Privacy policy

This policy explains what Apera collects, why, and your choices. Apera is operated by Erik Majlath (Prague, Czech Republic) ("we", "us"), the data controller. For privacy questions, contact [email protected].

What we collect

• Account. Your email address and a password, to create and secure your account. We do not ask for your name; a display name is derived from your email. Authentication is handled by an established EU-hosted identity service.
• Content you add. When you upload a page image, we hold it while we extract its vocabulary. We delete successfully processed images after processing and temporarily retain failed uploads for retries. Automatic cleanup also removes remaining images and previous storage versions; the timing is described below. When you paste text, we process it to derive vocabulary and do not keep it as a readable document inside the app.
• Learning data. The words we extract (their forms, dictionary forms, how often they appear, and your recall history), plus per-page statistics like word count and coverage.
• Usage analytics. Basic product usage, including page views and feature interactions. Our analytics uses no tracking cookies or cross-site tracking. For signed-in users, we associate events with an opaque account identifier; we do not send your email address to the analytics service. If you create an account after taking the quiz, we link the quiz visit's analytics to your account.
• Tools you can use without an account. The text analyzer and the placement quiz on this site work without signing in. Text you paste into the analyzer is sent to our servers, analysed, and discarded; it is not stored or linked to you. We temporarily keep your guest quiz session and answers under a session identifier so you can finish the quiz or save its result when creating an account. Guest sessions are scheduled to expire seven days after their last saved update; automatic deletion can take several additional days.
• Error logs. If something breaks, we record a technical error report to fix it. We keep these reports to technical details and configure our error monitoring to minimise personal data; we never use them to profile you.

Please add only what you need for learning. A photo of a page may incidentally contain personal information (for example a name or a handwritten note) — avoid uploading other people's personal data.

How we use it

To run the core loop: extract vocabulary from what you add, generate short stories and word explanations from the words you are about to forget, schedule reviews, and synthesise pronunciation audio. We also use aggregate usage to understand and improve the product. We do not sell your data or use it for advertising.

Legal bases

Under the GDPR we rely on these bases:

• To provide the service — performing our contract with you (creating your account, extracting vocabulary, generating study material and audio).
• To keep the service secure and improve it — our legitimate interests, including cookieless analytics and error monitoring, balanced against your rights.
• To meet legal obligations — for example tax and accounting records where the law requires them.
• With your consent — where we ask for it; you can withdraw it at any time.

Service providers (sub-processors)

We share data only with the service providers that run parts of the product for us:

• Cloud hosting & storage — application hosting, storage of uploaded images, and account authentication, in the EU (Frankfurt).
• Database — our application database (EU).
• AI models — optical character recognition and the language models that extract vocabulary and generate stories and explanations.
• Speech synthesis — text-to-speech for pronunciation audio. Word pronunciations are cached in a shared store keyed only by the word, so they are not tied to you; sentence audio is generated each time you play it and is not stored.
• Analytics & error monitoring — cookieless product analytics and technical error reports (EU).
• Email delivery — sending account and verification emails.
• Web serving & security — serving the website, DNS, and protection against abuse.

These providers act on our instructions and are not permitted to use your content for their own purposes, including training their models. They operate primarily in the European Union; where a provider processes data outside the EU/EEA, the transfer is covered by an adequacy decision or Standard Contractual Clauses. A current list of the specific providers we use is available on request at [email protected].

How long we keep it

We keep your account and learning data while your account is active. We derive vocabulary from your text and do not retain that text as a readable document. We delete a successfully processed page image after extracting its vocabulary. Remaining images, including failed uploads, are scheduled to expire fourteen days after upload. Previous storage versions are scheduled to expire after they have been previous versions for one day. These are automatic cleanup schedules, not guaranteed deletion deadlines; physical removal can take longer.

Word-pronunciation audio is cached in a shared store keyed only by the word and is not linked to you; sentence audio is generated each time you play it and is not stored. Production infrastructure logs are configured to expire after thirty days; this does not describe the separate retention settings for product analytics or error-monitoring reports. We keep analytics and technical error reports only for as long as they are needed for product improvement, security, and troubleshooting. You can ask us for the current retention periods at the contact address below.

How we protect your data

We encrypt data in transit and at rest, restrict access to the people and systems that need it, and rely on established providers for hosting and authentication. No service can be completely secure, but we work to protect your information.

Your rights

Under the GDPR you can request access to, correction of, export of, or deletion of your personal data, and you can object to or ask us to restrict certain processing. You can delete your account and its associated learning data yourself from your profile in the app. To exercise a right concerning other records, including analytics or error reports, email [email protected] and we will action it.

You also have the right to lodge a complaint with a data protection supervisory authority. In the Czech Republic this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů); you may also complain to the authority where you live.

Children

Apera is not directed at children under 16 and we do not knowingly collect their data.

Changes

We may update this policy; we will change the date above and, for material changes, let you know.

Contact

Erik Majlath, Prague, Czech Republic. [email protected].