Privacy

What this site stores about you

In the browser: your progress. That includes the exercises you have answered, the Leitner box of each exercise, your saved list, your daily goal, the personal goal you set on the account page (sl.lernziel), your Glimo (points and level), your Lingua Coins and what you unlocked with them, your profile (avatar, frame, title, the look you chose for the site and your goal item), the stamps in your language passport, the topic you opened last, the colour scheme you chose and the reading voice you chose. It sits in your browser’s local storage (localStorage), never leaves your device and is not sent to any server. You can delete it at any time on the progress page.

A user account is optional (see Account). Without an account there is no sign-in, and your progress does not leave your device. Without an account the site sets a cookie only when you open the account page or join a class: el_csrf, against forged requests (see the overview below).

For the icon on your home screen, the browser also keeps, under sl.app, how many practice rounds you have finished (the suggestion to install comes after the third at the earliest), whether you have dismissed that suggestion, and which language pair you last studied, so that the icon’s shortcuts lead there. The number of due reviews on the icon is worked out by your device from your progress; it is not transmitted, and there are no push notifications. If the site offers you a calendar file as a reminder after a round, it also keeps there the day of that offer (erinnerungTag, so that it comes at most once a day) and whether you downloaded the file or declined it; if you hide the topic of the week, that is noted there too. Which short fact about the language you last saw after a round is kept per language pair under sl.wusstest.*, so that next time you get a different one.

Offline storage

So that the site keeps working without a connection, your browser stores copies of the pages you have opened, the stylesheet, the scripts, the fonts and the exercise data in its own storage (Cache Storage, managed by a service worker). These are files from this site only — nothing about you, no answers, no progress, no identifier. Nothing is reported to a server in the process either. It is only set up once you study here: after your first answered exercise, or when you take a language pair offline on the practice page. If you only read, nothing is stored.

On the practice page there is a button that stores the language pair you are learning in advance — and others, if you like; without it, only what you have opened anyway is kept. Before that, the page asks your browser how much storage is free (navigator.storage.estimate()) and asks it not to delete what was stored on its own (navigator.storage.persist()); both stay on your device. Which language pairs you took with you is remembered by your browser in the same storage. On the same page you remove each pair again individually; you delete all of it with this site’s browsing data — in every browser in the same place as the cookies.

Account (optional)

Without an account everything stays in your browser, as described above. If you create an account, your progress is also stored on this site’s server so that it is the same on all your devices.

What is stored: your email address; your password only as a hash (Argon2id) — nobody knows the password itself; your progress, as described above, with a version number and up to 5 earlier versions as a fallback; the interface language, so that emails reach you in your language; when the account was created and when you last signed in; for Premium, the expiry date. No name, no postal address, no payment data. Your progress also includes your settings (such as the daily goal, colour scheme and reading voice), each with the time it was last changed, and for each study day how much was practised on which of your devices — the devices appear there only as a random identifier. In addition, for each signed-in device, a rough description such as “Firefox · Windows” and when it was first and last used; no IP address. If you change your address, the new one too, until it is confirmed (at most 24 hours).

Username (optional): If you choose one, the server stores it with your account, together with when you chose it. It is unique so that nobody can pose as someone else; that is why the server checks whether it is free when you choose it. You can change it every 30 days, and it is deleted together with the account.

Purpose and legal basis: to provide the account, i.e. to synchronise your progress between your devices — Art. 6(1)(b) GDPR (contract for the use of the account).

Cookies: when you sign in, the site sets a session cookie (el_konto, valid for up to 90 days and extended when used) and a cookie against forged requests (el_csrf). Both apply only to the path /api/, cannot be read by scripts and are technically necessary for the account (Section 25(2) no. 2 TDDDG); no consent is required for them. In local storage, under sl.konto, the browser keeps whether you are signed in, your email address for display and the state of the last synchronisation. There is also the cookie el_geraet (a random identifier of this browser, valid for two years, stored on the server only as a hash), so that you are notified when someone signs in from a new device. sl.konto also holds a check value for your account (not the address), so that after switching accounts no progress is mixed with someone else’s, and the value against forged requests; the email address stays there only while you are signed in. Under sl.geraet the browser keeps its random identifier for counting per device.

Protection against abuse: to stop passwords being guessed, the site briefly counts how often sign-in has been attempted from an IP address or for an email address. Only an encrypted check value (HMAC) is stored for this, not the address itself, and it is deleted after 24 hours — Art. 6(1)(f) GDPR, the legitimate interest in a secure account.

Emails: only about your account — to confirm your address (and one reminder about it after five days), when you request a new password, a notice when you sign in from a new device, when you change your address a link to the new one and a notice to the old one, and two warnings before an unused account is deleted. No advertising, no newsletter.

Where the data is kept: in a database at this site’s host (Hostinger International Ltd., 61 Lordou Vironos Street, Lumiel Building, 4th floor, 6023 Larnaca, Cyprus). No other service is involved. The connection is encrypted (HTTPS). In addition, the daily backup copy of the database is sent encrypted (AES-256) by email to a mailbox of the operator, so that nothing is lost if the server fails. It can only be read with a password that only the operator knows; there too it is deleted after 30 days.

Retention and deletion: until you delete the account. You can do that yourself at any time on the account page — immediately and with everything stored for it. The daily backup copies of the database are deleted after 30 days; until then, deleted data may still be in them, and likewise in the host’s backups according to its own periods. Accounts whose address was never confirmed are deleted after seven days. An account with which you have not signed in or studied for 24 months is deleted; beforehand you receive two warnings by email (30 and 7 days before), and signing in once is enough to keep it. No account is deleted for this reason without a delivered warning. An unconfirmed address receives a reminder after five days.

Counts without personal reference: for its own evaluation the server counts per month how many accounts were created (and from which notice on the site), how many of them were confirmed and still used after 1, 7 and 30 days, and how many were deleted. Only these numbers are stored — no row points to an account. No cookie and no tracking.

Totals across all accounts: for the same evaluation, the administration view calculates overall figures from the stored progress of all accounts — for example how many accounts practised in the last 1, 7, 30, 90 and 365 days, how many answers and Glimo that added up to, how many Lingua Coins were earned and spent, which items were unlocked, which language pairs were studied and which stamps were collected in the language passport. Only these totals are shown, and only from five accounts upwards; nothing additional is stored for this, and no figure is attributed to an account — Art. 6(1)(f) GDPR, the legitimate interest in knowing which parts of the site are used.

Access by the operator: in a password-protected administration view that is not public, the operator can see the accounts: email address, when an account was created and last used, whether the address is confirmed, how many devices are signed in, Premium, and how large the stored progress is — for a single account also how many entries it contains, but not the entries themselves. This serves only to run the accounts (answering questions, finding faults, detecting abuse) and the overall figures of the evaluation; nothing additional is stored for it, and the view does not show password hashes, session keys or confirmation links — Art. 6(1)(b) and (f) GDPR.

Access and portability: on the account page you can download everything stored for your account as a file (Art. 15 and 20 GDPR).

Learning together: learning partners and classes (optional)

Learning partners: Anyone with an account can invite another account. Only the two accounts and one nickname each, chosen by yourselves, are then stored; for an open invitation also an encrypted check value (HMAC) of its code and its expiry after seven days. What one partner sees of the other – the nickname, whether they learned today, their streak and the shared streak – is calculated from the accounts’ progress on every request and not stored separately. There are no messages, no free text apart from the nickname and no notifications; at most three partners per account.

Classes: A teacher with an account creates a class. Stored are its name, the language pair, a join code, when it was created and last opened, the teacher’s account and the assignments (topics of the language, whether with a worksheet, an optional date). Anyone joining enters the code and a nickname. With an account, the membership is linked to the account. Without an account – which is how it is meant for children – the server stores only the nickname and the hash of a random key of that device; the browser keeps the key itself under sl.klassen. No email address, no password, no name.

What the teacher sees: for each nickname, how many topics of the language pair are marked as understood, which of the assigned topics are among them, the last day with an answer, the streak and whether the figures come from an account or a device. For a membership with an account, the server calculates these figures from the synced progress; a device without an account sends exactly these figures when the account page is opened on it, and never otherwise. The teacher never sees an email address, individual answers or times of day. Members see the class name and the assignments, but no other members.

Purpose and legal basis: to provide the function you asked for – Art. 6(1)(b) GDPR. To prevent codes from being guessed, an encrypted check value of the IP address and of the account is briefly counted, as for the account (at most 20 wrong codes per hour and IP address, deleted after 24 hours) – Art. 6(1)(f) GDPR. A code has ten characters out of 31 possible ones, which gives more than 800 trillion combinations.

Use in schools and children’s data: If a school or teacher uses classes in lessons, this is processing by the school: it decides on the use, is responsible for it and determines the legal basis, for example under the school law of its state or country. Under Art. 8 GDPR, a child in Germany can consent to such a service on their own only from the age of 16; before that, where consent is the legal basis, the consent of the parents or guardians is needed – the school obtains it. This is why joining without an account is provided, with nothing more than a nickname, and why the nickname should not be a real name. Questions about a class are answered by the school; the operator can also tell you what is stored here (see the legal notice).

Retention and deletion: A partnership ends with one click, and then everything shared is deleted; open invitations expire after seven days. “Leave class” deletes the membership immediately. The teacher can remove members and delete the class – members and assignments are then deleted with it. Deleting your account also deletes your partnerships, memberships and your own classes. Deleted automatically are members without an account whose device has not reported anything for 400 days, and classes their teacher has not opened for 400 days. Like the rest of the account data, this information is also included in the daily backup copies of the database and disappears from them when those copies expire.

Access: The file you download on the account page also contains your partnerships, classes and memberships. Without an account, the account page in this browser shows which classes the device belongs to and under which nickname.

Visitor counting

This site counts for itself how often its pages are viewed — without a third-party service, without a cookie and without an account. Each page view sends only what viewing a page brings along anyway: the address of the page, its kind, the language pair and the interface language (both taken from the page itself) and the website you came from — only its name, for example “www.google.com”, never the full address and never a search term. The server sets the time. Nothing else: no window width, no screen size, no reading time, no answers, no other clicks and nothing from your progress. From the browser identifier that every request sends anyway, the server roughly classifies whether it is a phone, a tablet or a computer and which operating system and browser it uses (for example “phone, iOS, Safari”); only this classification is stored, not the browser identifier. In addition, each practice round reports when it starts and whether it was finished or abandoned — with the type of page, the practice mode and the language pair, but without a visitor identifier and without answers. Likewise, the placement test reports its start, abandonment and end, the end with the level it determined (for example “B1”), and a word pack reports whether “On to the topic” is chosen afterwards. It also counts when a feature is used (for example read-aloud, sharing, the conjugator, text analysis, marking a topic as understood or installing the app) — only its name with the page type and language pair — and, for a search with no results, the search term in lower case and cut to 40 characters; terms containing @ or five digits are not sent. These reports carry no visitor identifier either. If you open a link from the weekly learning email, it carries the addition von=mail; the page then reports “click from the weekly email” once, like a feature, and removes the addition from the address.

The counting stores nothing in your browser and reads nothing from it — except your objection, which you set yourself below (sl.messung), and the Do Not Track and Global Privacy Control signals your browser sends. To group the views of one day, the server forms a daily identifier as a checksum of IP address, browser string and a value (a salt) that changes every day at midnight Coordinated Universal Time (UTC) and is then deleted; every request carries the IP address and browser string anyway. Neither is stored. After the change the same visitor is a different one — returning visitors are therefore not hard to recognise but impossible.

The legal basis is Art. 6(1)(f) GDPR: the legitimate interest in knowing which pages are read and where readers come from, in order to improve the site. The reports are kept on the server in one file per calendar month (UTC); each monthly file is deleted as soon as its month is 25 months back — the one for October 2026 in November 2028. Until October 2026 the counting collected more (for example window width, reading time, scroll depth, answers and notes in the browser). These older reports are no longer analysed and are deleted on the same schedule; the site removes the notes of earlier versions (sl.kohorte, sl.aktiv, sl.lernweg, sl.sitzung, sl.ankunft) from your browser on your next visit.

Do Not Track and Global Privacy Control are checked and respected before the first report. You can also object here:

Reminder, topic of the week and progress card

After a practice round you can download a calendar file (.ics). It is made in your browser and ends up in your calendar, not with us. Under sl.app the browser also notes whether you downloaded or declined it and on which day it was last offered, and whether you hid the topic of the week. The progress card is an image your browser draws from your progress when you press “Create image”; it contains no name and no identifier and leaves your device only if you share or save it yourself. None of this is sent to our server.

Mistake reports

With “Report a mistake” you can send us a mistake in the content. Nothing is sent until you press “Send”, and only what is in the form: the address of the page, the section, the kind of mistake, your text (200 characters at most) and the interface language. We store this with date and time in a file outside the public directory and read it through a password-protected report. Your IP address, your browser identification, cookies and identifiers are not stored. To stop the form from being flooded, the server forms a check value from your IP address and a key that is created anew every day (UTC), and uses it to count that day’s reports; the previous day’s key and counter are deleted with the next report. There is no email and no reply — please write nothing personal in the text. The legal basis is our legitimate interest in content without mistakes (Art. 6(1)(f) GDPR). Reports are deleted after twelve months.

Controller

DELISORIA GbR
c/o Smarvo 295
Südstraße 31
47475 Kamp-Lintfort
Deutschland
Email: contact@delisoria.com

Server logs

This site is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, Lumiel Building, 4th floor, 6023 Larnaca, Cyprus. When a page is requested, log data is generated there for technical reasons (including IP address, time and the file requested). The legal basis is Art. 6(1)(f) GDPR — the legitimate interest in secure operation. Retention period: Hostinger does not state a fixed period. In the operator’s customer area the logs can be viewed for the last 7 days at most; how long the host keeps them beyond that depends on its own rules for secure operation.

Contact by email

If you write an email to contact@delisoria.com, the operator processes your email address and the content of your message in order to deal with your enquiry. The legal basis is Art. 6(1)(b) GDPR where it concerns a contract or steps towards one, and otherwise Art. 6(1)(f) GDPR — the legitimate interest in answering enquiries. The message is deleted once your enquiry has been dealt with, unless a statutory retention obligation requires otherwise.

Contact form

If you use the contact form, the operator processes the details you enter — your email address, your message and, if given, your name — in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where it concerns a contract or steps towards one, and otherwise Art. 6(1)(f) GDPR — the legitimate interest in answering enquiries. The message is not stored on this site’s server; when you send it, it is forwarded as an email to contact@delisoria.com and from then on exists only in that mailbox. It is deleted there once your enquiry has been dealt with, unless a statutory retention obligation requires otherwise.

To prevent mass abuse, the server counts how many messages arrive from one connection in a day. For this it does not store your IP address, only a check value formed from it and a random value that is newly generated every day; the counter and the random value are deleted the following day. The legal basis is Art. 6(1)(f) GDPR — the legitimate interest in secure operation. No cookie is set.

Feedback

If you use the feedback form, the operator processes what you enter — your rating, your text and, if given, your email address — together with the address of the page you send it from, the language pair and the interface language. This lets us connect the feedback to a page and improve the site; with your address we can ask you back. All details are optional. The legal basis is Art. 6(1)(f) GDPR — the legitimate interest in improving EveryLingua. The feedback is not stored on this site’s server; when you send it, it is forwarded as an email to contact@delisoria.com and from then on exists only in that mailbox. It is deleted there once it has been evaluated and any follow-up question has been dealt with, unless a statutory retention obligation requires otherwise.

The same protection against abuse applies as for the contact form: a check value instead of your IP address, deleted the following day, and no cookie. The “email” link next to it only opens your email program; nothing is sent until you press send there yourself.

External services

None. Fonts, scripts and data are on the same server as the site; no content is loaded from other servers.

Reading aloud

Next to sentences in the language you are learning there is a speaker button. It uses your browser’s speech output (speechSynthesis); this site loads nothing for it and does not itself send anything to any third-party server.

Which voices are available is determined by your browser and your operating system. This site reads the list your browser gives it and picks the most natural voice from it. That may be an online voice: with one of those, your browser sends the sentence to a service run by its maker, which generates the speech. Whether that happens, and what that service does with the sentence, is up to the browser maker; their privacy notice applies.

On the progress page you can choose a different voice. Voices your browser identifies as online voices are marked there; if you do not want an online voice, choose an on-device voice there. If the voice in use sounds poor, the site shows a note once explaining how to install a better one.

Speech happens only when you press: without a click on the speaker nothing is spoken and nothing is handed over. What is then handed to your browser is the sentence the button belongs to — nothing else, in particular nothing about which page you are reading and nothing from your progress.

The voice you chose (one per language you are learning) and whether you closed the note are kept only in your browser’s local storage (localStorage); the fact that the note has already been shown in this session is kept in session storage (sessionStorage) and is cleared when you close the tab. None of it leaves your device. You can delete it along with this site’s browsing data.

Speaking studio and microphone

On the speaking studio page you can record yourself while repeating sentences. The microphone is only requested when you press “Record” there; your browser then asks you whether the page may use it. Without that permission nothing is recorded, and you can withdraw it at any time in your browser’s settings.

The recording is made in your browser (MediaRecorder) and exists only in the memory of this tab. It is not uploaded, not sent to any server and not saved — neither on the server nor in your browser’s storage. It is discarded with the next recording and when you leave the page. The page switches the microphone off as soon as you leave it, after one minute without recording, or when you press “Turn the microphone off”.

Your browser works out the waveform and pitch itself (Web Audio API). No speech recognition is used, and no service listens in. The model is spoken by your browser’s speech output, as described above under “Reading aloud”. Because your voice does not leave your device, the operator of this site does not process it.

The only thing saved is your own rating per sentence (“Sounded the same”, “Almost”, “Not yet”) together with the day the sentence is due to come back — in your browser’s local storage (localStorage), as part of your progress. It does not leave your device and is deleted together with your progress.

Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability under Art. 15 to 20 GDPR. The right to object under Art. 21 GDPR is set out separately in the box below. Your point of contact is the party named in the legal notice.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in the country where you live. The authority responsible for the operator is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (the data protection commissioner of North Rhine-Westphalia), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

You are under no statutory or contractual obligation to provide this site with any data. Without the data that arises in the server logs when a page is requested, however, the server cannot technically deliver the page.

There is no automated decision-making, including profiling (Art. 22 GDPR).

Every entry in your browser’s storage

This list names every entry this site can create in your browser’s storage, and when. An asterisk stands for a part that changes with the language pair, the language or the place. None of these entries goes to a third-party service; what goes to this site’s server is described in the sections above. You delete the entries in localStorage and sessionStorage on the Progress page or with the browser data for this site, and cookies and the offline storage with the browser data.

The legal basis for storing in the browser is Section 25(2) No. 2 TDDDG, insofar as an entry is needed for a function you use or records a decision you made, such as your objection to the visitor counting. The visitor counting itself stores nothing in the browser.

Last updated: October 2026