What Speak Serbian processes

Controller

The controller under the GDPR is the operator named in the Imprint. Name, postal address and contact details are listed there.

Imprint

Signing in

During the beta, access is granted one person at a time by hand. Your e-mail address is stored in an invitation for that purpose; without such an invitation no account and no session is created. When you sign in, the application sends a six-digit one-time code to exactly that address. The code is stored only as a hash, expires after ten minutes and is invalidated after three failed attempts. There is no password; the database explicitly refuses to store one.

Your address is a sign-in credential and nothing more. All study data hangs off an internal, immutable identifier, never off the address. The address is used for your account, for the invitation and for sending the one-time code — nowhere else.

After a successful sign-in, a session is stored on the server. The session record holds a session token, timestamps, and the IP address and browser identification (user agent) of the device signing in. A session expires after 30 days at the latest.

Signing in with Google

The application can offer Google as a second way in. That route exists only if the operator has configured it, and it is used only if you choose it yourself. If you do, Google learns that you sign in here, and the application then stores your Google account identifier, the issuer, the granted scope and the tokens Google issues. This route, too, works only with an existing invitation for the same address.

Study data

Everything about your learning hangs off your internal identifier: study sessions with their start, time budget and end; a running review log with the phrase identifier, exercise type, direction, your self-assessment and the time you took; the scheduler's card state; your settings such as language, time zone, motion, audio and keyboard preferences; and a log of the corrections you have acknowledged on a card.

The review log is append-only on purpose: the database refuses updates and deletions of individual rows. That keeps your learning history trustworthy, but it also means a single row cannot be corrected after the fact.

If you create an appointment, the application stores a date, a situation and a short label of up to 80 characters that you write yourself. Do not put anything in there that should not be stored.

Feedback and content reports

You can send feedback about the application and reports about individual study items. Both are stored and contain your free text of up to 2000 characters, plus your internal identifier, the category or the reported surface, the interface language, the release, a coarse route category and the time. If you report something broken, the technical correlation id of that request is added.

The operator is notified by e-mail when a report arrives. That notification carries metadata only — report id, category or phrase identifier, interface language, release, route category and time. Your free text is not included in the mail; it stays in the database. The recipient address is fixed by the platform binding, so a report cannot redirect operator mail elsewhere.

Learning observations

The application contains a separate, one-way path for learning observations. It is controlled by an environment switch and is off by default; without an explicit activation nothing is collected.

When it is on, each practice attempt writes an event with a fixed set of fields: environment, exact release, data origin, corpus digest, phrase identifier and revision, exercise type, practice phase, direction, the cue language, the result, your self-assessment, a bounded duration and two flags for whether help or the reveal was used.

Not included: your e-mail address, answers you typed, audio, free text from feedback, and mailbox details. Where these events need to attribute a person, they do so through a keyed HMAC-SHA-256 value of your address rather than the address itself. The path is one-way and never changes your study data.

Technical logs

When a technical error occurs, the server writes a log entry with a random correlation id, the release, a coarse route category from a fixed list, the HTTP method, the status code and the name of the error class. The requested path itself is not retained, and the thrown value is never copied into the log. The hosting platform's invocation logs are switched off, as is the sign-in library's own logger.

To be straight about it: that covers the logs this application writes itself. It does not prove that the hosting platform records nothing further about requests through other means.

Cookies and local storage

Only strictly necessary cookies are set. There are no analytics, advertising or tracking cookies, no third-party cookies, and therefore no consent banner.

• Sign-in session, so that you stay signed in.
• Short-lived note during sign-in recording which address the code went to; it expires after ten minutes.
• Interface language for this device, valid for one year.
• Chosen colour theme for this device, valid for one year.
• Short-lived progress marker inside a running study session, valid for 15 minutes.

Your browser also keeps two small interface details locally — whether the keyboard hint has been shown, and, in the review view, the reviewer name last entered. Neither leaves your device.

Service providers

The application runs entirely on Cloudflare. It uses Cloudflare Workers as the runtime, two Cloudflare D1 databases for the application and the shared account data, Cloudflare Email Sending to deliver the one-time code and the operator notification, and Cloudflare Email Routing for incoming mail. Nothing else is wired in: there is no third-party analytics tool, no fonts or scripts embedded from foreign servers, and no payment processing.

Purposes and legal bases

• Account, sign-in and study data: performance of the usage relationship, Art. 6(1)(b) GDPR.
• Session records, technical logs and abuse prevention: legitimate interest in a working and secured service, Art. 6(1)(f) GDPR.
• Feedback and content reports: legitimate interest in improving the service, Art. 6(1)(f) GDPR; the free text is yours to decide.
• Signing in with Google: only where you choose it, Art. 6(1)(a) GDPR.

Retention

Account, study and report data stay stored as long as your access exists. One-time codes expire after ten minutes, sessions after 30 days at the latest. There is currently no automatic deletion period beyond that; deletion happens on request or when the beta ends.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with a supervisory authority.

Plainly: this application has no self-service function for any of that. There is no button to download your data and none to delete your account. Send your request to the contact address in the Imprint; the operator carries it out by hand in the database. So expect a handled answer rather than an instant one.

Rectification carries the limitation named above: the review and correction logs are append-only, and individual rows cannot be edited in them. Rectifying there means deleting the affected records rather than rewriting them.