Privacy Policy

Last updated: July 16, 2026

1. Information We Collect

We only collect the information necessary to provide you with the HSK Nest spaced-repetition service. This includes:

• Account Data: Email address and encrypted password.
• Usage Data: Flashcard study progress, review times, and algorithm parameters to schedule your next reviews.
• Billing Data (paid plan only): Your subscription status and a customer reference at our payment processor. We never see or store your card number.

2. How We Use Your Information (Legal Bases)

Your data is exclusively used to make the application function. We do not sell your data, nor do we use it for targeted advertising. Where the GDPR applies, we process account, usage, and billing data because it is necessary to perform our contract with you (Art. 6(1)(b)), and send service emails (password resets, verification, trial status) on the basis of that contract and our legitimate interest in operating the service (Art. 6(1)(f)).

3. Processors We Use

A small number of service providers process data on our behalf, only as needed:

• Stripe — payment processing for the hosted plan. Card details go directly to Stripe; we only receive a customer reference and subscription status.
• Resend — delivery of transactional emails (password reset, email verification, trial status).
• Umami (self-hosted) — privacy-friendly, cookieless page analytics running on our own server. No data is shared with any third party and no visitor is individually identified.

4. Cookies and Tracking

We use strictly necessary cookies to keep you logged in securely (NextAuth session cookies). Our analytics are cookieless. We do not use third-party tracking cookies by default without your explicit consent via our cookie banner.

5. Your Rights: Access, Export, and Deletion

You can exercise your data rights directly in the app, no email required: export your full study data as CSV at any time (Settings → Account), and delete your account and all associated data permanently (Settings → Account). These serve as our mechanisms for the GDPR rights of access (Art. 15) and erasure (Art. 17). Export remains available even after a subscription ends.

6. Contact Us

If you have any questions about this Privacy Policy, please contact us at privacy+mail@markusberlit.de.