Privacy policy

This policy explains what Apera collects, why, and your choices. Apera is operated by Erik Majlath (Prague, Czech Republic) ("we", "us"), the data controller. For privacy questions, contact [email protected].

What we collect

• Account. Your email address and a password, to create and secure your account. We do not ask for your name; a display name is derived from your email. Authentication is handled by an established EU-hosted identity service.
• Content you add. When you upload a page image, we hold that image only transiently — long enough to extract its vocabulary — and then delete it. When you paste text, we process it to do the same. We do not keep your uploaded text as a readable document inside the app — we derive vocabulary from it.
• Learning data. The words we extract (their forms, dictionary forms, how often they appear, and your recall history), plus per-page statistics like word count and coverage.
• Usage analytics. Basic product usage (page views, feature events). This is cookieless — we use no cookies, no tracking pixels, and no cross-site tracking, so no cookie banner is needed.
• Error logs. If something breaks, we record a technical error report to fix it. We keep these reports to technical details and configure our error monitoring to minimise personal data; we never use them to profile you.

Please add only what you need for learning. A photo of a page may incidentally contain personal information (for example a name or a handwritten note) — avoid uploading other people's personal data.

How we use it

To run the core loop: extract vocabulary from what you add, generate short stories and word explanations from the words you are about to forget, schedule reviews, and synthesise pronunciation audio. We also use aggregate usage to understand and improve the product. We do not sell your data or use it for advertising.

Legal bases

Under the GDPR we rely on these bases:

• To provide the service — performing our contract with you (creating your account, extracting vocabulary, generating study material and audio).
• To keep the service secure and improve it — our legitimate interests, including cookieless analytics and error monitoring, balanced against your rights.
• To meet legal obligations — for example tax and accounting records where the law requires them.
• With your consent — where we ask for it; you can withdraw it at any time.

Service providers (sub-processors)

We share data only with the service providers that run parts of the product for us:

• Cloud hosting & storage — application hosting, storage of uploaded images, and account authentication, in the EU (Frankfurt).
• Database — our application database (EU).
• AI models — optical character recognition and the language models that extract vocabulary and generate stories and explanations.
• Speech synthesis — text-to-speech for pronunciation audio. Shared word pronunciations are cached globally and not tied to you; story and sentence audio is cached per user for a limited time.
• Analytics & error monitoring — cookieless product analytics and technical error reports (EU).
• Email delivery — sending account and verification emails.
• Web serving & security — serving the website, DNS, and protection against abuse.

These providers act on our instructions and are not permitted to use your content for their own purposes, including training their models. They operate primarily in the European Union; where a provider processes data outside the EU/EEA, the transfer is covered by an adequacy decision or Standard Contractual Clauses. A current list of the specific providers we use is available on request at [email protected].

How long we keep it

We keep your account and learning data while your account is active. We derive vocabulary from your text and do not retain that text as a readable document. We delete each uploaded page image as soon as we have extracted its vocabulary — right after processing — and do not retain the image afterward. Shared word-pronunciation audio is cached globally and is not linked to you; story and sentence audio is cached per user for a limited time and is not retained beyond that.

How we protect your data

We encrypt data in transit and at rest, restrict access to the people and systems that need it, and rely on established providers for hosting and authentication. No service can be completely secure, but we work to protect your information.

Your rights

Under the GDPR you can request access to, correction of, export of, or deletion of your personal data, and you can object to or ask us to restrict certain processing. Email [email protected] and we will action it.

You also have the right to lodge a complaint with a data protection supervisory authority. In the Czech Republic this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů); you may also complain to the authority where you live.

Children

Apera is not directed at children under 16 and we do not knowingly collect their data.

Changes

We may update this policy; we will change the date above and, for material changes, let you know.

Contact

Erik Majlath, Prague, Czech Republic. [email protected].