Security

Where and how data is stored

• Your account and practice history live in the European Union (Frankfurt), encrypted at rest.
• All traffic uses HTTPS (TLS); connections without it are refused.
• Database access is protected by row-level security: your records are readable by your account only.

Your account

• Passwords are stored only as strong one-way hashes — we cannot read them.
• We never ask for your password by email.
• You can delete your account, and with it your practice history, at any time. Two things do not go with it: records we must keep by law, and our anonymous visit counts — those are tied to no account at all, so there is nothing in them to identify as yours. Privacy explains both.

Your recordings

• When you speak — in a Speaking exercise, or when you say a flashcard aloud — the recording is sent over HTTPS to a speech provider in the EU and used once, to produce text or a pronunciation score.
• We store neither the audio nor the text it becomes. What a finished exercise records is how it went — which rules you slipped on, so Helfen can bring them back — never the words themselves.
• The microphone opens only when it is your turn to speak — because you pressed record, or, in a Speaking scene, because the tutor has just finished his line. It closes as soon as the turn ends: when you stop speaking, when you say you are done, or when the time for that turn runs out.

Limits and abuse protection

• Every plan has a daily allowance — graded sets, Helfen assists and speaking time. Speaking a flashcard counts against the speaking allowance too, because it reaches the same paid service. The exact numbers are on the Handbook and Pricing pages.
• Allowances are enforced on our servers, not in your browser, so they cannot be bypassed from the page.
• Signed-out visitors are counted against a one-way salted hash of their IP address — we never store the address itself — and requests are rate-limited and bot-checked.
• There is also a spend ceiling across the whole service. If it is ever reached, AI features pause rather than run up an unbounded bill; your account and your saved work are unaffected. Before that point — from about 85% of the day's budget — we hold the last slice back for paying subscribers, so guests and free accounts are paused first. Reading, browsing and flashcard drilling keep working either way.

Payments

Payments are handled by Paddle as merchant of record. Your card details go to Paddle directly — Übungszeit never sees or stores them.

Found a vulnerability?

Please tell us privately at hallo@ubungszeit.com before any public disclosure. We read every report and fix confirmed issues quickly.