Privacy Policy
Version 1.0 — effective 5 August 2026
This policy describes the personal data processing carried out for the service available at https://language.therence.net (the "Service"), under Regulation (EU) 2016/679 (GDPR) and French Act No. 78-17 of 6 January 1978 as amended. This English text is a courtesy translation; the French version prevails.
1. Data controller
Therence Brune, sole trader, SIREN 979 083 961, 15 rue du 4 Août 1789, 69100 Villeurbanne, France.
Contact for any question about personal data: [email protected].
The Service is not required to appoint a Data Protection Officer.
2. Data collected
2.1 Account data
| Data | Source | Purpose |
|---|---|---|
| Email address | Provided by the user | Authentication, password reset, account-related notifications |
| Password | Provided by the user | Authentication. Never stored in clear text — only as a cryptographic hash |
2.2 Profile data
Profile name, biography, nationality, preferred interface language, avatar image. All optional except the profile name, and freely provided by the user.
2.3 Learning data
Per-lesson progress, unlock status, knowledge level, review and answer history (success or failure), daily sessions, level, virtual coins, coin transactions, inventory and game state, notebook entries, achievements earned.
2.4 Communication data
Content of messages sent through the contact form and the associated email address; in-app notifications generated by the Service.
2.5 Technical data
Server logs (IP address, timestamp, page or API endpoint called, response code, user agent), generated automatically on each request.
The Service does not collect precise location data, payment card data (no paid plan is offered to date), or special-category data within the meaning of Article 9 GDPR.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create and manage the account, authenticate the user | Performance of the contract (Art. 6(1)(b)) |
| Provide lessons, exercises, spaced repetition and track progress | Performance of the contract (Art. 6(1)(b)) |
| Processing data of a child under 16 | Consent of the holder of parental authority (Art. 6(1)(a) and Art. 8) |
| Reply to contact-form enquiries | Legitimate interest: answering enquiries (Art. 6(1)(f)) |
| Ensure security, prevent fraud and abuse, diagnose incidents | Legitimate interest: securing the Service (Art. 6(1)(f)) |
| Improve the Service using aggregated statistics | Legitimate interest: improving the Service (Art. 6(1)(f)) |
| Respond to lawful requests and meet accounting obligations | Legal obligation (Art. 6(1)(c)) |
No automated decision producing legal effects is taken. The knowledge levels computed by the spaced-repetition algorithm are used only to order the content presented.
4. Children's data
The Service is open to minors.
- From age 16, a minor may consent to the processing of their data on their own.
- Under 16, processing relies on the consent of the holder of parental authority, who creates the account, accepts the Terms and supervises use of the Service.
The holder of parental authority may at any time access, correct or request deletion of the child's profile data by writing to [email protected], or directly from the "Account" section of the Service.
No advertising, no commercial profiling and no user-to-user exchange is offered to minors.
5. Recipients and processors
Data is never sold, rented or transferred to third parties for commercial purposes.
It is accessible to the publisher and to the following technical processors, acting on instructions and bound by a data processing agreement under Article 28 GDPR:
| Processor | Role | Data location |
|---|---|---|
| Hostinger International Limited | Application and database hosting | Cyprus (European Union) |
| Cloudflare, Inc. / Cloudflare Ireland Ltd | File storage (avatars, images, audio) via R2 | Western Europe (European Union) |
| SuperTokens | Authentication component | Self-hosted on the publisher's server (no transfer to a third party) |
No transactional email provider is in production use at this time. This table will be updated as soon as one is.
Any transfer outside the European Union is covered by the European Commission's standard contractual clauses or by an adequacy decision.
6. Retention periods
| Data | Period |
|---|---|
| Account and profiles | For the life of the account, then deleted within 30 days of the deletion request |
| Learning and game data | Same as the account |
| Contact-form messages | 12 months from the last exchange |
| Technical logs | 12 months maximum |
No automated database backups are taken at this time: deleted data is removed immediately and permanently. This section will be updated if a backup policy is put in place.
An account inactive for three (3) years may be deleted after prior notice to the user by email.
7. Security
The following measures are in place: HTTPS-encrypted traffic, passwords stored as hashes, restricted database access, time-limited authenticated sessions, regular component updates.
As no system is infallible, in the event of a data breach posing a risk to individuals' rights and freedoms, the publisher undertakes to notify the CNIL within 72 hours and to inform the individuals concerned where the risk is high.
8. Cookies and trackers
The Service uses only cookies strictly necessary for its operation: the session cookies issued by the authentication component, which keep the user signed in. These cookies are exempt from consent under Article 82 of the French Data Protection Act.
The Service uses no advertising cookies, no third-party social networks and no external analytics tool. Some interface preferences may be stored locally in the browser (localStorage) without being sent to the server.
9. Your rights
Under Articles 15 to 22 GDPR, you have the rights of access, rectification, erasure, restriction, objection and data portability, as well as the right to withdraw your consent at any time where processing relies on it.
You may also give instructions on what happens to your data after your death (Article 85 of the French Data Protection Act).
These rights can be exercised:
- directly from the "Account" section of the Service, for viewing, editing and deletion;
- or by email to [email protected].
A response is provided within one (1) month, extendable by two months for complex requests. Proof of identity may be requested in case of reasonable doubt.
If you consider that your rights are not respected, you may lodge a complaint with the CNIL — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr.
10. Changes to this policy
This policy may be amended. Any substantial change is notified to users holding an account, by email or by a notice displayed in the Service, at least fifteen (15) days before it takes effect.