Privacy

What this site stores about you

In the browser: your progress. That includes the exercises you have answered, the Leitner box of each exercise, your saved list, your daily goal, the personal goal you set on the account page (sl.lernziel), your Glimo (points and level), your Lingua Coins and what you unlocked with them, your profile (avatar, frame, title), the stamps in your language passport, the topic you opened last, the colour scheme you chose and the reading voice you chose. It sits in your browser’s local storage (localStorage), never leaves your device and is not sent to any server. You can delete it at any time on the progress page.

A user account is optional (see Account). Without an account there is no sign-in and no cookie, and your progress does not leave your device.

For the icon on your home screen, the browser also keeps, under sl.app, how many practice rounds you have finished (the suggestion to install comes after the third at the earliest), whether you have dismissed that suggestion, and which language pair you last studied, so that the icon’s shortcuts lead there. The number of due reviews on the icon is worked out by your device from your progress; it is not transmitted, and there are no push notifications. If the site offers you a calendar file as a reminder after a round, it also keeps there the day of that offer (erinnerungTag, so that it comes at most once a day) and whether you downloaded the file or declined it; if you hide the topic of the week, that is noted there too. Which short fact about the language you last saw after a round is kept per language pair under sl.wusstest.*, so that next time you get a different one.

Offline storage

So that the site keeps working without a connection, your browser stores copies of the pages you have opened, the stylesheet, the scripts, the fonts and the exercise data in its own storage (Cache Storage, managed by a service worker). These are files from this site only — nothing about you, no answers, no progress, no identifier. Nothing is reported to a server in the process either. It is only set up once you study here: after your first answered exercise, or when you take a language pair offline on the practice page. If you only read, nothing is stored.

On the practice page there is a button that stores the language pair you are learning in advance — and others, if you like; without it, only what you have opened anyway is kept. Before that, the page asks your browser how much storage is free (navigator.storage.estimate()) and asks it not to delete what was stored on its own (navigator.storage.persist()); both stay on your device. Which language pairs you took with you is remembered by your browser in the same storage. On the same page you remove each pair again individually; you delete all of it with this site’s browsing data — in every browser in the same place as the cookies, which do not exist here.

Account (optional)

Without an account everything stays in your browser, as described above. If you create an account, your progress is also stored on this site’s server so that it is the same on all your devices.

What is stored: your email address; your password only as a hash (Argon2id) — nobody knows the password itself; your progress, as described above, with a version number and up to 5 earlier versions as a fallback; the interface language, so that emails reach you in your language; when the account was created and when you last signed in; for Premium, the expiry date. No name, no postal address, no payment data. Your progress also includes your settings (such as the daily goal, colour scheme and reading voice), each with the time it was last changed, and for each study day how much was practised on which of your devices — the devices appear there only as a random identifier. In addition, for each signed-in device, a rough description such as “Firefox · Windows” and when it was first and last used; no IP address. If you change your address, the new one too, until it is confirmed (at most 24 hours).

Purpose and legal basis: to provide the account, i.e. to synchronise your progress between your devices — Art. 6(1)(b) GDPR (contract for the use of the account).

Cookies: when you sign in, the site sets a session cookie (el_konto, valid for up to 90 days and extended when used) and a cookie against forged requests (el_csrf). Both apply only to the path /api/, cannot be read by scripts and are technically necessary for the account (Section 25(2) no. 2 TDDDG); no consent is required for them. In local storage, under sl.konto, the browser keeps whether you are signed in, your email address for display and the state of the last synchronisation. There is also the cookie el_geraet (a random identifier of this browser, valid for two years, stored on the server only as a hash), so that you are notified when someone signs in from a new device. sl.konto also holds a check value for your account (not the address), so that after switching accounts no progress is mixed with someone else’s, and the value against forged requests; the email address stays there only while you are signed in. Under sl.geraet the browser keeps its random identifier for counting per device.

Protection against abuse: to stop passwords being guessed, the site briefly counts how often sign-in has been attempted from an IP address or for an email address. Only an encrypted check value (HMAC) is stored for this, not the address itself, and it is deleted after 24 hours — Art. 6(1)(f) GDPR, the legitimate interest in a secure account.

Emails: only about your account — to confirm your address (and one reminder about it after five days), when you request a new password, a notice when you sign in from a new device, when you change your address a link to the new one and a notice to the old one, and two warnings before an unused account is deleted. No advertising, no newsletter.

Where the data is kept: in a database at this site’s host (Hostinger International Ltd., 61 Lordou Vironos Street, Lumiel Building, 4th floor, 6023 Larnaca, Cyprus). No other service is involved. The connection is encrypted (HTTPS). In addition, the daily backup copy of the database is sent encrypted (AES-256) by email to a mailbox of the operator, so that nothing is lost if the server fails. It can only be read with a password that only the operator knows; there too it is deleted after 30 days.

Retention and deletion: until you delete the account. You can do that yourself at any time on the account page — immediately and with everything stored for it. The daily backup copies of the database are deleted after 30 days; until then, deleted data may still be in them, and likewise in the host’s backups according to its own periods. Accounts whose address was never confirmed are deleted after seven days. An account with which you have not signed in or studied for 24 months is deleted; beforehand you receive two warnings by email (30 and 7 days before), and signing in once is enough to keep it. No account is deleted for this reason without a delivered warning. An unconfirmed address receives a reminder after five days.

Counts without personal reference: for its own evaluation the server counts per month how many accounts were created (and from which notice on the site), how many of them were confirmed and still used after 1, 7 and 30 days, and how many were deleted. Only these numbers are stored — no row points to an account. No cookie and no tracking.

Access by the operator: in a password-protected administration view that is not public, the operator can see the accounts: email address, when an account was created and last used, whether the address is confirmed, how many devices are signed in, Premium, and how large the stored progress is — for a single account also how many entries it contains, but not the entries themselves. This serves only to run the accounts (answering questions, finding faults, detecting abuse) and the overall figures of the evaluation; nothing additional is stored for it, and the view does not show password hashes, session keys or confirmation links — Art. 6(1)(b) and (f) GDPR.

Access and portability: on the account page you can download everything stored for your account as a file (Art. 15 and 20 GDPR).

Learning together: learning partners and classes (optional)

Learning partners: Anyone with an account can invite another account. Only the two accounts and one nickname each, chosen by yourselves, are then stored; for an open invitation also an encrypted check value (HMAC) of its code and its expiry after seven days. What one partner sees of the other – the nickname, whether they learned today, their streak and the shared streak – is calculated from the accounts’ progress on every request and not stored separately. There are no messages, no free text apart from the nickname and no notifications; at most three partners per account.

Classes: A teacher with an account creates a class. Stored are its name, the language pair, a join code, when it was created and last opened, the teacher’s account and the assignments (topics of the language, whether with a worksheet, an optional date). Anyone joining enters the code and a nickname. With an account, the membership is linked to the account. Without an account – which is how it is meant for children – the server stores only the nickname and the hash of a random key of that device; the browser keeps the key itself under sl.klassen. No email address, no password, no name.

What the teacher sees: for each nickname, how many topics of the language pair are marked as understood, which of the assigned topics are among them, the last day with an answer, the streak and whether the figures come from an account or a device. For a membership with an account, the server calculates these figures from the synced progress; a device without an account sends exactly these figures when the account page is opened on it, and never otherwise. The teacher never sees an email address, individual answers or times of day. Members see the class name and the assignments, but no other members.

Purpose and legal basis: to provide the function you asked for – Art. 6(1)(b) GDPR. To prevent codes from being guessed, an encrypted check value of the IP address and of the account is briefly counted, as for the account (at most 20 wrong codes per hour and IP address, deleted after 24 hours) – Art. 6(1)(f) GDPR. A code has ten characters out of 31 possible ones, which gives more than 800 trillion combinations.

Use in schools and children’s data: If a school or teacher uses classes in lessons, this is processing by the school: it decides on the use, is responsible for it and determines the legal basis, for example under the school law of its state or country. Under Art. 8 GDPR, a child in Germany can consent to such a service on their own only from the age of 16; before that, where consent is the legal basis, the consent of the parents or guardians is needed – the school obtains it. This is why joining without an account is provided, with nothing more than a nickname, and why the nickname should not be a real name. Questions about a class are answered by the school; the operator can also tell you what is stored here (see the legal notice).

Retention and deletion: A partnership ends with one click, and then everything shared is deleted; open invitations expire after seven days. “Leave class” deletes the membership immediately. The teacher can remove members and delete the class – members and assignments are then deleted with it. Deleting your account also deletes your partnerships, memberships and your own classes. Deleted automatically are members without an account whose device has not reported anything for 400 days, and classes their teacher has not opened for 400 days. Like the rest of the account data, this information is also included in the daily backup copies of the database and disappears from them when those copies expire.

Access: The file you download on the account page also contains your partnerships, classes and memberships. Without an account, the account page in this browser shows which classes the device belongs to and under which nickname.

Visitor counting

This site counts for itself how often it is visited — without a third-party service, without a cookie and without an account. Each page view records: the address visited, the kind of page, the window width, how long it was visible and whether any practice took place. For an exercise it records that an answer was given and whether it was right — never which exercise.

On the start pages, the site also counts which steps are used — for example a sample question answered, a daily goal chosen or which way on was clicked afterwards — together with the rough window width (narrow or wide) and whether your browser already holds a learning record (none, younger or older than a week). These reports consist only of words from a fixed list and carry no identifier: neither the session identifier nor a visitor identifier. Your learning record itself is not transmitted.

Whether people stay. If you have already learned something here, your browser works out from your progress which day since your first visit it is. If you practise on day 0, 1, 7 or 30, it sends one report for each, with exactly two pieces of information: the calendar week of your first visit and the day (for example “2026-W42, day 7”). No page, no session and no visitor identifier — this only counts how many browsers from a given week come back, not which ones. Your browser notes under sl.kohorte which reports it has already sent. Do Not Track, Global Privacy Control and the objection on this page apply here too.

How many devices. The server cannot know how many different devices were here on a day, in a week or in a month — the visitor identifier changes every night. So your browser itself notes under sl.aktiv for which day, which calendar week and which month it has already been counted (in Coordinated Universal Time, UTC). On the first page view of a new day it sends exactly one report: the day, plus the week and the month if those are new for it too, and whether it is here for the first time (for example “2026-10-21, 2026-W43, no new month, not new”). No page, no session, no visitor identifier and no IP address; the time is rounded down to the full hour. This only counts how many devices were here in a period, not which ones — it does not make you recognisable. Do Not Track, Global Privacy Control and the objection on this page apply here too; if you have objected, the note is not stored either.

There are two identifiers. The session identifier lives in sessionStorage and is gone when you close the tab. The visitor identifier is formed by the server as a checksum of IP address, browser string and a value (a salt) that changes every day at midnight Coordinated Universal Time (UTC); the IP address itself is not stored. After that change the same visitor is a different one — returning visitors are therefore not hard to recognise but impossible.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is to see which pages and exercises are used, in order to improve what the site offers. Your interests are protected by the way the counting is built: no cookie, no stored IP address, a visitor identifier with a salt that changes daily, Do Not Track and Global Privacy Control respected, and the switch for objecting further down. The reports are kept on the server in one file per calendar month (in Coordinated Universal Time, UTC). Each monthly file is deleted as soon as its month is 25 months in the past — the one for October 2026, for example, in November 2028. That is how long the analysis needs them: its longest period is one year, which it compares with the year before.

Do Not Track and Global Privacy Control are checked and respected before the first report. You can also object here:

Whether visitor counting of this kind is lawful in Germany without consent is disputed among experts: § 25(1) TDDDG generally requires consent for storing the session identifier in the browser, and the exception in subsection 2 is a matter of interpretation. This site does not claim the question is settled — it sets out what its assumption rests on.

Reminder, topic of the week and progress card

After a practice round you can download a calendar file (.ics). It is made in your browser and ends up in your calendar, not with us. Under sl.app the browser also notes whether you downloaded or declined it and on which day it was last offered, and whether you hid the topic of the week. The progress card is an image your browser draws from your progress when you press “Create image”; it contains no name and no identifier and leaves your device only if you share or save it yourself. None of this is sent to our server.

Mistake reports

With “Report a mistake” you can send us a mistake in the content. Nothing is sent until you press “Send”, and only what is in the form: the address of the page, the section, the kind of mistake, your text (200 characters at most) and the interface language. We store this with date and time in a file outside the public directory and read it through a password-protected report. Your IP address, your browser identification, cookies and identifiers are not stored. To stop the form from being flooded, the server forms a check value from your IP address and a key that is created anew every day (UTC), and uses it to count that day’s reports; the previous day’s key and counter are deleted with the next report. There is no email and no reply — please write nothing personal in the text. The legal basis is our legitimate interest in content without mistakes (Art. 6(1)(f) GDPR). Reports are deleted after twelve months.

Controller

DELISORIA GbR
c/o Smarvo 295
Südstraße 31
47475 Kamp-Lintfort
Deutschland
Email: contact@delisoria.com

Server logs

This site is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, Lumiel Building, 4th floor, 6023 Larnaca, Cyprus. When a page is requested, log data is generated there for technical reasons (including IP address, time and the file requested). The legal basis is Art. 6(1)(f) GDPR — the legitimate interest in secure operation. Retention period: Hostinger does not state a fixed period. In the operator’s customer area the logs can be viewed for the last 7 days at most; how long the host keeps them beyond that depends on its own rules for secure operation.

Contact by email

If you write an email to contact@delisoria.com, the operator processes your email address and the content of your message in order to deal with your enquiry. The legal basis is Art. 6(1)(b) GDPR where it concerns a contract or steps towards one, and otherwise Art. 6(1)(f) GDPR — the legitimate interest in answering enquiries. The message is deleted once your enquiry has been dealt with, unless a statutory retention obligation requires otherwise.

Contact form

If you use the contact form, the operator processes the details you enter — your email address, your message and, if given, your name — in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where it concerns a contract or steps towards one, and otherwise Art. 6(1)(f) GDPR — the legitimate interest in answering enquiries. The message is not stored on this site’s server; when you send it, it is forwarded as an email to contact@delisoria.com and from then on exists only in that mailbox. It is deleted there once your enquiry has been dealt with, unless a statutory retention obligation requires otherwise.

To prevent mass abuse, the server counts how many messages arrive from one connection in a day. For this it does not store your IP address, only a check value formed from it and a random value that is newly generated every day; the counter and the random value are deleted the following day. The legal basis is Art. 6(1)(f) GDPR — the legitimate interest in secure operation. No cookie is set.

External services

None. Fonts, scripts and data are on the same server as the site; no content is loaded from other servers.

Reading aloud

Next to sentences in the language you are learning there is a speaker button. It uses your browser’s speech output (speechSynthesis); this site loads nothing for it and does not itself send anything to any third-party server.

Which voices are available is determined by your browser and your operating system. This site reads the list your browser gives it and picks the most natural voice from it. That may be an online voice: with one of those, your browser sends the sentence to a service run by its maker, which generates the speech. Whether that happens, and what that service does with the sentence, is up to the browser maker; their privacy notice applies.

On the progress page you can choose a different voice. Voices your browser identifies as online voices are marked there; if you do not want an online voice, choose an on-device voice there. If the voice in use sounds poor, the site shows a note once explaining how to install a better one.

Speech happens only when you press: without a click on the speaker nothing is spoken and nothing is handed over. What is then handed to your browser is the sentence the button belongs to — nothing else, in particular nothing about which page you are reading and nothing from your progress.

The voice you chose (one per language you are learning) and whether you closed the note are kept only in your browser’s local storage (localStorage); the fact that the note has already been shown in this session is kept in session storage (sessionStorage) and is cleared when you close the tab. None of it leaves your device. You can delete it along with this site’s browsing data.

Speaking studio and microphone

On the speaking studio page you can record yourself while repeating sentences. The microphone is only requested when you press “Record” there; your browser then asks you whether the page may use it. Without that permission nothing is recorded, and you can withdraw it at any time in your browser’s settings.

The recording is made in your browser (MediaRecorder) and exists only in the memory of this tab. It is not uploaded, not sent to any server and not saved — neither on the server nor in your browser’s storage. It is discarded with the next recording and when you leave the page. The page switches the microphone off as soon as you leave it, after one minute without recording, or when you press “Turn the microphone off”.

Your browser works out the waveform and pitch itself (Web Audio API). No speech recognition is used, and no service listens in. The model is spoken by your browser’s speech output, as described above under “Reading aloud”. Because your voice does not leave your device, the operator of this site does not process it.

The only thing saved is your own rating per sentence (“Sounded the same”, “Almost”, “Not yet”) together with the day the sentence is due to come back — in your browser’s local storage (localStorage), as part of your progress. It does not leave your device and is deleted together with your progress.

Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability under Art. 15 to 20 GDPR. The right to object under Art. 21 GDPR is set out separately in the box below. Your point of contact is the party named in the legal notice.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in the country where you live. The authority responsible for the operator is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (the data protection commissioner of North Rhine-Westphalia), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

You are under no statutory or contractual obligation to provide this site with any data. Without the data that arises in the server logs when a page is requested, however, the server cannot technically deliver the page.

There is no automated decision-making, including profiling (Art. 22 GDPR).

Last updated: October 2026