Privacy policy

Who is responsible for your data?

Representative in the European Union (Art. 27 GDPR)

The site operator is established outside the European Union. For any question about your data, you can also contact its representative in the EU:

The data we process

• Account: your email address and password. The password is never stored in plain text, only as an irreversible fingerprint (a “hash”).
• Profile: display name (optional), interface language, native language, level, countdown duration, time zone.
• Learning: the text of your answers (dictated or typed), the mode (voice or keyboard), the score, the date, and the review schedule of each sentence.
• Security: to block abuse (too many login attempts, for example), a counter tied to an encrypted fingerprint (HMAC) of your IP address or email. Never in plain text, deleted after 24 hours.
• Technical logs of the hosting provider (IP address, date, requested page), kept briefly for security and proper operation.

Your voice is never recorded: no audio file ever reaches our servers. We only receive the text.

Why, and on what legal basis

• Providing the service (account, exercises, statistics, reviews): performance of a contract, Art. 6(1)(b) GDPR.
• Service emails (account confirmation, forgotten password): performance of a contract. No newsletter, no advertising.
• Security and abuse prevention (rate limits, logs): legitimate interest, Art. 6(1)(f) GDPR.

We do not sell your data and do not use it for advertising.

Dictation and reading aloud

Dictation uses your browser's speech recognition. When possible, it runs directly on your device. Otherwise, your browser sends the audio to its own service (Google for Chrome, Apple for Safari, Microsoft for Edge), under that provider's privacy policy. SagEs is not involved in this transfer and only receives the text. A notice is shown the first time. You can always type your answer instead.

For reading aloud, some voices (for example “Google Deutsch” in Chrome) are generated online: the German sentence to be read is then sent to that provider.

Our service providers

These companies process data only on our behalf (Art. 28 GDPR):

• Supabase: database and sign-in, servers in Frankfurt (EU).
• Vercel: website hosting, servers in Frankfurt (EU).
• Resend: sending service emails.

These companies are based in the United States. Any transfer of data outside the EU is covered by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses (Art. 45 and 46 GDPR).

Cookies and local storage

SagEs only uses what is strictly necessary:

• Session cookies: keep you signed in securely.
• NEXT_LOCALE cookie: remember the language you chose.
• Browser local storage: remember that you have seen the dictation notice.

No visitor statistics, no advertising, no tracking. That is why no consent banner is needed (§ 25(2) TDDDG).

How long we keep data

Your data is kept as long as your account exists. When your account is deleted, everything is deleted with it (profile, answers, statistics). Security counters disappear after 24 hours; hosting logs after a short period set by the provider.

Your rights

You can ask at any time for: access to your data (Art. 15 GDPR), correction (Art. 16), deletion (Art. 17), restriction of processing (Art. 18), a copy in a readable format (Art. 20), and you can object to processing based on legitimate interest (Art. 21).

Write to the site operator or to its EU representative (addresses at the top of this page). We reply within one month.

You also have the right to lodge a complaint with a data protection authority (Art. 77 GDPR), for example the one where you live.

Changes

We update this page if the service changes. The date of the latest version is shown at the top.