Privacy notice

Last updated: 12 October 2026

Who is responsible

the operator of Learnheim, a private test project. Email: support@learnheim.com. See the imprint.

What we store and why

• Your account: email address, a salted hash of your password (never the password itself), when you signed up, confirmed your email and were last active. Needed to provide the service (Art. 6(1)(b) GDPR).
• What you add: the texts you paste, the narration generated from them, the words you save, your reviews and reading progress. Only you can see them. Needed to provide the service (Art. 6(1)(b)).
• Feedback you send us: your message, its type and where in the app you sent it from, and our reply. Read by our team to answer and improve the app (we see your message, not your email address; replies go out through the app). Kept until you delete your account (Art. 6(1)(b) and (f)).
• Usage counts: per day, how many requests, word lookups and articles you made, to enforce fair daily limits and keep costs in check. Counts only, no record of what you read. Kept about 13 months (Art. 6(1)(b) and (f)).
• Security: sign-in attempts with email address and IP address, to stop password guessing (kept 2 days), and the hosting provider's request logs with IP address (kept up to 30 days). Legitimate interest in a secure service (Art. 6(1)(f)).

Cookies

One cookie keeps you signed in. Other cookies only remember settings you choose, such as the theme and the language of the interface. All are strictly necessary for what you asked for, so no consent banner is needed. The Android app keeps its sign-in token and your settings on your phone instead. There is no advertising and no tracking across sites.

Visit statistics

On the website, Cloudflare Web Analytics counts visits: page, referring site, browser and device type, country and loading time. It sets no cookies, doesn't follow you across sites and doesn't identify you; we only see totals. Purpose: to see how the site is used and keep it fast (legitimate interest, Art. 6(1)(f) GDPR). The Android app has no such statistics.

Service providers

• Google Cloud (Google Ireland Ltd.): hosting, database and file storage in Frankfurt, Germany; text-to-speech turns your texts into narration.
• Google Gemini API: the sentences of a text are sent once to translate them and to pick the right dictionary meaning of words that have several; when you tap a word, the word and its sentence may be sent to explain a word the dictionary doesn't have; feedback you send us is sent once to sort it by topic and urgency. Paid API use, not used to train Google's models.
• Brevo (Sendinblue SAS, Paris, France): sends the confirmation and password-reset emails from noreply@learnheim.com, so it receives your email address and the email's content.
• Cloudflare (Cloudflare, Inc.): our domain learnheim.com and its DNS; every request to the site passes through Cloudflare's network (which sees your IP address and the request), and it forwards emails sent to support@ and privacy@learnheim.com to our inbox; visit statistics (above).

Google and Cloudflare may process data outside the EU; transfers are covered by the EU Commission's adequacy decision for the EU-US Data Privacy Framework and standard contractual clauses. The dictionary comes from Wiktionary (via kaikki.org) and is stored with the app; looking up words sends nothing to Wiktionary.

Signing in with Google or Facebook

If you choose to, you can sign in with your Google or Facebook account instead of a password. Nothing is loaded from Google or Facebook until you click one of those buttons; you are then sent to their sign-in page and back. We then receive from them your email address and an account number for Learnheim; we store the account number to recognise you next time and never post anything or read anything else. Google and Facebook see that you signed in to Learnheim (their privacy policies apply to that). Needed to provide the service you chose (Art. 6(1)(b) GDPR).

How long we keep it

Until you delete it. Deleting an article removes it and its narration. Deleting your account removes everything above at once, apart from logs that expire on their own as described. Backups of the database are kept 7 days.

Your rights

You can ask for access to your data, correction, deletion, restriction or a copy (portability), and you can object to processing based on legitimate interest. Write to privacy@learnheim.com. You can delete your account yourself at any time under Account (how). You can also complain to a data protection supervisory authority.