Privacy Policy

We collect the following categories of data, tied to your account:

• Email address — used for sign-in (magic link) and account identification.
• Display name and profile image — shown on your public profile and the ranking leaderboard, if you have one.
• Quiz history and answers — which questions you were asked, what you answered, and whether it was correct.
• Progress and mastery data — XP, streak, CEFR level, hearts, per-topic mastery scores, and spaced-repetition scheduling state (when each word/phrase is due for review).
• Writing submissions — the text you write for the Writing exercise, and the AI-generated feedback on it.
• Conversation messages — what you type in the Conversation exercise, and the AI character's replies.
• Content reports — if you flag a word/phrase as wrong for your dialect.
• Usage events — a small set of first-party product-analytics events (e.g. completing a lesson, leveling up); we do not use any third-party analytics or advertising trackers.
• IP address — read briefly to rate-limit sign-in requests (stopping spam/abuse of the magic-link email), held only in server memory for a short sliding window, never written to the database.

Text you submit through the Writing and Conversation exercises is sent to a third-party AI model, routed through OpenRouter, to generate the feedback or reply that feature is built around. The list below is generated directly from our live configuration, one entry per AI-powered feature:

• Writing feedback (grammar/vocabulary correction on text you submit) — DeepSeek (deepseek/deepseek-chat), via OpenRouter
• AI conversation partner (roleplay chat — processes what you type) — DeepSeek (deepseek/deepseek-chat), via OpenRouter
• Conversation feedback (grammar notes on your chat messages) — DeepSeek (deepseek/deepseek-chat), via OpenRouter
• Quiz mistake explanations (your submitted answer, briefly) — DeepSeek (deepseek/deepseek-chat), via OpenRouter
• CEFR difficulty classification of course content (not your personal data) — DeepSeek (deepseek/deepseek-chat), via OpenRouter
• Grammar reference generation (course content, not your personal data) — DeepSeek (deepseek/deepseek-chat), via OpenRouter
• Example sentence generation (course content, not your personal data) — DeepSeek (deepseek/deepseek-chat), via OpenRouter
• Conversation scenario generation (course content, not your personal data) — DeepSeek (deepseek/deepseek-chat), via OpenRouter
• Vocabulary word generation (course content, not your personal data) — OpenAI (openai/gpt-4o-mini), via OpenRouter
• Example phrase generation (course content, not your personal data) — OpenAI (openai/gpt-4o-mini), via OpenRouter

Beyond the AI providers above, the following third parties process data on our behalf:

• Resend — delivers transactional email (magic-link sign-in, streak-risk reminders); receives your email address and, for sign-in, a one-time login link.
• Stripe — payment processor for "SwissLearn Plus" subscriptions. The billing integration exists in the app but is currently switched off (see section 5 of the Terms of Use); if it is ever turned on, Stripe will process payment details directly and we never see your card number.
• Hosting/database — the app runs on Vercel, with a PostgreSQL database, both processing data as necessary to run the service.

To run the core product: authenticate you, track your progress, schedule spaced repetition, generate AI feedback, and show your public profile/ranking if you choose to share it.

To keep the service reliable and safe: rate-limiting sign-in requests, reviewing content reports.

To email you: sign-in links, and (optionally, based on your activity) a reminder if your streak is about to end.

We keep your data while your account is active. You can request deletion at any time from Settings — no need to email us.

The moment you request deletion: your Writing submissions and Conversation sessions (the sensitive, AI-facing text) are deleted immediately, and you are signed out of every active session. The rest of your account — profile, quiz history, progress — is permanently deleted 30 days later, which gives you a short window to cancel the request (also from Settings) if you change your mind.

Data already sent to a subprocessor before deletion (e.g. an email delivered via Resend, a payment recorded by Stripe if you were ever a paying subscriber) is retained by that subprocessor under its own policy — we cannot force-delete it retroactively.

Because SwissLearn has an international audience, we apply GDPR- and LGPD-style rights to every user, regardless of where you are:

• Access — download a copy of your data (account, progress, quiz history, writing, conversations) as JSON, from Settings.
• Deletion — request account deletion self-service, from Settings (see section 5).
• Correction — edit your display name in Settings; contact us for anything else you can't edit directly.
• Portability — the same data export mentioned above is provided in a machine-readable format.
• Objection / restriction — contact contact@learn.emanuelvini.dev; we don't yet have a self-service flow for this.

The AI providers listed in section 2, and some other subprocessors, may process data outside Switzerland, the EU, or Brazil. [Placeholder — this deployment has not completed a Standard Contractual Clauses / adequacy review; a lawyer should assess this, especially given DeepSeek's use as an AI provider (see section 2), before relying on this policy for EU users.]

SwissLearn requires users to self-declare that they are at least 16 years old at sign-up. We do not knowingly collect data from users below that age. If you believe a younger user has created an account, contact us and we'll remove it.

We use a session cookie (via Auth.js) to keep you signed in, and a short-lived cookie to record that you checked the consent boxes on the sign-in page right before creating an account. We don't use third-party advertising or tracking cookies. The app also uses your browser's local storage for a few non-essential UI preferences (like your theme).

We may update this policy as the product changes. We'll update the "last updated" date above; if we start charging users or add a new subprocessor, we'll call that out more prominently.

Questions about this policy, or to exercise a right listed above: contact@learn.emanuelvini.dev