Privacy policy

• Your account: your email address, username and password (stored only as a secure hash), and whatever you add to your profile (name, display name, a picture link, an “about” text, social media usernames). If you sign in with Google or Metal ID, we receive from them your name, your email address and the basic profile details they share (such as a profile picture link).
• Your study progress and activity: the cards and questions you answer, your attempts and scores, streaks, notes, the tests and live quizzes you take part in, and a log of what you did on the site (for example “studied a deck” or “started a test”). The log holds no IP address and no answer text.
• If you use the site without an account: only once you have accepted analytics, and only after you have used the site the way a person does (for example finished a practice test or a game with a passing score, or marked five flashcards as known), your browser sends us a short log of what you do there (such as “finished a practice test, 8/10” or “reviewed 12 cards of a deck”), under a random identifier it keeps in its local storage. The log holds no name, email address, IP address or answer text, and the identifier is random, not worked out from your device. If you later sign up or sign in on that browser, we note which identifier it had, so this earlier activity is linked to your account.
• If you use the site without an account and have not answered the cookie banner: outside Europe, once you have used the site the way a person does (as above), we keep the same short log of what you study without any cookie or identifier on your device. To tell one visitor’s day from another’s, our server works out a code from your IP address, your browser’s details and the site, mixed with a random value that is replaced every day and then thrown away; it stores that code, never your IP address or browser details, and nobody (us included) can work your IP address back out of it or link one day to the next. This activity is never linked to an account. In Europe (the EU, the EEA, the UK and Switzerland, judged by your browser’s time zone and, where our network provides it, your country), nothing is logged until you accept analytics. Accepting or rejecting in the cookie banner ends it.
• Feedback and reports: what you send through the feedback form, including reports about a question or about something an AI wrote: your message, an email address if you give one, and the page and content it is about. A report about an AI grade or correction also keeps the AI’s text you reported and any part of your answer it quotes. Each one is also emailed to our team’s inbox.
• Practice answers you save: in the interview practice of some courses, the answers you write in preparation mode and the AI’s corrections are saved to your account so you can come back to them.
• Purchases: if you buy access to a course, what you bought, the price, the dates and your email address.
• Live quizzes: the nickname you choose when you join one.
• Technical data: our servers log each request (IP address, browser, the address asked for, including the text of any search you make, and when) to keep the service running and secure.

Your profile page, at /u/<your username>, is public: anyone can see it, signed in or not. It shows your username and, where they are filled in, your display name, picture link, “about” text and social media usernames (Facebook, X/Twitter, LinkedIn, GitHub). It also lists the decks on this site that you subscribe to or are a collaborator on, but only those the visitor can already see: someone who isn’t signed in sees only public decks there. Your email address, your name, your progress and your results are never shown on it.

Separately, a deck’s page credits the people its credit setting names. By default that is the site’s owners and editors, the deck’s owner and its collaborators; a deck can also be set to credit no one. Where a deck’s page names you, it shows your display name (or username) and your picture, if you’ve set one.

• Changing it: in the app, under Settings, you can change your username, and you can unsubscribe from a deck on its card. The app has no form for the other profile fields: they stay empty unless they were set through our API. To change or clear them, contact us (below).
• Removing it: deleting your account removes your profile page.

Some exercises are graded by AI, on our servers:

• Speaking: your recording is processed temporarily on our servers (in memory, or in a temporary file for a longer recording), sent to OpenAI to be turned into text, and deleted when that request finishes. It is never saved to your account or to our storage.
• Writing and spoken answers: your written text, or the transcript of what you said, is sent to OpenAI to be graded. We keep the scores and the level, not the text (except the practice answers you save, above, and any answer text quoted in a report you send us about an AI response; see below).
• We attach no account details (no username, email or account id) to these requests. Whatever you write or say in an answer is sent as you gave it, so if your answer includes your name or other personal details, OpenAI receives them too.
• If a site’s operator has connected its own OpenAI account, that account processes these requests instead of ours.
• ElevenLabs (and OpenAI as a fallback) read our own exercise texts aloud. They never receive your voice.

• To provide the service you signed up for (contract): your account, sign-in, your progress, grading, tests, live quizzes and purchases.
• With your consent: analytics cookies and the fuller analytics they allow, and the activity log of visitors without an account (see below). You can withdraw it at any time under “Cookie settings”.
• Our legitimate interests: keeping the service secure and working (logs, error reports, abuse prevention), answering feedback and improving the content, including the cookie-free activity log of visitors outside Europe who have not answered the cookie banner (see above), which shows us whether people really study here.
• Legal obligations: keeping purchase records for tax.

We do not sell your data, we show no ads, and we do not use your data for advertising.

• Heroku (Salesforce): hosts the site, its database and its cache.
• Cloudflare: the network in front of the site, and Cloudflare R2, where the site’s images, audio and video are stored, including media that a site’s authors and editors upload for its content. Learners’ recordings for grading are never stored there, and never kept in any permanent storage.
• Mailgun: sends our emails (sign-up, password reset, account deletion, and feedback and reports to our team’s inbox).
• Google Analytics 4: Google’s analytics script loads on our pages with Google Consent Mode, every signal set to denied until you choose. Before you accept, it sets no analytics cookies and sends only cookieless pings; accepting allows analytics storage. From your IP address, Google Analytics works out your approximate location (such as your country and city). Advertising storage and signals stay denied whatever you choose: no ads and no advertising ID. We send it no user id; it receives page views and events such as starting a test or completing a purchase (amount and order reference), never your answers.
• Sentry: error reports, so we can fix what breaks. We attach no user id to them, and a report never includes what you sent in the request that failed (such as an answer, an essay, a recording or its transcript, or an email address): it holds the address that was asked for, cut before any query (such as a search’s text), your browser’s details and the error itself.
• Pusher: the live connection of live quizzes. It receives your nickname (or display name), an anonymous or account id, and whether you are the host.
• Stripe: payments, through Stripe Checkout. Your card details go straight to Stripe and never reach us.
• OpenAI: AI grading, as described above.
• ElevenLabs: reading exercise texts aloud.
• Google or Metal Worlds: only if you choose to sign in with them.
• Some older images are still served by Cloudinary. Videos and players from other sites (such as YouTube) load only when you click them.

The people who run a site (its owners and editors, and the graders of a test) can see the results of the tests on their site, and may use an AI assistant they connect to read them.

Some of these providers process data in the United States or other countries outside your own. Where the GDPR applies, those transfers rely on the safeguards it provides for, such as an adequacy decision or the European Commission’s standard contractual clauses.

• Strictly necessary (no consent needed): sessionid keeps you signed in, csrftoken protects forms, kz_consent remembers your cookie choice, and a guest cookie lets you join a live quiz without an account.
• Analytics (set only once you accept): Google Analytics’ _ga cookies, and kz-session-id, the random identifier of the activity log of visitors without an account, kept in your browser’s local storage. They are deleted if you reject them.
• Local storage: your browser keeps settings (sound, language, chosen deck), progress waiting to be sent, and an exam session you are in the middle of. It stays on your device.

You can change your choice at any time under “Cookie settings” at the bottom of the home page.

On sites that take part in our creator program, a creator can recommend the site to you with a link or a handle (such as “/el_yucateco” at the end of the address, or “?ref=el_yucateco”).

• Referral consent: recording which creator recommended you is its own choice, “Referrals”, separate from analytics: accepting analytics does not cover it. In Europe (the EU, the EEA, the UK and Switzerland), and wherever we cannot tell your country, nothing about a referral is stored in your browser or your session, or counted, unless you give that consent, or click the button on a creator’s page that keeps their referral (which is consent for that purpose only). A creator’s handle you type in yourself, for example in “Who referred you?”, always counts: that is your own choice. Withdrawing your consent deletes a stored handle.
• What we keep: when you sign up, or make your first purchase, after a creator recommended the site, we link your account to that creator (a “binding”): which creator, the link and campaign it came through, how it arrived and when. The binding is kept for as long as your account exists, on the group of sites it was made on, and is deleted with your account. Clicks on a creator’s link are counted without storing any IP address.
• What the creator sees: totals (clicks, sign-ups and sales), with small numbers hidden. For each sale, their statement shows the date, the site, the course, the amounts and a pseudonymous tag that only tells two sales by the same buyer apart; never your name, email address or account. On sites made for children there is no tag.
• Sites made for children: a referral is recorded only when a parent buys, through the parent’s own account, and the handle is never stored in the browser.
• If you join the creator program: we keep your handle and creator profile, every version of the creator terms you accepted (with the date and language), your earnings and payouts, and the payee details you enter (legal name, postal address and tax id). Payouts through Stripe Connect are handled by Stripe, which holds your bank details; we never ask for them. If you delete your account, your creator profile is anonymised, and your earnings record, the terms you accepted and your payee details are kept, visible only to our staff, as the tax record of payments made to you (at least 7 years).
• People we invite to the creator program (the notice of Article 14 GDPR): we may record the contact details a creator or business has published (name, public channels and handles, a published business email address, country and language), where we found them, and a log of our contacts with them, to invite them to the program. Our legal basis is our legitimate interest in recruiting creators, or your consent where you gave it. We never cold-email anyone in Germany and never use automated direct messages. You can object at any time, and we then stop contacting you. The records of people who decline, or whom we have not contacted for 12 months, are deleted.

• Your account, progress and activity: until you delete your account.
• Server logs and error reports (Sentry): up to 90 days.
• Activity of visitors without an account: 90 days, unless the browser later signs up or signs in; it is then kept with that account’s activity. The daily random value behind the cookie-free log is thrown away after a day.
• Purchase records: at least 7 years, for tax.
• Feedback and reports: kept to handle them and improve the content. Deleting your account removes the link to you and your reply email, but the message and the text of a report (including any answer text it quotes) are kept.

You can delete your account at any time, in the app under Settings or on the web at c1german.cefrstudy.com/account/delete. It cannot be undone.

• Removed: your profile and sign-in details, linked Google or Metal ID sign-ins, your progress, results, attempts, streaks, notes, live quiz entries, saved practice answers, any AI keys you saved and the apps you connected. You are signed out everywhere.
• Kept without your account: decks and other content you wrote for a site, and feedback and reports you sent (the message and any reported or quoted text stay; the link to your account and your reply email are removed).
• Kept for tax and refunds: the record of any purchase, with the email address it was made with, for at least 7 years.

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. You can withdraw your consent to analytics at any time. Some of this you can do yourself: change your username in the settings, or delete your account.

Where the GDPR applies (in the European Economic Area, the United Kingdom and Switzerland), these are your rights under it, and you can also complain to your data protection authority. To use a right, contact us (below); we answer within one month.

Cefrstudy is meant for adults: you must be 18 or older to use it. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

When we change this policy we update the date at the top.

Questions about this policy, or a request about your data: