Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and, where it applies to our processing (for example when we offer the service to users in the EU/EEA), the EU General Data Protection Regulation (GDPR).

2. Data We Collect

We collect the following categories of personal data when you use Daily Cyrillic:

Account Information

• Name and email address (provided via Clerk authentication)
• Profile photo (if you upload one via your auth provider)
• Authentication tokens and session data

Learning Data

• Vocabulary sets and flashcards you create
• Study progress and performance scores
• Spaced repetition intervals and review history
• Onboarding preferences (learning level, topics)

AI Interaction Data

• Chat messages sent to the AI conversational tutor
• Images uploaded for the image scanner feature
• AI-generated responses and translations

Usage Data

• Pages visited and features used
• Device type, browser, and operating system
• IP address and approximate location
• Access timestamps and session duration

Payments, trials and cancellations

• Payments: Stripe processes your card details for us; we never see or store full card numbers. We store your Stripe customer ID, plan, subscription status and billing dates.
• One free trial per card: Stripe gives us a non-reversible card fingerprint (not the card number). We keep it with your account ID to prevent repeated free trials (legitimate interest, Art. 6(1)(f) GDPR). Fingerprints are deleted 12 months after the trial started.
• Cancellation form: if you cancel without signing in, we store your email address and any contract details or message you provide to process and document the cancellation, and delete them after the statutory retention periods. Completed requests are deleted after 3 years (limitation period for contract claims).

3. Purpose of Processing

We process your personal data for the following purposes:

• Service delivery - providing the language learning platform, flashcards, spaced repetition, verb drills, and AI tutor features
• Authentication - verifying your identity and managing your account
• Progress tracking - recording your learning performance to adapt the experience to your level
• AI features - Text and images are processed via OpenRouter for translations, image analysis, grammar explanations and tutor responses. Default DeepSeek requests use hosting providers with zero data retention and no training on inputs. Luna fallback requests may go to OpenAI, which may retain inputs for abuse monitoring under its API data policy but does not train on API data. Speech is generated separately via ElevenLabs.
• Improvement - understanding how the platform is used to improve features and fix issues
• Security - protecting against unauthorized access, abuse, and maintaining platform integrity

4. Legal Basis for Processing

Where the GDPR applies, we rely on the following legal bases:

5. Data Retention

We retain your data only as long as necessary for the purposes described:

When you delete your account, all associated data is permanently removed within 30 days.

6. Third-Party Services

We use the following third-party services to operate Daily Cyrillic. Each has its own privacy policy governing how they handle data:

7. International Data Transfers

Your personal data may be processed outside Switzerland and the EEA, in particular in the United States, by the service providers named in this policy (Clerk, Stripe, Convex, OpenRouter and its hosting providers for DeepSeek, OpenAI and Google models, ElevenLabs, and PostHog Inc., whose parent company is based in the United States; PostHog stores our analytics data in its EU Cloud in Frankfurt, Germany). Our application itself is hosted by Hostinger in Paris, France (EU). Where the recipient country does not ensure an adequate level of data protection, transfers are protected by appropriate safeguards, such as:

• The Swiss-U.S. and EU-U.S. Data Privacy Framework, where the recipient is certified
• Standard contractual clauses approved by the European Commission and recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC)
• Additional technical and organisational safeguards to protect your data

8. Your Rights

Wherever you live, you have the following rights regarding your personal data under the FADP and, where it applies, the GDPR (within the scope and limits of the applicable law):

9. Exercising Your Rights

You can exercise your rights in the following ways:

• Email us at info@DailyCyrillic.com with your request
• Export your data using the CSV/Anki export feature in your dashboard settings
• Delete your account through your account settings, which will permanently remove all associated data

We will respond to your request within 30 days. We may ask you to verify your identity before processing your request.

10. Cookies

We use essential cookies to operate the service (authentication sessions). For full details on what cookies we use, how to manage them, and your choices, please see our Cookie Policy.

Product analytics with PostHog. Before you make a cookie choice or after Essential only, PostHog counts page views, interactions, performance and technical errors anonymously in cookieless mode: nothing is stored on or read from your device, visits are distinguished only by a daily-rotating salted hash of IP address and browser user agent, and IP addresses are not stored. If your browser sends Do Not Track or Global Privacy Control, PostHog is not loaded and records nothing, not even anonymously. This anonymous counting relies on our legitimate interest in understanding and improving the service (Article 6(1)(f) GDPR). Under the same legitimate interest we note coarse first-touch attribution: the referring domain, allowlisted campaign tags, the type of an ad click identifier (never the identifier itself) and the landing page. It is held only in page memory, without device storage. If you sign in during the same page session, we may save it to your account before you make a cookie choice or after you choose Accept. Essential only prevents subsequent account attribution; it does not delete attribution already saved. Only if you choose Accept do we enable full PostHog analytics: analytics cookies and browser storage, linking events to your account, masked session replay and product experiments. On our servers we also record account lifecycle and payment events under legitimate interest; if you reject or withdraw analytics consent, they are sent anonymised and are not linked to your account. To connect payments with analytics, your PostHog person ID (your internal account ID, never your email address) is stored in your Stripe customer record and removed when you delete your account. Session recordings are deleted automatically after 30 days; when you delete your account, we ask PostHog to delete your person profile. You can withdraw consent at any time in Cookie settings by choosing Essential only: PostHog then returns to anonymous counting, and its cookies and browser storage are removed. We respect Do Not Track and Global Privacy Control, and you keep your right to object to processing based on legitimate interest by contacting us. Our first-party /api/t endpoint records only aggregated daily counts by page, entry page, source, campaign, language and event. It uses no visitor identifiers, cookies, browser storage or fingerprinting, works independently of your cookie choice, and IP addresses are used briefly to limit requests and are never written to analytics records. We save learning milestones with your account, such as creating your first set or starting a trial. Functional storage dc_pending_topic keeps your chosen topic for up to 24 hours so you can continue after signup. Portfolio Analytics and the chat widget load only after consent and are deferred until after interaction or idle time; Portfolio Analytics may store a session identifier in the browser and associate events with your account when signed in. We use no advertising trackers.

11. Children's Privacy

Daily Cyrillic is not intended for children under 16. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact us so we can delete it.

12. Changes to This Policy

We may update this privacy policy from time to time. When we make significant changes, we will notify you via email or a notice on the platform. The "Last updated" date at the top of this page indicates when the policy was last revised.

13. Right to Lodge a Complaint

If you believe your data protection rights have been violated, you can lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) at www.edoeb.admin.ch. If you live in the EU/EEA, you can also lodge a complaint with your local supervisory authority, which you can find at edpb.europa.eu.

14. Contact Us

For any questions about this privacy policy or our data practices, contact us at: