Privacy

The controller of your data, meaning the one who answers for it, is Upthink Solutions OÜ (registry code 16683946), at Aiandi tn 8/2-28, Mustamäe linnaosa, 12915 Tallinn, Harju maakond, Estonia. Write to privacy@upthink.ee about anything on this page, including any of the requests below.

There’s no data protection officer. This is a small installation, and the law only requires one of a public body or of a business built on monitoring people at scale, which this isn’t. The address above reaches a real person.

Your identity. Signing in with Google gives us your email address and a user id, held by Supabase Auth. We never see your Google password, and we don’t ask for anything else in your Google account. Without this we couldn’t show you your own deck instead of somebody else’s, so we keep it to provide the service you asked for.

Your learning. The cards in your deck, every review you have ever done (the grade, the moment, and how long you took), your tasks, your starred words, the words you have put aside as too complicated, your badges and your settings. The review log is what makes the scheduling work: it is the app’s memory of how well you know each word.

What we have sent you. If this installation sends email, we keep a line for each message: which kind it was and when it went, so that the next one is not a repeat and so that there is a cap on how often you hear from us. We do not keep the message itself, and there is no tracking pixel in any of them, so nothing anywhere records whether you opened one. Every message carries a link that switches its kind off without signing in, and Settings has the same switches. The messages you cannot switch off are the ones you asked for, like a sign-in link.

Reminders on a computer. If you turn them on in Settings, your browser gives us an address at the push service its maker runs and two keys to encrypt a reminder with, and we keep exactly those. A reminder is then booked like an email, as which kind it was and when it went, and we keep no record of whether it was shown or clicked. Turning it off in Settings, or signing out in that browser, stops it.

And one of them is about other people. Whoever runs a class or a workplace group can be sent a weekly note about it. That note carries how many people practiced and how many answers they gave between them, and never a name, a figure about one person, or anybody’s mistakes. Those are on the board inside the app, where everyone who joined was told they would be. It is switched off from the group’s own page.

Your level checks. Each sitting is kept: the levels it measured, how many questions it came from, and the rating you gave your own speaking. Nothing you record is uploaded, and no audio is stored anywhere.

Your mock exams. A sat paper is kept whole: the level, your score, and the marked paper itself, question by question, with what was expected and what you gave. That includes the composition you wrote, kept in your own words. A paper you abandon is never saved to your account. You mark the spoken part yourself, and nothing you record leaves your device.

Your conversations in Situations. Each one you finish is kept whole: who was behind the desk, what was on the role card, what went wrong on purpose, every turn, and where each of the other side's lines came from. Nothing in a transcript is about you. You play a patient, a tenant, a customer, with a card of invented facts and a document number that is fiction, and you are never asked for your own. The words a conversation needed and you did not have are kept as a list, so they can be handed back. A conversation you walk out of is kept as one you walked out of; one you abandon by closing the tab is kept on your device only, and goes nowhere until you finish it.

What you said happened out there. Today asks each morning whether you spoke any Estonian to somebody yesterday. Where the answer is no, nothing more is asked; where it is yes, it asks how it went, in one of three words: they understood me, I got stuck partway, they switched to English. That word and the day are kept, and nothing else: not where you were, not who you spoke to, not what was said. The errand it offers on a day with none is not stored at all.

Your class, if you are in one. Joining with a code stores which class you joined, when, and the name you chose to be known by in it, which is the one place you can be under a name of your own choosing rather than your account. If you run a class, its name and its join code are stored against you. What a teacher sees of a student is only ever effort, never contents: reviews this week, a streak, words known, when they were last here, which grammar the class as a whole is weakest at, and which grammar that student personally is weakest at, as a percentage rolled up over their own reviews. Never a deck, a search or a specific answer. Leaving a class removes your membership of it, and deleting your account removes every class you are in and every class you run.

Your workplace group, if an employer sponsors you. A group set up by an employer is the same membership row, and it shows them less than a teacher sees rather than more. They get your name, whether you have been reviewing and when you last did, and one of four bands for the examination the group works toward. Not a percentage, not which grammar you personally find hard, and never a deck, a search or an answer. The band is withheld entirely until there is enough history behind it to mean something. Leaving stops all of it at once and takes nothing from your own deck.

Your conversations with Anu. Messages you send the tutor and its replies are kept for a day, so the conversation survives a page reload, and no longer: the next time you speak to her, anything older than 24 hours is deleted and she starts fresh.

Pages you photograph. When you scan a page, what is kept is the word list you confirmed: the Estonian, the English, and which dictionary entry each word matched. The photograph itself is never stored. It is read once, on the way through, and dropped. It is not written to a database, not put in file storage, and not written to a log.

Photos of the things around you. A photo of your kitchen or your street goes the same way: shrunk on your device, read once by the AI and dropped. It is asked only for the English names of the objects in it, never about people. What is kept is the words you tick, exactly as for a page.

What the tutor cost. For every request to the AI, we keep a record: which model answered, roughly how much text went in and out, and what it is estimated to have cost. The tutor runs on somebody’s paid key and anyone can sign up, so each person has a daily allowance, and the allowance needs this count. We keep it under legitimate interest: keeping a free service affordable to run.

What you report as wrong. Anywhere the app cannot help you there is a button to tell us so. What you send is kept: what kind of problem it was, the screen you were on, what the app had just said to you, the correction you proposed and anything you wrote. Whoever runs this installation reads it, so treat that box as something another person will see, and please don’t put anything private in it. It is kept because a shared dictionary that nobody can correct goes wrong quietly, and because you asked us to look at it. Your own reports and what happened to each are on the Suggestions page, they are in the export, and they are deleted with your account.

Errors. When something breaks, we log the error message and where it happened, along with your account id, never your email. Anything that looks like a password or key is stripped out before it is written down. We keep this so faults can be found and fixed.

What is not stored. No analytics, no advertising identifiers, no third-party trackers, no profiling, and no cookie that is not needed to keep you signed in.

How we tell whether the app works. We count, from the review log described above, how many people come back after a day, a week and a month. It is worked out from what is already there rather than collected separately, which is why there is still no tracker on this site. Only totals ever leave that page: no name, no address, no word you looked up. A group of fewer than five people is reported as a size with no percentage, because “one of two people came back” is a fact about a person rather than a statistic.

What learners of Estonian get wrong, counted. From the same review log, this installation can produce a table of how often each grammatical case, each stem change and each word is answered correctly, added up across everybody. It is worked out from what is already here, so nothing extra is collected and no new question is put to you. That table can be sent to people who teach Estonian or study how it is learned.

What it holds is counts, built under these rules. Nothing is published that fewer than ten different people are behind, or that rests on fewer than fifty answers, and nothing where one person supplied more than half of a figure. Anything below that is missing from the table rather than shown as a small number. Counts are rounded and people are counted in bands, so two versions of the table cannot be compared to work out what happened in between. There is no user id in it, no email, no date anybody studied, no word anybody searched for and no individual answer. The table is not about you and could not be turned back into anything about you.

You can still say no. Settings → Anonymous statistics leaves your answers out of it, and out means your rows are skipped when the totals are worked out rather than removed from the answer afterwards. Nothing else about the app changes.

One cookie keeps you signed in. Beyond that the app stores a few things in the browser itself: whether you chose the dark theme, whether you have already been offered the install prompt, an outbox holding any card you graded while the network was down, so that grade is not lost and is sent with the time you actually answered it, a mock exam paper you have started but not handed in, so that closing the tab three hours into a B2 paper does not throw the whole sitting away, today's word puzzle, so a reload does not lose the guesses you have made, a workbook page you are halfway through, so a reload does not deal you a new one, and which card a review round was on, so opening a word's dictionary entry and coming back returns you to it.

The unfinished paper holds your answers and when each part's clock runs out. It holds no marks and no questions: the paper is rebuilt from a seed and marked on the server, so nothing kept here can change a score. It is replaced as you write and removed the moment the paper is handed in. The puzzle keeps your guesses and nothing else, and today's word is worked out from the date rather than kept beside them. The workbook page keeps the sentences it dealt and what you typed into them, and is removed when you finish it or after half a day. The card you were on is only its id, gone the moment the round ends or the tab does, whichever comes first.

None of that is a tracker and none of it is shared with anybody. Estonian law requires your agreement before something is stored on your device unless it is strictly necessary for the service you asked for, and each of these is: without them, answers you gave offline would be lost. That is why there is no cookie banner. Signing out removes the outbox, the saved session, the pages kept for offline use, any unfinished paper, any puzzle and any workbook page, so the next person on a shared computer starts from nothing; the theme and the install prompt stay, since they are about the device rather than about you. The browser also keeps a short code for which account last used it, so that a different account signing in clears the previous one's data even when nobody signed out. Clearing your browser storage removes all of it, and costs you nothing except any grade still waiting to be sent.

The microphone is used only after you press it, and it closes while the app itself is speaking. What you say is turned into text on this device. The sound is never stored and never sent, to us or to anybody else.

The text is yours to change before it counts. Once you send it, a turn in a conversation or an answer to a card, it is stored exactly as typed text is. To mark which heard words are real Estonian spellings, the words alone are checked against the dictionary on the server and not kept there.

One more thing is kept beside it: whether you said it. An answer sent just as it was heard is marked as spoken, and a conversation turn keeps two numbers, how many words were heard and how many you changed, never the words themselves. That is what the said-aloud count on Progress is read from.

A recording you open on the reading page, such as a voice message somebody sent you, holds another person's voice, so it is treated more carefully still. It is heard on your device in the same way, and the sound is never uploaded, stored or sent, to us, to the speech service or to anybody else. Only the words it was heard as go to the dictionary to be underlined, and they are not kept there, just as a pasted text is not.

The speech model is downloaded quietly in the background from this site, once per device, and it stays on your device so hearing works offline. It is the same file for everybody and says nothing about you. Signing out leaves it, because it belongs to the device rather than to you.

This installation only talks to the services below, and nobody else. Each one gets only what’s described beside it, and none of them is paid to profile you.

• Groq: what you type to Anu, and any page you photograph. Outside the European Economic Area.
• Google Gemini: what you type to Anu, and any page you photograph. Outside the European Economic Area.
• Anthropic: what you type to Anu, and any page you photograph. Outside the European Economic Area.
• Ekilex, at the Institute of the Estonian Language: a single word you looked up, with no account attached. In Estonia.
• Wikimedia, which runs Wiktionary: the same single word, asked for its English meaning, or an English word you searched for, asked for its Estonian, with no account attached. Outside the European Economic Area.
• Resend, which sends our emails: your email address, and whatever a message to you says about your own course. Outside the European Economic Area.
• The push services run by Google, Mozilla, Apple and Microsoft: a reminder you asked to have on a computer, encrypted so that only that browser can read it. Outside the European Economic Area.
• TartuNLP, at the University of Tartu: a phrase you asked to hear read aloud, with no account attached. In Estonia.
• Supabase: your email address and everything in the database, as the host of both. Where this is hosted depends on how the installation was set up, so ask the operator above.
• Vercel, which runs the servers this app lives on: every request you make, while it's being answered, and a log of it that includes your IP address. Outside the European Economic Area.

Your deck, your review history, your tasks and your level checks are never sent to any of them. The counted table described further up is the one thing that may go to somebody not on this list, and it holds none of those: it is totals, and it is only totals that at least ten people are behind.

Some of that leaves the European Economic Area. The AI providers are established outside it, so what you type to Anu and any page you photograph crosses a border to be read. That transfer rests on the standard contractual clauses the provider publishes, and nothing else. It is worth knowing that protection there is not identical to protection here. It is also avoidable: the tutor and the page scanner are the only features that do it, and using neither means nothing of yours leaves.

None of it is sold, and we never use it to train a model ourselves. What a provider does with what we send them is governed by their own terms. That is a real limit on this promise rather than a formality: some free tiers are free because the provider keeps the right to look at what goes through them.

Your learning, your conversations and your scanned word lists are kept for as long as you keep the account. The scheduling works off years of history and a level check is only useful next to the one before it.

Spending records are kept for the running year, since the caps they enforce are daily. Error logs are short-lived by nature and hold no name. There is no separate archive, and no backup that outlives a deletion by more than the hosting provider’s own retention window.

These are your rights under the GDPR. The two people actually use are buttons, so you don’t even have to ask.

A copy of everything (access, and portability). Settings has an Export button that gives you the whole thing as a JSON file: every card, review, task, setting, scanned page, level check, mock exam paper with your composition in it, tutor message, suggested fix, starred word, word put aside, badge and class membership. It is a real backup, and the same file restores into a fresh installation. One thing is held back: the spending record described above, since that is this installation’s accounting rather than your work. It is deleted with your account like everything else.

Erasure. Settings → Deleting your data removes all of that immediately, in one go, along with your sign-in record. The shared dictionary stays, because other learners have cards built on it, but any entry you edited stops being attributed to you. Take an export first: this keeps no copy. If this installation is not set up to delete the sign-in record itself, the button says so, and the address at the top of this page is who to ask.

Correction. Anything you can see, you can change: your settings, your cards, your tasks, your goal. A dictionary entry can be corrected too, and because the dictionary is shared, that correction is attributed to you until you delete your account. Where you would rather somebody looked at it first, the same entry has a button to suggest the change instead of making it.

Restriction and objection. You can ask for processing to be paused or object to it, in writing, at the address above. In practice almost everything here exists only to deliver the app to you, so the usual answer to an objection is to stop using the part you object to, and erasure is the stronger and faster version of the same thing. The one objection that is a button rather than a letter is Settings → Anonymous statistics, which takes your answers out of the counts described above.

None of this costs anything, and you don’t need to give a reason. A request made in writing gets an answer within a month.

The app estimates a CEFR level from what you answered, and predicts your chance of passing a mock exam. Neither is a decision with any legal or similar effect: they are study advice, checked directly against the dictionary rather than judged by a model, and every figure says how thin the evidence behind it is. No qualification, no admission and no result depends on them. There is no automated decision-making in the sense the law means, and no profiling.

Ask the operator first, at the address at the top of this page. If that gets you nowhere, you have the right to complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), which is the supervisory authority for Estonia: Tatari 39, 10134 Tallinn, Estonia, +372 627 4135, info@aki.ee, https://www.aki.ee/en. If you live elsewhere in the Union you may go to your own country’s authority instead. You can also take it to court.

In Estonia a person can agree to a service like this one for themselves from the age of 13, which is the age the Personal Data Protection Act sets. Below that, a parent has to agree. Kodukeel isn’t aimed at younger children and doesn’t knowingly hold their data. If you think a child under 13 has an account here without a parent’s agreement, write to the address above and it will be deleted.

A school running this for a class is the controller of its students’ data and answers for that agreement. What a teacher can see is deliberately narrow: how much work each student did, which grammar the class as a whole is weakest at, and which grammar each student personally is weakest at as a rolled-up percentage. Never an individual’s deck, their searches or a specific answer.

An employer sponsoring a workplace group is the controller of that group’s membership in the same way, and sees a narrower set again: effort, and a band for the paper the group is working toward. The difference is a different query rather than a hidden column, so there is no setting that widens it.

Questions about your data go to the operator named at the top. See also the terms.