Privacy policy
Last updated: 7 November 2026
In short: without an account, your progress stays in your own browser and we never receive it. With an account, we store your email address and your learning progress, only to give you the service. No ads, no tracking, no selling of data. You can delete your account at any time.
1. Who is responsible
Little by Little (learnlittlebylittle.com) is run by [Your name], a private person in the Netherlands. [Your name] is the controller of your personal data under the General Data Protection Regulation (GDPR). Contact: [email protected].
2. What we store, and why
| Data | Why | Legal basis (GDPR art. 6) |
|---|---|---|
| Email address and password (stored only as a secure hash, never readable) | To create your account, let you log in and send the emails the account needs: confirming your address and resetting your password | Contract (1b) |
| Learning progress and settings: which words and exercises you practised and with what result, days studied, saved words, course settings | To show your progress and let you continue on any device | Contract (1b) |
| Technical data: IP address, browser type, time of requests, and the result of the anti-bot check on the account forms | To deliver the website securely and keep bots and abuse out | Legitimate interest (1f): security of the service |
We do not use your data for advertising or profiling, we do not sell it, and we only send emails that your account needs (no newsletters).
3. Without an account
You can use the courses without an account. Your progress is then kept only in your browser's local storage on your own device. We do not receive it. Clearing your browser data deletes it.
4. Cookies and local storage
We do not use tracking or advertising cookies, and no analytics. The site uses your browser's local storage for your progress, your interface choices and, when you are logged in, your login session. This is strictly necessary for the service, so no consent banner is needed.
5. Who processes the data for us
We use these service providers. Each one has a data processing agreement with us and may only use the data to provide its service.
| Provider | What for | Where |
|---|---|---|
| Supabase Inc. | Account login and the database with your progress | Servers in Frankfurt, Germany (EU) |
| Cloudflare Inc. | Hosting the website, protection against attacks, and the anti-bot check (Turnstile) on the account forms | Global network; transfers outside the EU are covered by the EU–US Data Privacy Framework and the EU standard contractual clauses |
| Sendinblue SAS (Brevo) | Sending account emails | EU (France) |
6. How long we keep it
- Account and progress: until you delete your account. Deleting is immediate and permanent.
- Accounts that have not been used for 2 years may be deleted. We email you first, so you can keep it.
- Technical logs at our providers are kept for a short time only, usually days to a few weeks.
7. Your rights
You have the right to access, correct and delete your data, to receive it in a portable format, and to object to or restrict its use. Most of this you can do yourself:
- Export: Ajustes → Export backup downloads all your progress as a file.
- Delete: Cuenta → Delete account removes your account and all progress.
- Anything else: email [email protected]. We reply within one month.
You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority in your own EU country.
8. Age
Accounts are for people aged 16 and over.
9. Security
All connections are encrypted (HTTPS). Passwords are stored only as hashes. Database rules make sure every account can only read and change its own progress.
10. Changes
If this policy changes, we update the date at the top. For important changes, we tell account holders by email.