Privacy policy

This policy explains what Apera collects, why, and your choices. Apera is operated by Erik Majláth, IČO 05546371, Prague, Czech Republic ("we", "us"), the data controller. For privacy questions, contact hello@apera.me.

What we collect

• Account. Your email address and a password, to create and secure your account. We do not ask for your name; a display name is derived from your email. Authentication is handled by an established EU-hosted identity service.
• Content you add. When you upload a page image, we hold it while we extract its vocabulary. We delete successfully processed images after processing and temporarily retain failed uploads for retries. Automatic cleanup also removes remaining images and previous storage versions; the timing is described below. When you paste text, we process it to derive vocabulary and do not keep it as a readable document inside the app. While it waits to be processed it sits in a processing queue; if processing fails, it can stay there for up to seven days so it can be retried.
• Learning data. The words we extract (their forms, dictionary forms, how often they appear, and your recall history), plus per-page statistics like word count and coverage.
• Invites. If you join with a friend’s invite, we record which account invited yours, so we can give you both the month of Plus it earns.
• Usage analytics. Basic product usage, including page views and feature interactions. Our analytics uses no tracking cookies or cross-site tracking. For signed-in users, we associate events with an opaque account identifier; we do not send your email address to the analytics service. If you create an account after taking the quiz, we link the quiz visit's analytics to your account.
• Tools you can use without an account. The text analyzer and the placement quiz on this site work without signing in. Text you paste into the analyzer is sent to our servers, analysed, and discarded; it is not stored or linked to you. We temporarily keep your guest quiz session and answers under a session identifier so you can finish the quiz or save its result when creating an account. Guest sessions are scheduled to expire seven days after their last saved update; automatic deletion can take several additional days.
• Error logs. If something breaks, we record a technical error report to fix it. If a page tries to load something our security policy does not allow, the browser sends a report of that too. Neither uses cookies. We keep these reports to technical details, such as your browser or device type, and configure our error monitoring to minimise personal data; we never use them to profile you.

You need an email address to have an account, together with either a password or a Google or Apple sign-in; without them we cannot create one. Everything else is up to you: if you add no pages or text, there is nothing for us to extract vocabulary from, and the text analyzer and the vocabulary quiz work without an account at all.

Signing in with Google or Apple. If you choose to, Google or Apple confirms who you are and gives us your email address and, if you allow it, your name. We receive nothing else from them, and they learn only that you used them to sign in to Apera. Apple’s “Hide My Email” gives us a relay address instead of your own. Google and Apple handle that sign-in under their own privacy policies. If you already have an account with the same address, the two are joined into one.

Please add only what you need for learning. A photo of a page may incidentally contain personal information (for example a name or a handwritten note) — avoid uploading other people's personal data.

How we use it

To run the core loop: extract vocabulary from what you add, generate short stories and word explanations from the words you are about to forget, schedule reviews, and synthesise pronunciation audio. We also use aggregate usage to understand and improve the product. We do not sell your data or use it for advertising.

We estimate how many words you know from your quiz answers and your reviews, and use that estimate to choose which words and stories to show you. This is automated, but it only shapes what you study: it has no legal or similarly significant effect on you, and you can retake the quiz whenever you like.

Legal bases

Under the GDPR we rely on these bases:

• To provide the service — performing our contract with you (creating your account, extracting vocabulary, generating study material and audio).
• To keep the service secure and improve it — our legitimate interests, including cookieless analytics and error monitoring, balanced against your rights.
• To meet legal obligations — for example tax and accounting records where the law requires them.
• Reminder emails — a new account gets them unless you tick “No reminder emails” when you sign up. That rests on our legitimate interest in reminding our own users about the service they signed up for, which Czech law allows for an address given to us with the chance to refuse (Act 480/2004, §7(3)). Accounts created before we offered that choice at signup get them only if you turned them on, in Profile or when Apera asked you once; for those, the basis is your consent. Either way we use your activity in Apera (when you last reviewed cards or finished a story, and what is waiting for you) to decide whether and when to write: after 3 days away and after 12, never more. That is profiling for direct marketing; for accounts that kept reminder emails at signup it is our legitimate interest. You can object to it, or withdraw your consent, at any time and without giving a reason: turn reminder emails off in Profile, or use the link in any reminder email, which needs no sign-in. Either stops the emails and the profiling behind them. Withdrawing does not affect emails already sent.

Service providers (sub-processors)

We share data only with the service providers that run parts of the product for us, and with the tools we use to build and fix it:

• Cloud hosting & storage — application hosting, storage of uploaded images, and account authentication, in the EU (Frankfurt).
• Database — our application database (EU).
• AI models — optical character recognition and the language models that extract vocabulary and generate stories and explanations.
• Speech synthesis — text-to-speech for pronunciation audio. Word pronunciations are cached in a shared store keyed only by the word, so they are not tied to you; sentence audio is generated each time you play it and is not stored.
• Analytics & error monitoring — cookieless product analytics and technical error reports (EU).
• Email delivery — sending account and verification emails, the email telling you an invite has added Plus to your account and, unless you have turned them off, reminder emails.
• Web serving & security — serving the website, DNS, and protection against abuse.
• Development tools — AI coding assistants our engineers use can process account and learning data while diagnosing a problem; we give them only what the fix needs.

These providers act on our instructions and are not permitted to use your content for their own purposes, including training their models. Some of them process data outside the EU/EEA, including in the United States, where the language model that writes your daily story runs. Those transfers rely on an adequacy decision, such as the EU–US Data Privacy Framework, or on Standard Contractual Clauses. A current list of the specific providers we use is available on request at hello@apera.me.

How long we keep it

We keep your account and learning data while your account is active. We derive vocabulary from your text and do not retain that text as a readable document. We delete a successfully processed page image after extracting its vocabulary. Remaining images, including failed uploads, are scheduled to expire fourteen days after upload. Previous storage versions are scheduled to expire after they have been previous versions for one day. These are automatic cleanup schedules, not guaranteed deletion deadlines; physical removal can take longer.

Your daily story is scheduled to expire seven days after it is written; the words you met in it stay in your learning history. Word-pronunciation audio is cached in a shared store keyed only by the word and is not linked to you; sentence audio is generated each time you play it and is not stored. Production infrastructure logs are configured to expire after thirty days; this does not describe the separate retention settings for product analytics or error-monitoring reports. We keep analytics and technical error reports only for as long as they are needed for product improvement, security, and troubleshooting. You can ask us for the current retention periods at the contact address below.

Our databases keep encrypted backups so we can recover from an incident. Data you delete, including a deleted account, can stay in those backups for up to 35 days before it is overwritten. We do not restore it from them except to recover from an incident.

How we protect your data

We encrypt data in transit and at rest, restrict access to the people and systems that need it, and rely on established providers for hosting and authentication. No service can be completely secure, but we work to protect your information.

Your rights

Under the GDPR you can request access to, correction of, export of, or deletion of your personal data, and you can object to or ask us to restrict certain processing. You can delete your account and its associated learning data yourself from your profile in the app; backup copies then expire as described above. To exercise a right concerning other records, including analytics or error reports, email hello@apera.me and we will action it.

You also have the right to lodge a complaint with a data protection supervisory authority. In the Czech Republic this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů); you may also complain to the authority where you live.

Children

Apera is not directed at children under 16 and we do not knowingly collect their data.

Changes

We may update this policy; we will change the date above and, for material changes, let you know.

Contact

Erik Majláth, IČO 05546371, Prague, Czech Republic. We answer in English, Czech and Slovak. hello@apera.me.