1. Who We Are

Galaxyglot ("we", "us", "our") is a vocabulary learning application. The data controller for personal data collected through the Service is Patrik Gobec. You can contact us at legal@galaxyglot.com.

2. Data We Collect

Account data - email and password sign-up

When you register with an email address and password we store your username, your email address, and a cryptographic hash of your password together with a random per-account salt. We never store the password itself and cannot recover it.

Account data - Google sign-in

If you choose Continue with Google, Google sends us a signed identity token which we verify. From it we store:

Your Google account identifier (Google's stable subject id). This, not your email address, is what identifies you to us on subsequent sign-ins.
Your email address, which we mark as verified. We only accept the token if Google states the address is verified.
Your name and the URL of your Google profile picture, used as your initial display name and avatar. You can change both afterwards.

We never receive your Google password, and we request no access to any other Google service - no contacts, no Drive, no Gmail, no calendar. An account created this way has no password with us at all.

If you sign in with Google using an address that already belongs to a Galaxyglot account, we do not merge the two automatically. Instead we store a short-lived link challenge - the Google id, email, name and picture URL, held server-side and never returned to the browser - until you prove you own the existing account by signing into it. Unclaimed challenges expire and are deleted automatically. If you end up with two accounts, Settings → Merge can combine them at your request.

See the Cookie Policy for what Google itself receives when the sign-in button is displayed.

Profile data

We store your display name, native language, language you are learning, interface language, and - if you upload one - your avatar image, held as binary data in our database. If your avatar came from Google, we store the URL rather than the image. Roles granted to your account (Tester, Curator for one or more languages, Admin) are stored as part of it.

Learning progress and statistics

To run the Service and show you your own progress we store:

Progress - per-word mastery levels for each course direction, per-node and per-mode completion counts, spaced-repetition scheduling, and a rolling window of your 50 most recent drill results.
Scores and streaks - XP, level, weekly XP and the date it last reset, your current daily streak, your best-ever streak, and the date you were last active.
Satellites - your current balance and when it last refilled.
Lifetime counters - total drills completed, perfect drills, and total seconds spent on drills. These are kept as running totals rather than derived from your drill history, so they do not decrease.
Daily activity - one row per calendar day on which you did genuine learning activity, recording the date, how many lessons you completed, and your streak value that day. This is what draws your activity charts.
Achievements - which badges you have unlocked, the value of the underlying metric at the moment each fired, and when it was unlocked and first shown to you.

Two of these are worth calling out. Resetting your progress does not delete your achievements or your lifetime counters - a badge records that you once did something, so it is deliberately kept. And your daily activity history has no backfill: it exists only from the day the feature shipped onwards. Deleting your account removes all of it.

User Content

Any word lists or CSV files you upload are stored to power your custom drills.

Invites and social connections

If you generate an invite link, we store the invite token, its expiry, usage limits, any role grant attached to it, and which accounts registered through it. If you follow another user, we store that follow relationship.

Feedback and word reports

If you submit feedback or report an issue with a word (for example a wrong translation, image, or audio clip), we store the category or reason, your message, the relevant word or page, and your account id, so Curators and Admins can review and act on it.

Curator, Admin and tester activity logs

If you hold a Curator, Admin or tester role, the actions you take - editing content, casting validation votes, managing users, granting roles, using tester tools - are recorded in an audit log, together with a snapshot of your account id, username, display name and roles at the time, and a timestamp. Ordinary learning activity (drills, progress, XP) is never audit-logged. A few account events (password resets, account deletion) and the feedback and word reports you send are logged with your account id so they can be reviewed.

Technical data

We collect standard server logs that may include your IP address, browser type, operating system, referring URLs, and timestamps of requests. This data is used solely for security, debugging, and abuse prevention.

When the app or our servers hit an error, an error report is sent to our error-monitoring service: the error message and code location, the page path, and your browser and operating system. It carries no IP address, no cookies, no account name or email, and none of your answers. Reports are kept for up to 90 days.

Sign-up funnel

To see where new visitors give up before they start learning, we record the first time each browser reaches a handful of onboarding steps: viewing the landing page, trying the app as a guest, picking a course, starting and finishing a first drill, creating an account, and coming back on a later day. Before you sign in, these records are tied to a random identifier the app creates and keeps in your browser's localStorage (galaxyglot.anon.v1); it contains nothing about you, is used only by Galaxyglot, is never shared with anyone, and is not used to follow you across other sites. When you sign in, the identifier is linked to your account (so that the XP and streak you earned as a guest are credited to it) and then removed from your browser. Signing out also clears it. The records hold only the step and its date, and are deleted with your account.

Local storage and cookies

Your session token lives in a first-party cookie your browser cannot read or hand to a script - only our server sets and clears it. Settings and a cache of your progress and profile are stored separately in your browser's localStorage. See our Cookie Policy for the full list.

3. What Other People Can See

Some of your data is visible to others by design. Specifically:

The global and weekly leaderboards are public - they can be read without signing in. An entry shows your username, display name, avatar, XP, level, weekly XP and your highest-tier badges. If you would rather not be identifiable there, choose a username and display name that do not identify you, and do not upload a personal photo as your avatar.
User search and follower lists show the same fields to other signed-in users.
Your email address is never shown to anyone else. It is returned only to you, on your own account, and is deliberately excluded from every shape of your profile that reaches another user.
Curators and Admins can see feedback, word reports and audit entries, including which account submitted them.

4. How We Use Your Data

Providing the Service - to authenticate you, display your progress and statistics, schedule reviews, personalise quizzes, and award XP, streaks and achievements.
Security - to detect and prevent fraud, abuse, and unauthorised access, and to keep one person's cached progress from reaching another account on a shared browser.
Content moderation - reviewing word reports and feedback to maintain content quality.
Social features - leaderboards, invites and follows.
Improvement - aggregated, anonymised usage patterns help us improve features.
Communication - to respond to support requests you initiate.

We do not sell your personal data to third parties. We do not use your account or learning data for advertising, and we do not build advertising or behavioural profiles ourselves. The optional rewarded ads are served by Google, which handles its own ad data as described in section 7.

5. Legal Bases (GDPR)

Where the GDPR applies, we process your personal data on the following legal bases:

Contract performance - processing necessary to provide the Service you signed up for, including authentication (whether by password or through Google), progress tracking, and the statistics and achievements that are part of the product.
Legitimate interests - security monitoring, abuse prevention, the accountability audit log for privileged roles, and the first-party sign-up funnel described in section 2.
Consent - where you supply optional data such as an avatar, or opt into optional features. Personalised advertising by Google relies on the consent you give or refuse in Google's consent message.

6. Data Retention

We retain your account data, progress, statistics and achievements for as long as your account exists. Server logs are retained for up to 90 days. Feedback and word reports are retained for up to 180 days, after which they may be deleted unless needed for an ongoing review. Audit log entries stay in the live database for a limited period, currently planned as 12 months. Each finished month is also copied to an archive file that is kept permanently. Archived entries carry no names, only an account id, and entries about learners keep only the action, the account id and a date. Expired sessions and unclaimed Google link challenges are deleted automatically; we also keep only your eight most recent sessions.

When you delete your account, your profile, progress, statistics, achievements, follows, invites and uploaded content are deleted immediately, and any remaining copies are removed within 30 days. Your name is removed from the audit log entries about you.

Curator and tester work records. Before you first use the curator console, the admin console or tester mode, you are asked to accept a short notice explaining this section. If you did curator work (votes, proposals, alternative translations, endorsements), that work stays after you delete your account, because other content depends on it: your account is replaced by a closed placeholder named "~curator-" followed by a number, which holds no email, password or other personal data and cannot sign in, and your audit log entries show that placeholder in place of your name. We keep these work records on the basis of our legitimate interest in an accountable content history. Exception: if an Admin removes an account because it was compromised or misused, the votes it cast are withdrawn and the audit log keeps its name as a security record, on the basis of our legitimate interest in preventing abuse.

7. Data Sharing

We do not share your personal data with third parties except:

Google - if you use Google sign-in. Google acts as an independent controller for the sign-in interaction: it learns that you are signing in to Galaxyglot, and receives your IP address and browser information when its button is displayed. Its handling is governed by Google's Privacy Policy. Registering with an email address and password avoids this entirely.
Google AdSense - the optional "watch an ad for a satellite" feature. While you are signed in, Google's ad script is loaded so an ad is ready when you ask for one; Google receives your IP address, browser and device information, and may use cookies as described in the Cookie Policy. Google acts as an independent controller for this, and its use of that data is governed by the Google Ads Controller-Controller Data Protection Terms. We never pass it your name, email address, username or learning data.
Sentry (Functional Software, Inc.) - error monitoring, as a processor on our behalf, receives the error reports described in section 2. Its data is stored in its EU (Germany) region.
Infrastructure providers - our hosting provider processes data on our behalf under a data processing agreement.
Curators and Admins - trusted internal roles can access reported content, feedback, and audit logs strictly to moderate content and administer the Service.
Other users and the public - as described in section 3 above.
Legal requirements - if required by law, court order, or to protect our legal rights.

8. International Transfers

Your data is processed on servers located within the European Economic Area (EEA). The routine exceptions are Google sign-in, if you use it, and Google's ad service: both can send data to Google LLC in the United States. Google self-certifies under the EU–US Data Privacy Framework and additionally relies on Standard Contractual Clauses. Where we transfer data outside the EEA we ensure appropriate safeguards are in place.

9. Your Rights

Under GDPR and applicable law, you have the right to:

Access the personal data we hold about you.
Rectify inaccurate data (via the Settings panel).
Erase your data ("right to be forgotten") by deleting your account or contacting us. Account deletion asks you to confirm with your password, or - for a Google account, which has no password - with a fresh Google sign-in, so that only you can trigger it.
Restrict or object to certain processing.
Data portability - download a machine-readable (JSON) copy of your account data and learning progress yourself, using "Download my data" in Settings, or request one by contacting us at the address below.
Withdraw consent at any time where processing is based on consent.
Lodge a complaint with your national data protection authority (in Slovenia: ip-rs.si).

To exercise any of these rights, contact us at legal@galaxyglot.com. We will respond within 30 days.

10. Children's Privacy

The Service is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us data, please contact us and we will delete it promptly.

11. Security

We use industry-standard measures to protect your data. Passwords are hashed with scrypt using a random per-account salt, and verified in constant time. Session tokens are never stored in readable form - we keep only a SHA-256 hash of each, so a copy of our database does not yield working sessions. Google identity tokens are verified against Google's own keys server-side, and no sign-in path accepts an account identifier supplied by the browser. Traffic is protected with HTTPS in transit, and access controls are applied on our servers. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy. We will notify you of material changes via the Service or by email. Continued use after changes take effect constitutes acceptance of the updated policy.

13. Contact

Questions or requests regarding this policy: legal@galaxyglot.com.