Privacy policy

_Last updated: 2026-07-31_

Who we are

**[Data controller: insert your name or legal entity, and country of establishment]** operates Thoth (this app). For anything in this policy, or to exercise any of the rights below, contact: [insert a real privacy/support email address].

What we collect, and why

Thoth is a German-learning app with user accounts. Everything we collect exists to run the learning features you actually use — nothing is collected for advertising, profiling, or resale.

• Account data: your email address (required), display name

(optional), and password — stored only as a salted bcrypt hash, never in plain text and never visible to us.

• Learning activity: which words you've studied and how well

(spaced-repetition state, review history), listening history, daily streaks and goals, achievements, and the resulting contribution score shown on your avatar.

• Community contributions: any data-quality flags you submit on word

entries, and — if you're a moderator — the flags you review.

• Preferences: theme, audio autoplay, and speech-playback-rate

choices. These are stored on our server as your account default and separately in your browser's local storage as a per-device override — the local-storage copy never leaves your device.

We rely on performance of a contract (GDPR Art. 6(1)(b)) as the legal basis for this processing: it's the data necessary to provide the account and learning features you signed up for.

Cookies and local storage

Thoth uses only two kinds of browser storage, both strictly necessary for the service to function:

1. A session cookie, set when you sign in, so you stay logged in

between page loads. Without it the app cannot work for a signed-in account.

1. Local storage (not a cookie) for the device-level preferences

listed above, so your theme/audio choices survive a page reload.

**We do not use analytics cookies, advertising cookies, or any third-party tracking technology.** Under the ePrivacy Directive and GDPR guidance, cookies/storage that are strictly necessary to provide a service you've explicitly requested are exempt from the opt-in consent requirement that applies to tracking or advertising cookies — which is why you won't see a cookie-consent banner here. This section is that disclosure.

Who else sees your data

Nobody. Thoth doesn't use any third-party analytics, advertising, customer-support, or email-marketing service. Your data is stored in our own database and is not shared with, sold to, or processed by any third party, except:

• Our hosting/database provider, if Thoth is deployed on third-party

infrastructure (e.g. a cloud host and managed database) rather than self-hosted — they process data on our behalf under their own data processing agreement, strictly to keep the service running, and never access your data for their own purposes.

How long we keep it

We keep your data for as long as your account exists. If you delete your account, your profile and everything tied to it (review history, streaks, notes, submitted flags) is permanently deleted immediately — see Settings → Danger zone, or the rights below.

Your rights

Under the GDPR, you have the right to:

• Access the data we hold about you — use **Settings → Export my

data** for a complete machine-readable copy at any time.

• Rectify inaccurate data — edit your display name in Settings; email

changes or anything else, contact us at the address above.

• Erase your data — use **Settings → Danger zone → Delete my

account**, which is immediate and permanent.

• Restrict or object to processing, and data portability — the

export above is already a portable format; contact us for restriction or objection requests.

• Lodge a complaint with your local data protection supervisory

authority if you believe your data has been mishandled.

Children

Thoth isn't knowingly directed at or marketed to children under 16 without parental consent, in line with GDPR Art. 8.

Security

Passwords are hashed with bcrypt and never stored or logged in plain text. No online service can guarantee absolute security, but we don't collect more than the learning features above require, which limits what there is to protect.

Changes to this policy

If this policy changes materially, we'll update the date at the top. Continuing to use Thoth after a change means you accept the updated policy.