Privacy Policy

Last updated 2026-10-13.

This policy explains what personal data Vladimir Shirokun ("we") processes when you use Pepelen, why, and the rights you have. We are the data controller. Contact: privacy@pepelen.com.

Data we process

• Account data — your email address, an optional display name, and a hashed password (we never store your password in plain text). Used to provide and secure your account. Legal basis: performance of a contract. When you sign up we also note where you came from: the host of the site that linked to us (if any), campaign tags (utm_*) from the link you followed, and the page you landed on. Your browser holds this in the page's memory only until you sign up — no cookie, no storage on your device — and we use it solely to see which channels bring learners. Legal basis: legitimate interest in understanding where our audience comes from.
• Learning data — the cards, decks, lessons, courses, attempts and progress you create or study. Used to provide the service. Legal basis: performance of a contract.
• Technical data — minimal request metadata (e.g. IP address) used for security and rate limiting, and a first-party visit journal for measuring our audience: for visitors who are not signed in we record the page they landed on, the host of the referring site and campaign tags (utm_*) from the link, the browser family (e.g. "Chrome"), the preferred language, and a truncated IP address (the last IPv4 octet or IPv6 host bits removed) — one entry per visitor per 30 minutes, kept for 30 days, without cookies, device storage or third parties. Legal basis: legitimate interest in protecting the service and in knowing where our visitors come from.
• Usage analytics — to improve the product we record first-party, server-side events about how the app is used: pages viewed (route paths), lessons started and finished, exercise results, card reviews, placement submissions, video votes, use of the AI tutor and card generator, and search activity. We store coarse signals only — never your AI questions — linked to your account when you are signed in. Legal basis: your consent — analytics is off until you opt in via the cookie banner, and you can change it anytime under "Cookie settings" in the footer. The operator can also disable analytics entirely, and we honour your browser's Do-Not-Track / Global Privacy Control signal.
• Study reminders (optional) — if you turn on email reminders, we use your email address and the dates you studied to send you a reminder on the first, third and seventh day after you last studied, and none after that until you study again. They are off until you switch them on, are sent only to a confirmed address, and you can switch them off anytime in Settings or with the link in each email. Legal basis: your consent.
• Search journal — the text you type into the platform search, the search scope and how many results it returned, so we can see which topics learners look for and our courses do not cover. It is linked to your account only when you have opted in to analytics; otherwise it is stored without any user identifier. Entries are deleted after 90 days. Legal basis: legitimate interest in improving the catalogue (and your consent for the account link).

Processors and third parties

• AI features (optional). If you use the AI tutor or AI card generator, the text you submit (your question or topic and the current exercise) is sent to OpenAI to generate a response. OpenAI processes it as our sub-processor; API inputs are not used to train their models by default. Don't submit sensitive personal data to these features.
• Pronunciation audio. When you play a word or a sentence, the text to be spoken is sent to Google Cloud Text-to-Speech to synthesise the voice; the audio is cached so the same phrase is not synthesised twice. No account data travels with it. Where the platform cannot voice a phrase, your browser's own speech engine may be used instead, on your device.
• Embedded videos. Lessons may embed YouTube videos in privacy-enhanced mode (youtube-nocookie.com). They do not load until you allow embedded videos — via the cookie banner or by clicking "Load video" on the placeholder. Once loaded and played, Google may receive data per its own policy.
• Email. Verification and password-reset emails — and study reminders, if you turn them on — are delivered via our SMTP provider.

Cookies

We use two strictly-necessary cookies: pepelen_session (keeps you signed in) and pepelen_locale (remembers your language). We use no advertising or cross-site tracking cookies. Everything non-essential is off by default and asks for your consent once via a cookie banner — you can change your choice anytime under "Cookie settings" in the footer. The optional categories are analytics (recorded server-side, not via cookies) and embedded videos (third-party YouTube cookies, set only after you allow and play them).

Retention

We keep your account and learning data until you delete your account, after which it is erased — including your analytics events and placement results. Usage-analytics events are additionally deleted automatically after a retention period. Visit-journal entries are deleted after 30 days and search-journal entries after 90 days. Security logs are kept only as long as needed for that purpose.

Your rights

You can access and export your data and delete your account(right to erasure) at any time from Settings — step by step: how to delete your account. You may also request rectification or restriction, and lodge a complaint with your supervisory authority. To exercise any right, contact privacy@pepelen.com.

Children

Pepelen is not directed to children under 16. You must be at least 16 years old to create an account.

See also our Terms of Service and contact details.