Privacy policy

What we collect

We collect what the product needs to work. There is no third-party analytics and no selling of personal data, and the only advertising is an ad you can choose to watch after a lesson (see “Optional ads after a lesson”).

• Account details. Your email address, the display name you choose, your language settings, your plan, when the account was created, and which version of these documents you accepted at sign-up and when. If we ever suspend the account, when and why. Your password is handled by our own sign-in server and stored only as a salted hash.
• Study activity. Your answers, scores, exercise results, mock-exam sittings, streaks, mastery, experience points, badges, study plan, mistakes, flashcard reviews, and the sets, decks and exams you make. This is the product: it is how we show progress and aim practice at your weak spots.
• Written and spoken answers sent for review. The text you write, or the recordings of what you say and their transcripts, with the task they answer and the review of them (see “AI features, reviews and speech”).
• Your review timing. From your marked answers we keep, for every item you study, how likely you are to remember it and when to show it to you again, and a model of your own memory that times those reviews: the share of items it aims for you to recall and — once you have given enough marked answers — numbers fitted to them, with how well those numbers predict your answers. It is worked out from your own answers only, is used only to time your reviews, is part of the copy of your data and is deleted with your account.
• The practice map. The game around your study, kept with your account: the seed your islands grow from, how they are laid out and how each topic on them stands, the places and land you build, where your figure stands and where it has walked, the villagers, finds, quests, camps, ships and castles you meet, the creatures you meet and have seen, your frost wards, the portals and looks you own, and a record of each move on the map. With it, your purse: gold (earned and bought kept apart), energy, practice tickets and bonus rolls, and a ledger of every change to them.
• Devices. When you sign in, your browser creates a random device identifier and keeps it; it is not a fingerprint and nothing in it comes from your hardware. It is sent with your signed-in requests. With it we keep a list of your signed-in devices: a label such as “Chrome on macOS” worked out from your browser’s user-agent string (the string itself is not stored), and when each device was first and last seen. This list enforces the limit of 3 devices per account (behind it, our sign-in server allows 6 sessions) and lets you sign a device out in Settings.
• Payments, when paid plans are open. Nothing is sold during the free beta. When it is, Stripe takes the payment and we store the identifiers of your Stripe customer and subscription, your plan, its status and its renewal date, what each purchase was, its amount and whether it was refunded, and a record of the consent you give at checkout (see the terms). We never receive or store your card number. A purchase in the iOS app goes through Apple, which tells us what was bought.
• Leaderboards, only if you opt in. If you choose to appear on a public leaderboard, your display name and your result on it are shown to other learners. It is off until you switch it on, on the awards page, and you can switch it off there at any time.
• Class chat. If you post in a class chat, your message is shown to that class with your display name.
• Reports about content. If you report a set, we keep the report: which set, the reason and the explanation you gave, when you sent it, and your account if you were signed in — or, if not, the email address and name you chose to leave, if any. We keep what we decided on it and why, and email you the confirmation and the outcome when we have an address. The set's author is not told who reported it.
• Server logs. Every request to our server is logged. Our application logs its time, the address requested (without its query string), the result, your IP address and — when you are signed in — your account id and plan; the proxy in front of it logs the time, the full address, the result, your IP address, the page you came from and your browser’s user-agent string. In our log store, password-reset links and other sign-in codes in an address are masked; the raw files on the server keep them until they are overwritten. We use the logs for security, to stop abuse and to fix faults.
• Error reports. When the app fails in your browser, it sends us the error message, its stack trace, the first part of the page address, the app version and a random reference number — never your stored data, form contents or sign-in token. Our server adds your browser’s user-agent string to the report and logs it.
• Performance measurements. When you leave a page, your browser sends us how fast it loaded and responded (the standard web-vitals timings) and the first part of the page address — no account, device or session identifier. They are added to anonymous totals, not stored per visit. We also count sign-ups, exercises started and finished, and exams started as totals, which name no one.
• How the app is used. To see what helps people learn and what gets in their way, the app records the steps taken in it: the pages opened (the address without its query or any code in it), taps on links and on buttons we mark, what is done on the practice map, a drill or a lesson started, finished or left, the steps of setting up a study plan, a purchase started (the item, never the amount), signing in and out, and the kind of an error. Our server adds the steps it handles itself — an account created, a lesson or a mock exam finished, a purchase completed (its kind, never the amount). Each record holds the time, the screen size (phone, tablet or desktop), the interface language, the app version and, for the first page of a visit, the name of the website you came from. Nothing you type is recorded, and the records never leave our own servers. Signed in, the records carry your account: we rely on our legitimate interest in improving the service, and you can object at any time with one switch in Settings → Privacy — from then on nothing of yours is recorded, and what was recorded under your account is deleted at once. Not signed in, the records carry no identifier and nothing is stored in your browser for them: our server tells one visit from another by a code it computes from your IP address and your browser’s user-agent string with a secret that changes every day and is kept only in memory, so a visitor can be recognised within one day and never after it. The records are deleted after 90 days; what we keep after that are daily totals and the share of new accounts that come back after 1, 7 and 30 days, which name no one.

AI features, reviews and speech

When you use an AI feature, the text involved is sent to our AI provider, Anthropic, to produce the answer: your messages to the AI tutor and the coach, a text or design answer you submit for review, a grammar question, the words you ask it to build sentences or questions from, and the transcript of a spoken answer. No name, email address or account identifier is sent — only the text, the exercise it belongs to and the language to answer in. Anthropic keeps what it receives only for a limited time under its commercial terms. Avoid putting personal details you would not want to share into these texts.

What we keep. A reply from the AI tutor, the coach or a grammar explanation is sent back to you and not stored on our servers; for a graded exercise we keep only the score, as for any other exercise. The AI tutor conversation is kept in your own browser so that it has context, and signing out clears it. Reviews of written and spoken answers are the exception, described next.

Reviews of written and spoken answers. When you send a written or spoken answer for review — in practice, or as part of a mock exam — we store it so that it can be reviewed and so that you can read the review: the text you wrote, or the recordings of your spoken answer and the transcripts our speech recogniser makes of them, together with the task they answer. The review is written by an AI model (Claude, made by our AI provider Anthropic) that we use to mark answers against the exam’s marking criteria; a member of our team may read an answer and its review when a review is set aside for a person to look at, or to check the quality of reviews. The reviewer receives the task, your answer, the target level and the language to write the review in — never your name, email address or account identifier. The review — a score for each criterion, corrections and comments — is stored with your answer and shown to you, labelled as AI-generated.

Recordings. A speaking exercise uses your microphone only while you record, and a recording stays on your device until you send it: when you submit it for review in practice, or as you finish each spoken part of a mock exam. It is turned into text by a speech recogniser that runs on our own servers, and the recording itself is deleted 30 days after it was uploaded; the transcript stays with the review. A recording from a mock exam that is never finished is deleted after two days. We never use your voice to identify you.

Your written answers, transcripts and reviews are kept with your account until you delete them — one at a time in your reviews, or all of them with the account. Anthropic keeps what it receives only for a limited time under its commercial terms and does not use it to train its models.

Nothing here decides anything about you automatically: an AI score or review is a study estimate, and nothing depends on it but your own practice.

Optional ads after a lesson

After a lesson you can choose to watch an ad for a bonus on the gold that lesson earned (the “bonus roll”). It is never required and never shown inside a lesson: nothing of the ad service loads until you tap “watch an ad”, and skipping it costs nothing. An ad changes only your gold — never your XP, progress or results.

Google shows the ad. The ads come from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) through Google Ad Manager. When you tap “watch an ad”, your browser loads Google’s ad code and asks Google for an ad, sending what any ad request sends — your IP address, details of your browser and device, the page’s address and the cookies or identifiers Google may have set — but not your name, email address or account. Google uses this data as a controller in its own right, under its own privacy policy (https://policies.google.com/privacy), and explains how it uses data from sites that show its ads at https://policies.google.com/technologies/partner-sites.

Your consent comes first. Before your first ad, Google’s consent message — a consent tool certified under the IAB Transparency and Consent Framework — asks whether Google and its partners may store and read information on your device and use it to personalise and measure ads. If you agree, the ad may be personalised. If you do not, it is not: Google then shows a non-personalised ad, or a limited ad that uses no cookies for advertising. The message keeps your choice in cookies on this site, so it does not ask every time. Until the message has answered, no ad is requested.

Changing your mind. “Ad privacy choices” — here, under the bonus roll, and in Settings once Google has asked this browser — opens Google’s message again: you can change or withdraw your consent at any time, as easily as you gave it. It contacts Google only in a browser where Google’s message has run before; anywhere else there is no answer to change, and it says so. Withdrawing does not affect ads already shown.

Why we are allowed to use it

Under the GDPR we rely on these legal bases:

• Performance of a contract — running your account and giving you the exercises, exams, AI features and progress tracking you signed up for.
• Legitimate interests — keeping the service secure, the device limit, preventing abuse of the service and its content, fixing faults and measuring performance in aggregate, and — for signed-in learners, unless they switch it off — understanding how the app is used so we can improve it (see “How the app is used”). We keep this data minimal and short-lived (see below).
• Consent — only for what is optional: appearing on a public leaderboard, and personalised ads after a lesson, which Google’s consent message asks about (see “Optional ads after a lesson”). You can withdraw it at any time: on the awards page for the leaderboard, and with “ad privacy choices” for ads — in Settings, or in “Optional ads after a lesson”.
• Legal obligation — keeping payment records when paid plans are open, handling reports about content as the EU Digital Services Act requires, and answering lawful requests from authorities.

To create an account you must give an email address and a password — without them we cannot provide one. A display name is optional. No law requires you to give us data.

Who processes it for us

These providers process personal data for us. Each acts only on our instructions, under a data processing agreement, and receives only what its job needs.

• Hetzner Online (Germany) — hosts the whole service, including the database, in its data centre in Helsinki, Finland.
• Amazon Web Services, EU (Stockholm) region, Sweden — keeps encrypted backups of our database (Amazon S3), and sends our account email and reports bounces back to us (Amazon SES and SNS).
• Anthropic (United States) — the AI features described above, including the reviews of written and spoken answers.
• Stripe (Ireland and United States) — payments, only when paid plans are open. Stripe’s payment form runs only at a checkout step: on the checkout page, or in the payment sheet on the practice map once you choose to continue to payment.

Apple is not our processor: an iOS purchase is made with Apple, which handles it as its own controller.

Everything else runs on our own servers: sign-in, speech recognition, logs and monitoring. Fonts are served by us too, so opening a page contacts no third party. The one exception is the optional ad after a lesson, which contacts Google only when you tap “watch an ad” — and afterwards “ad privacy choices”, to change your answer; for it Google is not our processor but a controller in its own right (see “Optional ads after a lesson”).

We disclose data to an authority only where the law requires it. We will not give your data to anyone else without telling you, unless the law forbids us to tell you.

Transfers outside the EU

Hetzner and Amazon Web Services keep our data inside the European Union. Anthropic, and Stripe where it uses its US company, process some of it in the United States. For those transfers we rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s standard contractual clauses. Ask us for a copy of the safeguards that apply.

Google, which shows the optional ads as a controller in its own right, may process the data of an ad request in the United States too, under its own safeguards.

How long we keep it

• Account and study data — for as long as your account exists; deleting the account removes it (see below). Two things go sooner even while it exists: the item-by-item detail of an exercise result after 90 days (the score stays), and the question paper of a finished mock exam after 30 days.
• Recordings of spoken answers — 30 days after they are uploaded (from a mock exam that was never finished, two days); the transcript and the review stay with your account until you delete them.
• Server logs and error reports — our log store deletes them after 14 days; raw log files on the server are overwritten on a rolling, size-based basis. Performance totals and counts — 15 days.
• Usage records — 90 days (see “How the app is used”); the daily totals and return rates made from them name no one and are kept.
• Database backups — up to 31 days. Deleted data therefore stays in the backups for up to 31 days before it ages out.
• Account email — a copy of each email we send is kept for 30 days after it is delivered, and deleted with your account in any case.
• Devices — until you sign that device out or delete the account; a device whose session has ended is dropped the next time you sign in.
• Class chat — a message is deleted 30 days after it is sent, or sooner once 200 newer messages have been posted in that chat; a copy of a reported message stays in our moderation queue for up to 30 days after the report.
• Reports about content — an open report until it is decided; then the report and the decision on it for 12 months, as the record of that decision, after which they are deleted. Deleting your account sooner removes your account, and your email address and name, from the reports you sent.
• Payment records, when paid plans are open — the payment processor keeps its own records of payments for as long as tax and anti-money-laundering law requires. Our own record of each purchase — what it was, its amount, the payment's reference and any refund — is kept after your account is deleted, as an accounting record, for as long as tax and accounting law requires; it keeps only the account's id, which after the deletion leads nowhere.

Deleting your account

You can delete your account yourself, at any time, in Settings → danger zone, by typing your email address to confirm. No email, no waiting, no support ticket.

Deletion first cancels an active plan at the payment provider; if the provider cannot be reached, nothing is deleted and you can try again. A plan bought in the iOS app is billed by Apple: cancel it in your Apple subscription settings — deleting your wspell account does not stop Apple’s billing.

Deletion then permanently removes your profile, study history and progress, your written and spoken answers with their recordings, transcripts and reviews, the usage records made under your account (and refuses any that arrive after it), saved rules and study lists, wallets, your practice map with its gold, energy, practice tickets and game items, an exam pass, devices, the sets you have not made public, your class-chat messages and the emails addressed to you, and finally your sign-in.

Content you published stays available, because other learners may be studying it, but your name and your account are removed from it.

What remains: the copy in our backups, for up to 31 days; our server logs, until they age out as described above; the payment processor’s own records; our record of each purchase, kept as an accounting record (see above); the record of any consent you gave at a checkout, kept as evidence in case a charge is disputed; our record of any action we took on your account, such as a suspension; a report you made about someone else’s chat message, without your account, until it leaves our moderation queue; reports you sent about content, with your account and address taken off them; and, if an email to your address bounced or was marked as spam, the address on our do-not-send list, so that we never email it again.

Your rights

You have the right to access your data and to receive a copy of it in a portable format, to have it corrected, to have it deleted, to restrict or object to certain processing, and to withdraw consent. Much of this you can do yourself, as described below; for anything else, email support@wspell.com from the address on your account and we answer within one month.

A copy of your data. In Settings → Account → Your data you can download everything your account holds as one machine-readable JSON file: your profile and sign-in record, study history and progress, study plans, saved rules and lists, the sets and exams you made, your mock-exam sittings, your written and spoken answers with their reviews (each recording we still hold as a download link valid for a day), your practice map with its gold, energy and tickets, wallets, purchases and the consents you gave at a checkout, your devices, the messages you posted in a class chat that are still kept, the reports you sent about content, the emails we sent you, and any action we took on your account. Left out are only sign-in and session tokens, the answer keys of exam questions, the text of the emails (it can contain a live link) and who reviewed your answers or acted on your account. You can download the file up to three times a day.

Changing your email address. In Settings → Account, enter the new address and your current password. We email a link to the new address, and the change happens only when you open that link, within 24 hours — until then you sign in with the old address as before. We then tell the old address, with a link that undoes the change for 7 days: it puts the old address back, signs the account out on every device, replaces the password with one nobody knows and sends a link to set a new one. For those 7 days the old address stays reserved for your account — nobody else can register it or move to it. The address you asked to move to is kept until you open the link, ask for another change or delete the account; the addresses your account used to have are kept with it, each with the date it stopped being yours, so that mail we sent to them while they were yours is included in your copy and deleted with the account.

You can also delete the account, change your display name, sign out a device or switch off usage statistics yourself, in Settings, and leave a leaderboard on the awards page.

Storage on your device

wspell keeps some data in your browser’s local storage. All of it is strictly necessary for the service you asked for, so we do not ask for consent for it — there is no third-party analytics, and nothing is stored here for usage statistics (signed in, they go with your account; see “How the app is used”). We set no cookies ourselves; Google can, once you tap “watch an ad” after a lesson (see the last paragraph).

• Sign-in tokens — keep you signed in.
• Device identifier — created when you first sign in, for the device list and limit above.
• Settings — your language, theme and practice preferences, and which notices you have dismissed.
• Caches — your recent results, progress, mistakes, study lists, word map and the AI tutor conversation, so pages open quickly and keep working on a bad connection.
• Exam sitting token — shows that this device holds your running mock exam.
• Drafts — the answers of an exam or exercise in progress, and results not yet sent, so nothing is lost on a reload.
• Ad consent marker — that Google’s consent message has run in this browser, so that “ad privacy choices” contacts Google only where there is an answer to change.
• Practice map — the seed a guest’s islands grow from, sent with the map’s read so that the island survives a sign-up; the last map this browser drew and the gold and energy it showed, for a guest and for each account signed in here, so that what changed since can play on the next visit; and the map’s display choices.

Signing out removes the sign-in tokens, your drafts, your cached study data and your account’s settings from the browser. What stays is what belongs to the browser, not the account: the interface language, a few display choices (the word map’s look, the notices, hints and help cards you have dismissed, page layouts), two drill caches that hold no answers, the ad consent marker, the practice map’s entries a guest’s browser holds (the seed, and the last map and the gold and energy a guest saw — an account’s own map entries are removed), and the device identifier, so that signing in here again uses the same device slot. A sitting token also stays, but it is of use only to your account, and one stored with your account is removed when another account signs in here; deleting the account here removes it and the device identifier. A session that ends without signing out (it expired, or was ended from another device) leaves your cached study data and drafts here, marked with your account, for your next sign-in; anything done here without signing in after that counts as yours too, and if another account signs in here first, all of it is removed and never sent to it. Clearing the site’s data in your browser removes all of it.

Other services can set cookies only when a step needs them: our sign-in server, on its own pages, when you open a password-reset or email-confirmation link; Stripe, at a checkout step when paid plans are open — on the checkout page, or in the practice map’s payment sheet once you continue to payment; and Google, only after you tap “watch an ad” after a lesson — its consent message keeps your choice in cookies on this site, and its advertising cookies are used only as that choice allows (see “Optional ads after a lesson”).

Children

wspell is for people aged 16 and over, and signing up asks you to confirm that you are. If you believe a child under 16 has given us personal data, contact us and we will delete it.

Security

Traffic is encrypted in transit. Passwords are stored only as salted hashes, card details never reach our servers, and database backups are encrypted at rest. Access to production data is limited to the operator, and every change made to an account through our admin tools — its plan, a suspension, a deletion — is recorded.

No service can promise perfect security. If a breach puts your personal data at risk, we will report it to the supervisory authority within 72 hours where the law requires, and tell you without undue delay when the risk to you is high.

Changes to this policy

When this policy changes, we update the date at the top of this page. The version you accepted when you signed up is recorded with your account.

Complaints

If you think we have handled your data wrongly, tell us first at support@wspell.com so we can put it right. You can also complain to a data protection authority — in Lithuania, the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, LT-10312 Vilnius, https://vdai.lrv.lt — or to the authority where you live or work.