Privacy policy

10 Sentences (10sentences.com) is a website for learning German vocabulary. This page explains what personal data we collect, why, who handles it for us, and what you can ask of us.

Who is responsible

Muhammad Naufil
Email: [email protected]

Write to this address about anything on this page, including the requests listed under “Your rights”.

What we collect and why

Your account

When you sign in with Google, we receive your name, email address and profile picture from Google. When you sign in with an email link, we receive your email address. We use these to create your account, keep you signed in and show your name where you choose to appear. Legal basis: providing the service you signed up for (Art. 6(1)(b) GDPR).

Your learning

We save what you do on the site so you can continue where you left off: the sentences and answers you write, the corrections and scores they receive, your flashcard and revision progress, your learning plan, your streak, and any reports you send us about an exercise. Legal basis: providing the service (Art. 6(1)(b) GDPR).

Pro

If you subscribe to Pro, Polar (polar.sh) sells the subscription to you as our reseller: it collects your payment details, billing address and email address, and is responsible for them under its own privacy policy. We never see your card details. We receive from Polar whether you have a subscription, which plan it is, until when it runs and Polar’s customer number for you, and we keep when your free week ends. Legal basis: providing the service (Art. 6(1)(b) GDPR).

Chats

If you use the chat, we save the profile you fill in (city, level, job and hobbies) and your messages. If you choose “Use my location”, your position is rounded to about 10 km to place you on the globe. Rounded this way, it can’t locate you precisely. The chat partners are AI, not people. Legal basis: providing the service (Art. 6(1)(b) GDPR).

What other learners see

The leaderboard and the chats show your first name and the first letter of your last name (for example “Anna S.”). Your email address is never shown to anyone.

Emails

We send sign-in links when you ask for them, and now and then an email about new features of the site. You can stop the feature emails at any time by replying “unsubscribe”. Legal basis: providing the service for sign-in links (Art. 6(1)(b) GDPR); our legitimate interest in telling you about the service you signed up for, for feature emails (Art. 6(1)(f) GDPR).

Analytics

We use Google Analytics to count visits and see which pages are used. Google Analytics sets cookies (named _ga…) and receives your IP address, your browser and device type, and the pages you view. You can block it with your browser’s privacy settings or an ad blocker; the site works the same without it.

Technical logs

Our hosting provider records technical information for each request, such as your IP address and the time. We use it to keep the site running and secure. Legal basis: our legitimate interest in a working, secure site (Art. 6(1)(f) GDPR).

Cookies and storage in your browser

• A sign-in cookie that keeps you signed in. It’s needed for your account to work.
• A cookie that remembers your choice between learning to recognise words and learning to use them.
• Small notes in your browser’s storage, such as where you stopped in a story or an exercise. They stay on your device.
• Google Analytics cookies, as described above.
• YouTube clips play in YouTube’s privacy-enhanced mode. Once you play one, YouTube may set its own cookies and receive your IP address.

Who processes data for us

We use these services to run the site. They only get the data they need for their part.

• Railway hosts the site and its database.
• Google provides “Sign in with Google”, Google Analytics, and the YouTube player for the video clips.
• Resend sends our emails (sign-in links and feature emails).
• OpenRouter, and the AI model provider it passes requests to, checks your sentences, writes the chat partners’ replies and translates the video sentences. For this they receive the text you write and, in chats, your first name, your chat profile and the words you’ve been learning. Your email address is not sent.
• OpenStreetMap (Nominatim) turns your rounded position into a city name, only when you choose “Use my location” in the chat.
• RSS.com hosts the audio of the stories, which plays from their servers.
• Polar sells Pro subscriptions as our reseller and handles their payments, as described above. For this it receives your account id and email address from us.

Some of these companies are based in the United States, so your data may be processed there. Where that happens, the transfer is covered by the EU–US Data Privacy Framework or by the European Commission’s standard contractual clauses.

How long we keep it

We keep your account and learning data for as long as you have an account. If you ask us to delete your account, we delete it, including your progress, chats and chat profile, usually within 30 days. Google Analytics deletes its data automatically after the retention period set in our Google Analytics account (2 or 14 months). Technical logs are kept by our hosting provider for a short time.

Your rights

Under the GDPR you can ask us to:

• tell you what data we have about you and give you a copy;
• correct data that’s wrong;
• delete your data and your account;
• limit how we use your data, or give it to you in a format you can take elsewhere;
• stop using your data where we rely on our legitimate interest (you can object to this at any time).

Where you gave consent, you can withdraw it at any time. To use any of these rights, email [email protected]. You can also complain to a data protection authority, for example the one in the country where you live.

Children

10 Sentences is meant for people aged 16 and over.

Changes

If we change how we handle your data, we’ll update this page and the date at the top. See also our terms of service.