ProsteProste Homework

Draft — the final text will be approved before the public launch.

ProsteProste privacy policy

Effective from ⟦effective date⟧. Covers the app at app.prosteproste.pl and the website prosteproste.pl.

1. Who is responsible for the data

ProsteProste is run by IBEX Maciej Kuś, ul. Szlifierska 5/6, 58-309 Wałbrzych, Poland, tax ID (NIP) 8862443484 ("we"). For anything about personal data, write to info@ibex.pl.

  • Teacher and tutor accounts, Pro list sign-ups and the "What's missing?" form — we are the controller.
  • Students' data — the controller is the teacher or tutor who added the student. We are the processor: we process this data only on their behalf, under the data processing agreement (DPA) the teacher accepts before using the account.

2. What we process and why

Teacher or tutor account

  • E-mail, name (visible only to you), language, password stored only as an argon2 hash and/or your Google account ID, and the dates of sign-up, DPA acceptance and e-mail confirmation.
  • The names of the groups and assignments you create.
  • With "Continue with Google", Google gives us your e-mail address (with the fact that it is verified), your name and your account ID. We do not store your profile picture or any other data from your Google account.
  • The only automatic e-mail is the link to set a new password, when you ask for it. Apart from that, we write to you only about your account and our agreement: changes to the documents, sub-processors, personal data breaches and termination.
  • Purpose: creating and running the account, sign-in, password reset, contact about the account and the agreement.

Students (data entrusted by the teacher)

  • A nickname chosen by the teacher (up to 30 characters), group membership, assignments and access links, answers in exercises (the word or sum practised, game type, correctness and answer rating, response time, hint use, device time and time saved) and the review schedule computed from them.
  • We do not collect children's names, e-mail addresses, photos, location or any contact details. Children do not create accounts and give no details about themselves — they only answer exercises.
  • Purpose: running assignments and showing progress to the teacher and — through a read-only link — to a parent.

The website prosteproste.pl

  • The website uses no cookies, ads, analytics or tracking tools. Practice progress is kept only in your browser's storage and never reaches us.

Pro list and "What's missing?" form

  • Pro list: e-mail address, language, where you signed up (website or app), sign-up date. Purpose: a one-time notice when the paid version starts.
  • "What's missing?": the message, the page it was sent from, optionally an e-mail for our reply; if you send it from the app while signed in as a teacher, the link to your account. Purpose: improving the service and answering you.

Security

  • We use IP addresses for attempt limits (sign-in, sign-up, password reset, forms); for sign-in the limit also applies to the e-mail address. The IP address and e-mail are then stored in the database as part of the limit key.
  • The server keeps technical logs (errors, results of scheduled jobs).
  • All traffic to the app, the website and the picture and recording files (media.prosteproste.pl) passes through Cloudflare's network, which processes the IP address and the content of requests to deliver them and to protect the service from attacks.
  • Purpose: protecting accounts and the service from abuse.

3. Legal bases

  • Account, sign-in (including with Google) and password reset: Article 6(1)(b) GDPR (contract — the terms).
  • Security, attempt limits, logs, backups, answering feedback and improving the service from it: Article 6(1)(f) GDPR (our legitimate interest: a secure and available service, replying to your message).
  • Pro list: Article 6(1)(a) GDPR (consent). You can withdraw it at any time (Article 7(3) GDPR) by writing to us; deleting your account also removes the Pro list entry with the same e-mail address.
  • Students' data: processed on the teacher's instructions (Article 28 GDPR). The teacher provides the legal basis (for example parental consent or the school's task) and confirms this before using the account.
  • Providing data is voluntary and not a statutory requirement (Article 13(2)(e) GDPR). Without an e-mail address and a password or a Google account you cannot create an account; without an e-mail address we cannot add you to the Pro list or reply to your message.

4. How long we keep data

  • Account: until you delete it. Deletion takes effect at once: sign-in and all student and parent links stop working, your e-mail and name are overwritten, and the Pro list entry with that address is removed. All other data of the account and its students (including "What's missing?" messages sent from the account) is permanently erased by the daily clean-up — usually within a day, and within 30 days at the latest.
  • A student removed from the group (archived) by the teacher: their links stop working at once, and their data is permanently erased by the daily clean-up 90 days after archiving. "Delete data now" erases the student's data at once.
  • Password reset link: valid for 1 hour and single-use; we store only its hash, and expired entries are removed by the daily clean-up.
  • Attempt-limit records (with an IP address, and for sign-in with an e-mail): a limit window lasts from 15 minutes to 1 hour; after it ends, the record is removed by the daily clean-up.
  • Database backups: made daily and before every database structure update, and kept for 30 days. The newest three are always kept, but a lifecycle rule in Cloudflare R2 deletes every backup after 35 days at the latest — after that, deleted data is gone from the backups too.
  • Server logs: ⟦rotated by size, not by age: Docker keeps the newest logs up to about 50 MB per container (weeks to months at current traffic) — confirm this wording, or set a period once log rotation is configured⟧.
  • Pro list: until the paid version starts or you withdraw consent, at most ⟦24 months — confirm; nothing removes these entries automatically yet⟧.
  • "What's missing?" messages: ⟦up to 24 months — confirm; nothing removes these entries automatically yet⟧.

5. Who processes data for us

We use providers that process data only on our instructions:

  • ⟦VPS provider and data centre country⟧ — the application and database server.
  • Cloudflare, Inc. — DNS, proxying traffic to the app and the website, attack protection, hosting of prosteproste.pl and storage of database backups (Cloudflare R2).
  • ⟦Amazon Web Services EMEA SARL (Amazon SES, eu-west-1 — Ireland) — confirm the provider and the entity (G4)⟧ — sending e-mails with the link to set a new password.
  • ⟦Anthropic — the AI assistant (Claude) that operates the service, with possible access to logs and the database: whether and how to list it here is decided by the legal consultation⟧.

Sign-in with Google: if you choose "Continue with Google", Google (in the European Economic Area Google Ireland Limited, in the United Kingdom Google LLC) confirms your identity and gives us the data described in section 2. Google acts as a separate controller of its own data, under its own privacy policy.

The pictures and recordings in the exercises are prepared in advance from the word list with the Google Gemini API (pictures) and ElevenLabs (recordings). These services receive only English words from the list, picture descriptions and the generated pictures (for an automatic check), never personal data, so they are not recipients of your data.

We do not sell data or share it with advertisers. No feature of the service passes children's answers to artificial intelligence tools.

6. Transfers outside the European Economic Area

The application and database server is in ⟦data centre country of the VPS⟧. Backups are stored in Cloudflare R2 with the European Union as the location hint, and e-mails are sent from ⟦the eu-west-1 region (Ireland) — confirm the mail provider's region (G4)⟧.

Cloudflare is based in the United States and serves traffic through a global network, so data may also be processed outside the European Economic Area. ⟦Amazon Web Services — confirm the mail provider (G4)⟧ and Google belong to groups based in the United States. Where data reaches the United States, the transfer relies on the European Commission's adequacy decision for the EU–US Data Privacy Framework (Article 45 GDPR) or, where applicable, on standard contractual clauses (Article 46(2)(c) GDPR).

7. Cookies and browser storage

  • Student and parent pages (the links from the teacher) set no cookies at all.
  • Teacher pages — nuxt-session: an encrypted session cookie; after you sign in, it keeps you signed in for up to 30 days.
  • Teacher pages — pp_lang: the language you picked with the language switch (up to 1 year).
  • Teacher pages — pp_oauth_state: only during sign-in with Google, protects against forged sign-in (CSRF) (up to 10 minutes, removed when you come back from Google).
  • All three are technical cookies; none is used for tracking, advertising or analytics.
  • Student links: browser storage (localStorage) keeps the personal link of the student picked on a class link, so it need not be picked again, and answers waiting to be sent when the device is offline.
  • prosteproste.pl: no cookies; practice progress only in browser storage.
  • We use no advertising or analytics cookies.

8. Children

Only adults may create accounts. A child uses a link from their teacher, with no account and no personal details. Children's screens have no ads, no analytics, no cookies, no third-party scripts and no streak rewards. The review schedule only chooses the next exercises; we do not profile children for marketing and make no decisions about them based solely on automated processing. We ask teachers not to use full names as nicknames.

9. Your rights

You have the right to access, rectify and erase your data, to restrict processing, to data portability and to object (Articles 15–21 GDPR), and the right to withdraw consent (without affecting earlier processing). Some of this you can do yourself in the app: viewing your account data, renaming a student's nickname, deleting a student, deleting the account. To change your name or e-mail address, get a copy of your data or anything else, write to info@ibex.pl.

For a student's data, a parent contacts the teacher (the controller); we help the teacher fulfil such a request.

You may lodge a complaint with the Polish supervisory authority, Prezes Urzędu Ochrony Danych Osobowych (Article 77 GDPR; ul. Stawki 2, 00-193 Warszawa), or in the United Kingdom with the Information Commissioner's Office.

10. Changes to this policy

We will tell signed-in users about material changes in the app or by e-mail in advance. The current version is always at app.prosteproste.pl/legal/privacy.