Privacy
We process as little personal data as possible. This page explains what we store, when, and why.
Short version
This platform is self-hosted and runs without ad networks or third-party cookies. We only store what is required to operate your account and your learning progress. The one exception is a visitor count that also runs on our own server - it is loaded only if you explicitly agree, and until then it is not part of the page at all.
What data we process
On sign-up: email address, optional display name, password hash (bcrypt). During use: learning progress (read concepts and tutorials, quiz results) and selected topic interests. Server-side, standard logs are collected (IP address, user agent, timestamp) and rotated after 30 days.
Login & sessions
We use Auth.js with JWT sessions. The session cookie is HTTP-only, SameSite=Lax, and expires after 30 days. Passwords are stored only as bcrypt hashes - we cannot read them.
Cookies and local storage
Technically required and therefore set without consent: the sign-in session cookie (authjs.session-token, 30 days), your cookie decision itself (ba_consent, 6 months), the learning journey you last opened (active_journey, 60 days) and - for teachers only - presentation mode (presentation_mode, 60 days). If you arrive through a member's referral link, you also get a purpose-bound referral cookie (ba_ref, HTTP-only, SameSite=Lax, 30 days). It holds nothing but the referral code, is consumed at sign-up and deleted afterwards - no usage profile, no sharing. The parcours exercises create short-lived session cookies that keep one exercise run apart from another; they end with the run. We do not store a language preference - the language is part of the address (/de/… and /en/…). Anything beyond that we ask about first: see the next section.
Visitor counting - only with your consent
We use Rybbit, a web analytics tool we host ourselves on our own infrastructure (rybbit.ynotbetter.com). No data is passed to third parties, there is no cross-device profile and there are no advertising identifiers. Rybbit sets no cookie, but it does place a random identifier in your browser's local storage (rybbit-visitor-id) in order to attribute repeat visits to the same browser. That is a storage of information on your device within the meaning of § 25 (1) TDDG and therefore requires consent - legally it is treated exactly like a cookie. The analytics script is therefore only loaded after you have agreed. Without consent it is not part of the page we serve at all; it isn't merely disabled, it is never transmitted. The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDG). You can withdraw at any time via “Cookie settings” in the footer of every page. On withdrawal we delete the identifier from your browser immediately. Withdrawal takes effect for the future; the lawfulness of processing carried out until then is unaffected. On pages whose address carries a one-time token (password reset, email confirmation) we never load the script - not even if you have consented.
Hosting
The platform runs on our own self-hosted infrastructure behind Cloudflare for edge protection. Cloudflare briefly processes connection metadata as part of its protection features.
Third parties in the playground
Inside the playground you optionally call LLM APIs (Anthropic, OpenAI, or local models). When you use this feature, your input is forwarded to the chosen provider - nothing is sent automatically.
Your rights
You have the right to access, correction, deletion, and portability of your stored data at any time. Reach out informally by email to the address listed in the imprint.