Privacy policy

Version: 0.1 · Effective from: 4 November 2026 · Last updated: 4 November 2026

Czech text (binding)

1. Controller

The controller of personal data is TDPK Digital Group s.r.o., company ID 30120756, registered office Roháčova 145/14, Žižkov, 130 00 Praha 3, register entry: Městský soud v Praze, oddíl C, vložka 457534, e-mail [email protected]. The operator has not appointed a data protection officer.

2. What we do not collect

We do not ask for date of birth, first or last name, phone number, nationality or location. We do not store IP addresses in the database. The providers named below see the IP address in transit, and the operating logs of our servers keep it for a short time (item 3 m); to limit abuse we keep only a shortened fingerprint of it that changes every day and cannot be used to follow a user over time.

Exception: if you enter a phone number or e-mail after a quiz result (item 3 k), we store that contact.

3. What we process and why

a) Account and sign-in: e-mail address (from the e-mail link, or from Google or Apple sign-in when the provider has verified it), an identifier from the sign-in provider, app language, exam country and language, licence group, time of creation. A one-time sign-in link is valid for 15 minutes.

b) Devices and sessions: only a fingerprint of the token is stored, plus a short device name, the time created and last used. A session lasts 90 days and is extended while you use it. At most three devices.

c) Learning progress: answers, mistakes and settings are stored on your device. If you are signed in, they sync to the server so you have them on more devices.

d) Purchases: country, packs and groups bought, amount and currency, date and hour, days since installation, whether an exam date was set (yes/no), time of the consent to start delivery, any withdrawal and refund, state of the confirmation e-mail, payment identifiers at Stripe, and the price test label if any. Card data is processed by Stripe, not by us.

e) Where you came from: on first opening a link we store where you came from (for example a community or a search) and the UTM tags from the link, at most 64 characters each.

f) Invitations: your invite code, who invited you and when, and invitation rewards. To spot abuse, the daily IP fingerprint is compared for invitations.

g) Anonymous statistics: daily counts of events (for example app opened, round finished, lock window shown) by country, language and group. They contain no person or device identifier. Visits in price tests and first opens by source are counted the same anonymous way.

h) Abuse protection: number of paid-content downloads per account and day, and up to 20 daily IP fingerprints, deleted after 30 days; request rate limits. When you ask for a sign-in link, Cloudflare Turnstile checks that you are a person.

i) Translation error reports: the report text (up to 1,000 characters), the question and the language. No account and no IP address. Do not put personal data in it. The operator reads the reports, and AI tools that help judge a translation fix may process them too.

j) Consent to offers by e-mail: off until you turn it on in Settings, and only with a confirmation that you are 18 or older. We store the time and the version of the consent text. You can turn it off with one tap.

k) Contact after a quiz result: channel (Zalo, Telegram, WhatsApp, e-mail), contact, language, source, result band (passed/close/not passed), time and version of the consent. It is voluntary and needs consent and an 18+ confirmation. The operator sends the message by hand through the channel you chose.

l) Usage statistics and error reports (only with your consent, which you give or refuse in the banner and can withdraw in Settings › Privacy): events such as app opened, onboarding step, group chosen, question answered (correct or wrong, mode, free or paid; never the question text), translation toggled, lock window shown, checkout started, purchase completed, code redeemed, withdrawal requested, and technical errors with a stack trace. Each event carries the app language, platform, app version and the page path without query or fragment. It is linked to a random identifier of the installation, not to your name or e-mail. If you are signed in and not under 18, the identifier may be linked to a salted one-way hash of your account number so that the same person on two devices counts once; for under 18 it never is. We do not send e-mail addresses, names, codes, tokens, typed text or your IP address (it is not stored). We use PostHog (item 6). Unhandled server errors are also reported to PostHog without headers, bodies or personal data; the legal basis is our legitimate interest in keeping the service working.

m) Operating logs of servers: the web servers and reverse proxy on our servers record the time, the request address, the status code, the response size, the IP address and the browser identification. They serve security and troubleshooting (legitimate interest) and are kept for at most 30 days. We do not use them for profiling.

4. Legal bases

5. Cookies and storage on your device

On the web we use one cookie, __Secure-capy_session. It is needed to stay signed in (HttpOnly, Secure, SameSite=Lax) and lasts at most 90 days. We use no advertising cookies, no pixels and no cross-site tracking tools. Where the build has usage statistics, a banner asks for your consent first; until you accept, nothing is collected and PostHog stores nothing on your device. After you accept, one random installation identifier is kept in localStorage and events waiting for a connection are kept in IndexedDB; both are deleted when you withdraw.

Settings, progress, downloaded data and an unfinished test are kept in browser or app storage (IndexedDB, localStorage). They only serve the running of the app. In the mobile app the sign-in is kept in the device's secure storage.

Third-party pages you go to may set their own cookies under their own policies. These are the Stripe payment page, Google and Apple sign-in, and Cloudflare Turnstile.

6. Recipients and processors

Our servers and database are in the European Union. Some other recipients (Cloudflare, Stripe, Resend, PostHog, Google, Apple) are part of groups based in the United States or may process data outside the European Union. The transfer relies on an adequacy decision or on the providers' standard contractual clauses. We do not pass data on for advertising and do not sell it.

7. How long we keep data

8. Deleting your account

In Settings › Delete account you permanently delete the account, sign-in methods, synced progress and the device list. Consent to offers is deleted with the account.

Purchase records are not deleted but anonymised: they are detached from you and the payment identifiers at Stripe are removed. What stays is country, packs, amount, currency, date and hour, the record of consent to start delivery, any withdrawal, and the price test label.

A contact entered at the quiz is not linked to the account. Deleting the account deletes the e-mail quiz contact that is the same as the account e-mail address. A Zalo, Telegram or WhatsApp contact is not deleted with the account; ask for its deletion by e-mail to [email protected].

9. Your rights

You have the right to access your data, correct it, have it erased, restrict processing, data portability, and to object to processing based on legitimate interest. Send requests to [email protected]; we answer within one month. The app has no self-service data export yet; we send a copy on request.

You withdraw consent to offers in Settings. You withdraw the quiz consent by replying STOP or by e-mail.

You have the right to complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů) or to the supervisory authority in your country of residence.

10. Minors

People under 18 can use the service. We do not profile them and do not send them marketing. Offers by e-mail and the quiz contact need a confirmation that you are 18 or older. We do not verify age; we rely on this confirmation.

11. Automated decisions

We do no profiling and no automated decisions with legal effects. The price in a price test is assigned at random from the account number, not from personal characteristics.

12. Security

Connections are encrypted. Sign-in tokens are stored only as a fingerprint. Backups are in private storage on a separate server. No system is fully secure; in a security breach we act as the law requires and inform the affected people and the authority where mandatory.

13. Changes and contact

We may change this policy. The current text is on this page with its version and effective date. Questions: [email protected].

The Czech text is binding. Translations are for information.