Privacy Policy

In short

• You can use the lessons without an account. Without one, your progress stays only in your browser and is not sent to us.
• If you create a free account, we store your email address, a securely hashed form of your password (never the password itself), your learning progress and your settings. If you sign in with Google or Apple, we also store the account identifier that company gives us.
• We use no advertising, no analytics service and no tracking cookies.
• We do not sell or share your personal data.
• You can delete your account and everything stored with it at any time on your Account page.

Who is responsible

Kosmolingo (kosmolingo.com) is run by Alberto Martinez, an individual based in Tijuana, Baja California, Mexico (“we”). We are responsible for your personal data under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP). You can reach us at contact@kosmolingo.com.

What is stored on your device

If you are not signed in, your progress (lessons viewed, quiz scores and the days you practised) and your last learning pair are kept only in your browser's local storage, where we cannot see them. You can delete them at any time with “Reset progress” on the Progress page, or by clearing this site's data in your browser. When you log out, this device's copy is removed.

We set a few small functional cookies, none of them used to track you: kl_locale remembers your interface language and kl_script_sr your choice of Serbian alphabet (each up to one year); kl_session keeps you signed in (up to 30 days, and it can't be read by scripts on the page); kl_csrf is a random security code that protects your account against requests from other websites (up to 30 days); and kl_oauth is used for a maximum of 10 minutes while you sign in with Google or Apple.

Student accounts

Accounts are optional. If you create one, we store:

• Your email address, and whether you have confirmed it. We use it to sign you in and to send you account emails (confirming your address, resetting your password). We do not send newsletters or marketing.
• Your password, hashed. We store only a salted scrypt hash, which can't be turned back into your password. Nobody at Kosmolingo can see your password.
• Your learning data: lessons viewed, quiz scores and attempts, the days you practised, and your settings (interface language, learning pair, Serbian alphabet). Signing in adds the progress already saved in your browser to your account, so it syncs across your devices.
• Sign-in sessions: for each signed-in browser or app, a hashed session code, when it was created and last used, and the browser or app name, so you can stay signed in. Sessions end when you log out, change or reset your password, or after 30 days without use (90 days in our mobile app).
• Security counters: to stop password guessing and abuse, we briefly count attempts per IP address and per email address. They are stored only as one-way hashes and deleted after about an hour.

Signing in with Google or Apple

If you choose “Continue with Google” or “Continue with Apple”, that company confirms who you are and sends us a unique account identifier and your email address (and whether it is verified). We never receive your Google or Apple password, contacts or anything else. With Apple you can use “Hide My Email”; we then only receive Apple's relay address.

You can link or unlink Google and Apple on your Account page. Your use of those services is covered by Google's privacy policy and Apple's privacy policy.

Where account data is stored and for how long

Account data is stored in Cloudflare D1, a database service run by Cloudflare, Inc. for us, which we have asked to keep it in North America. Account emails are sent through Cloudflare's email service, which processes your address and the message only to deliver it.

We keep your account data for as long as you have an account. When you delete your account, everything listed above is deleted from our database immediately; Cloudflare's automatic backups of the database are overwritten within 30 days. Email links expire after 24 hours (address confirmation) or 1 hour (password reset).

Hosting and server logs

The site runs on Cloudflare Workers, provided by Cloudflare, Inc. (USA). As with any website, when your browser requests a page, Cloudflare processes technical information such as your IP address, the page requested, the date and time, your browser type and your approximate country.

We have Cloudflare's Workers logging switched on so we can find and fix errors. These logs are kept for a few days and then deleted automatically. Cloudflare may also use this information to protect the site against attacks and abuse, and your browser may send Cloudflare anonymous network error reports. Learn more in Cloudflare's privacy policy.

We do not use Google Analytics, Cloudflare Web Analytics or any other analytics or advertising tool. Our fonts are served from our own site, so no requests go to font providers.

Audio and pronunciation

Pronunciation uses the text-to-speech voices built into your browser or device. Kosmolingo does not send what you listen to to our servers. Some browsers offer online voices (for example from Google or Microsoft); if your browser uses one, the text being spoken may be sent to that company under its own privacy terms.

If you email us

If you write to us, we use your email address and message only to reply to you, and we keep them only as long as needed for that.

Why we use this information

We use the information above only to provide the website and your account, keep them secure and fix problems. We do not use it for marketing, profiling or automated decisions. Because Cloudflare's network is global, the data may be processed on servers outside your country, including in the United States.

Your rights

Under Mexican law you have the ARCO rights: to Access your personal data, to Rectify it, to Cancel (delete) it and to Oppose its use. You can also withdraw any consent you have given.

If you live in the European Union, the United Kingdom or another place with similar laws, you also have the right to access, correct, delete, restrict or object to the use of your data, to receive a copy of it, and to complain to your local data protection authority.

Much of this you can do yourself: your Account and Progress pages show what we keep, and there you can change your password, unlink Google or Apple, and delete your account with all its data. Without an account, clearing this site's data in your browser removes everything. For anything else, write to contact@kosmolingo.com and we will answer within the time limits set by law.

Children

Kosmolingo is for learners of all ages, and no account is needed to use the lessons. Accounts are meant for people who can agree to this policy themselves; younger children should create one only with a parent or guardian. If you believe a child has given us personal data without permission, write to contact@kosmolingo.com and we will delete it.

What will change later

We plan to add paid plans and an AI tutor. These will involve more data, such as payments handled by a payment provider and the messages or voice you send to the AI tutor. Before either goes live, we will update this policy and, where the law requires it, ask for your consent.

Changes to this policy

When we change this policy, we will update the date at the top of this page. If the changes are important, we will also show a notice on the site.