is an online German practice service: reading, listening, writing and speaking exercises, a vocabulary library and flashcards, with an AI tutor that grades work and explains mistakes. It is run from India by its two founders, Ayushi Gupta and Rishabh Nasa, who are responsible for the data described on this page; your data itself is hosted in the European Union, as set out below. For privacy questions, or to exercise any of the rights below, contact hallo@ubungszeit.com and a person will answer.

What we collect

• Account: your email address and a securely hashed password.
• Practice content: your exercise answers, written texts, the text of your spoken conversations, the corrections generated for you, and — if you use the flashcards — which words you found easy or hard and when each is next due, so we can grade your work, show your progress and remember your weak spots.
• Usage: practice minutes and feature usage, to enforce fair limits.
• Newsletter, if you ask for it: your email address, the time you asked, a one-way hash of the IP that asked, and the time you confirmed. We keep that record because it is the proof that you consented. Nothing is ever sent until you click the confirmation link, and every email carries a one-click unsubscribe. If you unsubscribe we keep the row — marked unsubscribed, never mailed — so the choice cannot be undone by accident. Ask us and we'll erase it outright.
• Practice reminders, if you ask for them: when you enrol there is an optional, unticked box asking whether you want an occasional email when words are ready for review or a grammar rule is still tripping you up. If you tick it we record that you did, when, and which version of this policy was in force — that record is the proof you consented, and we keep it even after you opt out, because otherwise the opt-out itself could not be shown to have happened. Leave the box unticked and none of this applies to you: no reminders, ever. We are not sending anything yet — ticking the box records that we may, and you will be able to stop them in one click, without signing in, from the first one onwards.
• IP address: used to rate-limit abuse and, for signed-out visitors, to count the day's free practice. We never store the address itself — only a one-way salted hash of it — and it is also sent to Cloudflare's bot check (below).
• Which pages were visited: the page address, the website that sent you (its name only, such as google.com), any campaign tag in the link you followed, how long the page stayed open, your country, and whether you are on a phone or a computer. See how we count visits below.
• Diagnostics: when something breaks, an error report — what failed, which part of the site it happened in, and, if you were signed in, your account id so we can tell whether the problem hit one person or everyone. It does not include your practice content.

Why we may process it (legal bases)

• To provide the service you signed up for (performance of a contract): your account, practice content, progress, usage limits and subscription.
• Our legitimate interests: rate-limiting and bot protection to keep the service up, and the thin visit counting described below — each explained in its own section.
• Your consent: the newsletter, and practice reminders if you asked for them when you enrolled. Nothing else here runs on consent. You can withdraw either with one click in any email, without signing in.
• Legal obligations: the few records that tax and accounting law require us and Paddle to keep.

Browser storage (no tracking cookies)

We do not use advertising or third-party tracking cookies. To sign you in, Übungszeit sets a strictly necessary session cookie, and signed-out visitors get a short-lived cookie recording that they passed the bot check. We also keep a few preferences in your browser's local storage — whether you have seen the welcome, how far you got in the tour, where you dragged Helfen, your correction preference, and, for the Recess games, your daily sample counters, which game instructions you have already seen, and whether sound is muted. Those all stay on your device and are never sent to us. Your daily free practice count for graded exercises is different: it is kept on our servers against a hashed IP, because a counter you can clear could not enforce a fair limit. The game counters can stay client-side precisely because playing a game costs us nothing to serve.

Our visit counting adds nothing to this list — it sets no cookie and stores nothing in your browser at all.

How we count visits

We count visits so we can tell whether people who arrive actually find what they came for — if someone lands on a page and leaves straight away, we would like to know, because it usually means the page is bad. We built this ourselves rather than adding an analytics company, so the numbers stay in our own database and are not shared with anyone.

We do not know who you are, and we cannot follow you.There is no cookie and nothing saved in your browser. To avoid counting the same person twice in a day, we turn your IP address, your browser's name and today's date into a single scrambled value. The address itself is never written down, and because the date is part of the scramble, the value is completely different tomorrow — so there is no way to connect what you did today with what you do next week.

We keep the page address with anything that looked like a name, an email or a search term stripped out of it; the name of the site that linked to you, never the full link; the campaign and keyword tags if the link carried them; roughly how long the page stayed open; your country; whether you are on a phone, tablet or computer; and which one of a short, fixed list of actions happened — that a page was opened, an exercise was answered, the tutor was asked something, a daily limit was reached, an account was created, or checkout was opened. Nothing else.

The timing is only how long a page was open and visible, so we can tell a page people read from one they closed straight away. It is not a recording of what you did on it: nothing about where you moved, clicked or scrolled is collected, and a page left open in a background tab counts as nothing at all.

We do this on the basis of our legitimate interest in understanding whether the site works, which we think is a fair trade for information this thin. If you disagree, your browser can switch it off and we will obey: turn on “Do Not Track” or Global Privacy Control and we record nothing at all. You can also email us and we will exclude you by hand. These records are deleted after 13 months.

Your voice

When you speak, your audio is sent to a speech provider and turned into text so Helfen can understand you. On the flashcards, if you choose to say a word out loud, that short recording is sent to Microsoft Azure to judge how close it was. In both cases we do not store your audio recordings — only the resulting text is kept, as part of your practice history, so Helfen can coach you. Both are processed on servers located in the European Union.

The speaking sceneswork the same way as the conversation room, on every device. When it is your turn, the scene records what you say and sends it to Deepgram in the European Union to be turned into text. The recording is held only for the seconds that takes and is never stored; the text is used to pick Helfen's next line and is not kept either. Nothing you say in a scene is written to your practice history — what a finished scene records is that you did it, never your words. And you can type your replies instead: every scene accepts typing, and the practice is the same.

Where your data lives

Your account and practice history are stored in the European Union (Frankfurt, Germany). Speech-to-text and text-to-speech are processed within the EU. To generate Helfen's replies and corrections, the text of your turn is processed by our AI provider (Anthropic), which may process it outside the EU; it is not used to train their models.

Where a provider processes data outside the EU — Anthropic, Cloudflare and Vercel — the transfer happens under that provider's data-processing agreement incorporating the EU's Standard Contractual Clauses. Paddle, as merchant of record, is the seller for your purchase and handles your payment data under its own privacy policy.

Service providers

We share data only with providers who help us run the service. Active today:

• Supabase — database, authentication and file storage (EU)
• Deepgram — speech-to-text (EU)
• Microsoft Azure — text-to-speech, and pronunciation scoring when you say a flashcard aloud (EU)
• Anthropic — generates replies and corrections from your text
• Cloudflare — bot and abuse protection (Turnstile); checks your IP address and interaction signals to distinguish real visitors from bots
• Resend — confirmation and account emails (EU)
• Paddle — payments and invoicing (merchant of record)
• Vercel — application hosting
• Sentry — error monitoring (EU)
• YouTube / Google — the thumbnails on our video pages are served by us, so nothing reaches Google while you are only reading. If you press play, the video itself is loaded from YouTube (in its no-cookie mode) and Google then sees your IP address and browser, and may set its own cookies.

Error reports go to our hosting provider's logs (Vercel, above) and to Sentry (EU) for monitoring. Sentry receives nothing else.

We do not sell your personal data, and we do not use third-party advertising.

Children

Übungszeit is not directed at children. You must be 18 or older to create an account, and you confirm that when you enrol — we ask, but we cannot verify it. We do not knowingly collect personal data from anyone under 18, and we have no mechanism for obtaining a parent's consent — so if you believe a child has given us their data, email hallo@ubungszeit.comand we will delete it. Anyone may read the site's public pages without an account.

Your rights

Under the GDPR and India's DPDP Act, you can ask us at any time to:

• see a copy of the data we hold about you,
• correct anything that is wrong,
• export your data in a portable format, or
• delete your account and data entirely.

You can also, at any time:

• ask us to restrict how we use your data, or object to a particular use,
• withdraw your consent where we rely on it — that is the newsletter and, if you asked for them when you enrolled, practice reminders. Every email of either kind carries a one-click unsubscribe that needs no login, or
• complain to your local data-protection authority if you think we have handled your data wrongly. You do not need to contact us first, though we would rather you did so we can fix it.

Deleting your account removes your practice history. Email hallo@ubungszeit.com and we will help within a reasonable time.

Complaints (India). If you are in India and are unhappy with how your data has been handled, write to hallo@ubungszeit.com — it reaches Ayushi Gupta and Rishabh Nasa directly, who answer these themselves. If we do not resolve it to your satisfaction, you may take the complaint to the Data Protection Board of India under the Digital Personal Data Protection Act, 2023.

Retention

We keep your account, practice history and progress for as long as your account exists, because that history is the service — it is what lets Helfen remember the rules you keep slipping on. Concretely:

• Account, practice answers, corrections and flashcard progress: until you delete your account, and erased when you do.
• Audio: never stored. Your recording exists only for the seconds it takes to turn into text.
• Daily usage counters: reset every day; the hashed-IP counter for signed-out visitors is kept only long enough to enforce that day's limit.
• Visit counts: 13 months, then deleted automatically.
• Newsletter record: kept while you are subscribed, and after you unsubscribe as the proof of that choice, until you ask us to erase it.
• Payment and invoice records: held by Paddle as merchant of record, for as long as tax and accounting law requires.

If you stop using Übungszeit without deleting your account, the account stays until you ask us to remove it — we would rather you found your progress waiting than lose it to a timer you never agreed to.

The visit counts described above are deleted after 13 months. They are not tied to your account and contain nothing that identifies you, so deleting your account does not reach them — there is no way to tell which of them were ever yours.