Privacy Policy

1. Data controller and contact

The controller for your personal data is Oma Suomi, Finland. For privacy questions, requests or complaints, contact [email protected].

We have not appointed a statutory Data Protection Officer. Privacy requests are handled by the operator. We aim to respond within one month; complex requests may take longer, and we will tell you if that is the case.

2. Scope

This policy covers the public website, account registration, the learning dashboard, vocabulary and reading practice, progress tracking, support email and account emails. It does not cover third-party websites you reach through external links.

3. Personal data we collect

We collect the following categories:

Account and preferences

• email address and display name;
• password, stored as a one-way hash by our authentication provider (we do not see it);
• target level, daily goal, daily word goal and vocabulary-hint preference;
• account timestamps and authentication session information.

Learning activity

• vocabulary progress, review ratings and review dates;
• learning sessions and current position;
• quiz sessions, answers, scores and XP;
• reading attempts, answers, scores, bookmarks and AI feedback;
• achievements and progress statistics.

Technical and security data

• IP address, browser/user-agent, timestamps and request logs processed by our hosting, security and database providers;
• authentication cookies and the local-storage value that remembers your cookie choice;
• error and security information needed to keep the service working and prevent abuse.

Communications

• account confirmation and password-reset emails;
• messages you send to our contact address, including your email address and the content of your message.

Optional analytics

If you select Accept all in the cookie banner, Google Analytics 4 collects usage information such as pages viewed, approximate location derived from IP, device/browser information and interactions. It is not used for advertising or ad personalisation. See our Cookie Policy.

Please do not submit health information, identity documents, passwords or other sensitive personal data in reading answers or support messages.

4. Why we use data and our lawful bases

Performance of our contract with you

We use account data and learning activity to create and secure your account, provide vocabulary/reading practice, save progress, calculate reviews and XP, show your dashboard and send essential account emails. Without this data we cannot provide the service.

Consent

We use Google Analytics only after you choose Accept all. You can withdraw consent at any time with Cookie settings in the footer, or by clearing this site's cookies/site data so the banner appears again. Analytics storage then returns to denied and existing analytics cookies are cleared. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

Legitimate interests

We process limited technical logs, security information and aggregated service-usage information to keep the service secure, prevent abuse, diagnose errors and improve the learning experience. We balance these interests against your rights and expect this processing to be limited to what is necessary for those purposes.

Legal obligations

We may process or retain information where required by law, to respond to lawful requests from authorities, or to establish, exercise or defend legal claims.

5. Cookies and local storage

Essential cookies keep you signed in. A local-storage value remembers your cookie choice. Google Analytics cookies are optional and are not enabled unless you accept analytics. Our fonts are served from our own domain, not from Google Fonts.

Read the Cookie Policy for the current list, purposes and durations.

6. AI-assisted reading feedback

When you submit an open-ended reading answer, we send the relevant passage, question, rubric/key points and your answer to our AI provider, Groq, to produce provisional feedback. The request is used to return the assessment; we do not include your name or email address in that AI request. The provider processes the request under its own terms and data-protection commitments.

AI feedback is not an official YKI assessment. We do not use solely automated processing to make decisions that produce legal effects or similarly significantly affect you. You can contact us if you believe an assessment is wrong.

7. Who receives data

We do not sell personal data. We share it only with service providers that help us run the service, and only as needed:

• Supabase — authentication and database hosting. Our production database is hosted in the EU (Frankfurt region).
• Resend — delivery of account confirmation and password-reset emails.
• Groq — AI processing of open-ended reading answers and rubric context.
• Google Analytics — optional usage measurement, only after you accept analytics.
• Cloudflare and our hosting provider — content delivery, security, server logs and application hosting.
• professional advisers, authorities or courts where required by law, or a successor organisation if the service is transferred, subject to appropriate safeguards.

Authorised administrators can access account and learning data only as needed to operate, support and secure the service.

8. International transfers

Our production database is hosted in the EU. Some providers — including email, AI processing and analytics providers — may process data outside the European Economic Area, including in the United States. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, an adequacy decision, or another lawful transfer mechanism. Contact us if you would like more information about the safeguards for a particular provider.

9. How long we keep data

• Account and learning data: for as long as your account is active. When you ask us to delete your account, we delete the live records; residual copies may remain in provider backups for a limited period before they expire.
• Support messages: for as long as needed to resolve the request and meet legal obligations, then deleted.
• Analytics: retained according to the retention settings of our Google Analytics property and Google's standard retention rules. Analytics cookies can last up to two years. No analytics data is collected if you do not accept analytics.
• Security logs: for a limited period needed to investigate incidents and prevent abuse.

We may retain limited information for longer where the law requires it or where necessary for legal claims.

10. Security

We use HTTPS, authentication, row-level access controls, security-definer database functions, restricted administrative access and reputable infrastructure providers. Passwords are hashed by our authentication provider. No online service is completely secure; if we become aware of a breach that is likely to result in a high risk to your rights, we will notify you and the supervisory authority where required.

11. Your rights

Subject to applicable law, you have the right to:

• access a copy of your personal data and information about how we use it;
• correct inaccurate or incomplete data;
• request deletion of your data (the right to be forgotten);
• restrict or object to certain processing;
• receive your data in a portable, machine-readable format;
• withdraw analytics consent at any time;
• complain to a supervisory authority.

To exercise a right, email [email protected]. We may ask for information to verify that the request relates to you. We will not charge a fee unless a request is manifestly unfounded or excessive. You can also delete your account by contacting us; some information may be retained where the law requires it.

12. Children

The service is intended for users aged 16 or older. We do not knowingly collect personal data from anyone under 16. If we learn that we have done so, we will delete the account and its data.

13. Changes to this policy

We may update this policy when the service, providers or law changes. The “Last updated” date shows the current version. For material changes, we will give reasonable notice on the site or by email where appropriate. Please review the policy periodically.

14. Complaints and supervisory authority

Please contact us first at [email protected] so we can try to resolve your concern. You also have the right to lodge a complaint with the Finnish Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) at tietosuoja.fi or with the supervisory authority in your country of residence.

See also our Terms of Service.