Privacy Policy

The controller responsible for processing your personal data under the General Data Protection Regulation (GDPR) is Osonnia Studio, Inh. Dan Kraw, Schönhauser Allee 163, email (visible with JavaScript). Further details are in our Impressum.

For any question about your data, or to use your rights, write to (visible with JavaScript).

We process only the data "Hallo Otti!" needs to work: your account, your learning progress and your settings.

We do not sell your data and show no advertising. We use no tracking or analytics tools of other companies, no social media plugins and no fonts or scripts from other servers: every file of the site comes from our own server. We count visits only with our own statistics, without cookies (section "Visitor statistics").

Service providers process data only on our behalf and on our instructions. Other services receive data only when you use a feature that needs them. The section "Who receives data" lists all of them, with what they receive and what they never receive.

We make no automated decisions that have legal or similarly significant effects on you (Art. 22 GDPR). The review plan of your cards is calculated automatically only to schedule your learning.

When you open a page, your browser sends us technical data: your IP address, the date and time, the page requested, the referring page, and your browser and operating system. Our web server records them in log files, and if something goes wrong, the application records the error.

We need them to deliver the pages, to keep the service secure and to find errors (legitimate interest, Art. 6(1)(f) GDPR). The log files are deleted after 14 days at the latest. Only an entry we need to clear up a specific attack is kept until it is cleared up.

To protect the service against abuse, we count for a short time how often an IP address signs up, logs in, asks for emails or decodes letters, and how often an account asks for Frau Hilde's explanations (legitimate interest, Art. 6(1)(f) GDPR). These counters are deleted after one day at the latest.

To learn which pages help and which channels bring visitors, for example a post in a Telegram group or an advertisement, we count visits with Umami, an open-source statistics tool that we run ourselves, on our server in the European Union. No other company receives these data. The tool sets no cookies and stores nothing on your device.

For each page you open, the statistics receive its address without its parameters, except campaign tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term), its title, the address of the page you came from (also without parameters) and the time. We also count a few actions: pressing the buttons to sign up, to share or to start the level test, finishing the level test, confirming an email address and the first answer while learning, some with a detail such as the level reached or where something was shared. They never contain your name, your email address or your account.

From your IP address and your browser's identification (user agent), Umami derives the browser, the operating system, the type of device, and the country, region and city, with a database on our own server. The IP address itself is not stored. Together with a secret key, it becomes a visitor number (a hash) that changes every month: visits from the same browser and network in one calendar month count as one visitor and can't be linked to visits in other months. We don't combine the statistics with your account or any other data, and we only look at totals.

The legal basis is our legitimate interest in knowing which pages and channels work, so that we can improve the site and decide where to make it known (Art. 6(1)(f) GDPR). We delete the statistics after 24 months.

You can object at any time (section "Your right to object"): with the switch below, which this browser remembers in its local storage, or with your browser's "Do Not Track" setting, which the statistics respect. Then nothing more is counted from that browser.

To create an account, you give your name (or a nickname), your email address and a password. We also store your interface language, your timezone, when you accepted the terms of use and your settings. We store your password only as a secure hash, never in plain text.

When you choose a password, we check that it has not appeared in a known data breach, as attackers try such passwords first. Our server sends only the first five characters of the password's SHA-1 fingerprint to the free service "Have I Been Pwned" (api.pwnedpasswords.com), which answers with all the fingerprints that start with them, hundreds of them; the comparison happens on our server. Your password, your name and your email address never leave our server, and the five characters cannot be traced back to you. The legal basis is our legitimate interest in keeping accounts safe (Art. 6(1)(f) GDPR).

We use these data to provide the service to you (performance of the contract, Art. 6(1)(b) GDPR): to sign you in, to confirm your email address, to reset your password and to show the service in your language and at your times of day. We also note when we last sent you a reminder and a diary, so that you get each only once.

You need to give these data to create an account; without them we cannot provide one. The public pages work without an account.

In your profile you can change your name, language, timezone and settings at any time, download all your data, change your password and delete your account.

Our administrators can see your account and how you learn (for example how many words you have learned) when this is needed to help you or to keep the service safe, for example when you write to us. They sign in with a second step. We log what they do with an account (for example blocking, confirming or deleting it) with the account's internal number only and keep this log for 365 days, so that we can show who did what. The legal basis is our legitimate interest in a secure service and in being accountable for it (Art. 6(1)(f) GDPR).

While you learn, we store what the service needs to plan and show your learning: your cards and their review plan, each answer (the rating, the kind of exercise, the time and how long it took), the scenarios you started, the words you already know, your backpack, your daily goal, Otti's level and items, and your recent searches.

Your notes to words are texts you write yourself on a word's page, with the moments you wrote and last changed them. Only you can see them: on the word's page, in the lists, on the learning card and under "My Notes". We use them for nothing else and pass them to no one, OpenAI included. Please write nothing sensitive about yourself or others into them. You can change or delete a note at any time; it is in the copy of your data too.

We use these data to provide the service (Art. 6(1)(b) GDPR). Your progress page and Otti's map are made from these data; no other user can see them.

A picture you share (your progress or Otti's map) is made in your browser and shared by your device; we receive nothing about it.

Words and sentences are read aloud by the speech output of your device or browser; we send nothing for it. We choose a voice installed on your device. Only if your device has no German voice may your browser use an online voice of its maker (for example Google in Chrome); the text read aloud then goes from your browser to that company, under its privacy policy.

We use only cookies that are strictly necessary for the service you asked for (§ 25(2) TDDDG; Art. 6(1)(b) and (f) GDPR):

• the session cookie, which keeps you signed in while you use the service, and keeps a level test you take without an account; your browser deletes it when you close it, and the session ends after one day without use;
• "REMEMBERME", only if you tick "Remember me": it keeps you signed in for up to 365 days, until you log out, change your password or delete your account;
• a short-lived security cookie against forged forms (CSRF), removed after the form is sent;
• "language", only if you choose a language on the website: it remembers the chosen language for one year, so that the website's main address opens in that language and a new account starts with it; as a functional cookie it needs no consent (§ 25(2) no. 2 TDDDG);
• "footer" and "cookie_notice", which remember for one year that you opened the footer or closed the cookie notice.

We use no tracking, analytics or advertising cookies, and no other storage in your browser for such purposes. Only if you switch off our visitor statistics does your browser remember that (section "Visitor statistics").

The installed app (PWA) stores the offline page and the app's files in your browser, so that it opens quickly and works without a network. They contain none of your personal data.

We send you the emails the service needs: the link to confirm your email address, the link to reset your password, the confirmation that your account was deleted and a note when someone tries to sign up with your address (Art. 6(1)(b) GDPR).

Otti's diary: once a week we send you a short email in simple German with the words you practised that week. It is part of the service you signed up for (Art. 6(1)(b) GDPR) and is on from the start, as the sign-up form says. It contains no advertising. You can turn it off at any time and at no cost in your profile or with the link in every diary email, and change its day and time in your profile.

We send emails through an email service provider (see "Who receives data").

If you turn on Otti's daily reminder in a browser, the browser asks for your permission first. If you agree, it gives us an address at the push service of its maker and two keys; we store them with your account. Which push service it is depends on your browser: Google (Chrome and browsers built on it), Mozilla (Firefox), Apple (Safari) or Microsoft (Edge).

Once a day, at the hour you chose, we send a reminder to this address, but only if you learnt in the last three days and not yet that day. The reminder is encrypted so that only your browser can read it. The push service only delivers it; it learns no more than that a message for this address arrived at that time, and never receives your name, your email address or your learning data from us.

These push services may process data in the USA. Where the provider is certified under the EU-U.S. Data Privacy Framework, the transfer rests on the European Commission's adequacy decision (Art. 45 GDPR); otherwise it is necessary to deliver the reminder you asked for (Art. 49(1)(b) GDPR).

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time with the button in your profile or in your browser's settings; then we delete the stored address.

Frau Hilde's explanations and memory tricks and Otti's diary are written for us by OpenAI (OpenAI Ireland Ltd., Dublin, Ireland, with OpenAI, L.L.C., USA), our processor: it processes the data only on our behalf and on our instructions, under its standard data processing terms (Art. 28 GDPR). For this we send it:

• for "Frau Hilde, please explain": the German word or phrase, the kind of exercise, the right answer and your answer (at most 100 characters);
• for Frau Hilde's memory trick: the word and its meaning;
• for Otti's diary: the words you practised that week and your interface language.

We never send your name, your email address or anything else that identifies you. OpenAI doesn't receive your IP address either: it only sees our server. Please don't type personal information into an answer field.

This happens only when you press the button or when your diary is due (Art. 6(1)(b) GDPR). We keep an explanation for up to 30 days and a memory trick for as long as the word is in our dictionary, both without any link to a person, so that the same question doesn't have to be asked twice.

OpenAI may process the data in the USA; the transfer is protected by the EU Standard Contractual Clauses in its standard data processing terms (Art. 46(2)(c) GDPR). According to OpenAI, the data we send it is not used to train its models and is kept for at most 30 days to detect abuse, unless the law requires it to be kept longer.

The text you paste into "Decode a letter" is used only to show you its words. It is not stored, not written to log files, not cached and not sent to anyone, OpenAI included. When you leave the page, it is gone.

If you are signed in, we compare the words found with your cards to show which ones you know. If you put words into your learning, we store them as new cards.

You can take the level test without an account. Your answers and your result are kept in your session on our server, so that the next question and your result can be shown; it needs the session cookie and nothing else. The session ends after one day without use, and the test with it. If you sign up or log in in the same browser, we offer you once to use your result for your learning; nothing changes unless you say yes.

When you finish your first test in a session, we add one to the count of its result (for example "B1"). The count stores nothing else: no IP address, no time and nothing that could point to you, so it is not personal data. From these counts we show how many people took the test and how a result compares, once there are enough of them.

The card you share is made in your browser and shared by your device. The Telegram and WhatsApp buttons are plain links: nothing is loaded from these services before you press one; then your browser opens their site or app, and their privacy policies apply.

The legal basis is the test you asked for (Art. 6(1)(b) GDPR).

On a word's page you can open the word in Linguee (DeepL SE, Cologne, Germany) or in Wiktionary (Wikimedia Foundation, Inc., USA). Nothing is loaded from these sites until you press the button.

When you do, your browser connects to that site, which receives your IP address and browser data and may set its own cookies. That site is responsible for this, and its privacy policy applies. The legal basis is your consent by pressing the button (Art. 6(1)(a) GDPR).

Links to these and other sites, for example the unknown words of a decoded letter, open in a new tab; the same applies there.

The grammar data of the words comes from the German Wiktionary (CC BY-SA 4.0); our terms of use name all our sources and their licences.

Depending on which features you use, data may go to the recipients below; not every recipient receives data from every user. Service providers process data only on our behalf and on our instructions. We use each of them under its public standard terms, the same for all its customers, including its standard data processing terms (Art. 28 GDPR); we have no individually negotiated contracts with them.

• Our hosting provider, with servers in the European Union: stores and processes all data of the service on our behalf and uses none of it for its own purposes.
• An email service provider: receives your name, your email address and the text of each email we send you, to deliver it. It never receives your password, your answers, your searches or any other learning data, except the words in your diary.
• OpenAI, only for Frau Hilde's explanations and memory tricks and for Otti's diary: receives what the section "Frau Hilde's explanations and Otti's diary" lists. It never receives your name, your email address, your IP address or anything else that identifies you.
• The push service of your browser's maker, only if you turn on daily reminders: receives an encrypted reminder it cannot read. It never receives your name, your email address or your learning data.
• Linguee and Wiktionary, only when you open them on a word's page, and your browser maker's online voices, only if your device has no German voice: your browser connects to them directly; we send them nothing.

If a recipient processes data outside the European Union or the European Economic Area, this happens only on the basis of an adequacy decision of the European Commission or of the EU Standard Contractual Clauses (Art. 45, 46 GDPR), unless a section above says otherwise.

We use no other recipients: no analytics, advertising or social media services of other companies; our visitor statistics run on our own server. We pass data on to authorities only where the law obliges us to, and we never sell it.

We keep your account and learning data as long as you have an account. When you delete it, we delete all of it at once, including the "Remember me" logins on all your devices. Copies left in our encrypted backups are deleted with these backups, within 30 days at the latest.

Some data is deleted earlier:

• recent searches: only the newest 200 are kept;
• your notes to words: when you delete one or save it empty;
• sessions: after one day without use;
• "Remember me": when you log out, change your password or delete your account, at the latest after 365 days;
• the address for daily reminders: when you turn them off or delete your account, or when the push service says it is no longer valid;
• the counters against abuse: after one day at the latest;
• Frau Hilde's explanations: after 30 days, her memory tricks: with the word (they belong to no person);
• emails that could not be delivered: after 14 days;
• visitor statistics: after 24 months;
• the log of what our administrators did with an account: after 365 days;
• server log files: after 14 days.

Where the law requires us to keep data longer, we keep it only for that purpose and restrict its processing.

You have the right to:

• access your data (Art. 15 GDPR): download all of it in your profile at any time;
• have it corrected (Art. 16 GDPR): you can change most of it in your profile;
• have it erased (Art. 17 GDPR): delete your account in your profile;
• restrict its processing (Art. 18 GDPR);
• receive it in a machine-readable format and have it passed on (Art. 20 GDPR): the download is a JSON file;
• object to processing (Art. 21 GDPR), as the next section explains;
• withdraw a consent at any time, with effect for the future (Art. 7(3) GDPR), for example for daily reminders.

For anything you can't do in your profile, write to us at (visible with JavaScript). We answer within one month (Art. 12(3) GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU country where you live or work, or where we are based.

Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), that is, the server log files and the counters against abuse (section "Visiting the website") and the visitor statistics (section "Visitor statistics"), you have the right to object at any time, on grounds relating to your particular situation (Art. 21(1) GDPR).

We then stop processing these data, unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. To object, write to (visible with JavaScript). For the visitor statistics, the switch in their section is enough: from then on, nothing is counted from your browser.

You must be at least 16 years old to create an account. If you are younger, you need the consent of a parent or guardian, as the terms of use say.

We update this policy when the service or the law changes. The date at the top of this page shows the last change. If a change affects how we use your data, we tell you by email at least 30 days before it takes effect.