Privacy Policy

Effective: 14 May 2026

1. Data controller

The operator of jirisuder.eu and the Letesh language-learning app is Jiří Suder, a private individual (no business registration; this is a hobby project). For any privacy-related questions: jiri.suder.92@gmail.com.

2. What we collect

When you visit (no account)

• IP address — stored in nginx access logs and an internal audit_log for rate-limiting and abuse detection.
• User-Agent string — your browser identifier, in logs only.
• Cloudflare Turnstile processes your IP and a browser fingerprint when you load the registration form, to detect bots.

When you register a Letesh account

• Email address — your account identifier.
• Password hash — we never store your plaintext password. We store only a one-way bcrypt hash (cost 12).
• Study data — decks, cards, progress, settings you create.
• Session cookie — a random 32-byte token named letesh_session (HttpOnly + Secure + SameSite=Strict).
• Audit log entries — registration, login, password-change events (timestamp, IP, User-Agent) for security review.

Browser-side storage

• localStorage — your study data, language preference, app settings. This data never leaves your browser unless you sign in.
• sessionStorage — a transient "guest mode" flag.

3. Purposes & legal basis

Purpose	GDPR Art. 6 basis
Running your account & syncing data	(b) Contract performance
Sending verification / password-reset emails	(b) Contract performance
Anti-abuse: rate limit, CAPTCHA, audit log	(f) Legitimate interest in service security
Operational logs	(f) Legitimate interest

4. Recipients & processors

Vendor	Location	Purpose	Data they see
Oracle Cloud Infrastructure	Stockholm, Sweden (EEA)	Server hosting	Everything stored in DB
Resend, Inc.	Delaware, USA	Transactional email	Email address + email body
Cloudflare, Inc.	California, USA	Turnstile CAPTCHA	IP, browser fingerprint
ISRG (Let's Encrypt)	California, USA	TLS certificates	Domain names only, no personal data

Note: web fonts (Inter, JetBrains Mono) are self-hosted on our server — no requests are made to Google or any third-party CDN for typography.

5. Transfers outside the EEA

Two of the processors above (Resend, Cloudflare) operate from the USA. Transfers are covered by Standard Contractual Clauses (SCCs) under GDPR Art. 46, available in each vendor's public Data Processing Agreement.

6. Retention

• Account & study data: until you request deletion, or after 24 months of inactivity.
• Operational & audit logs: 30 days.
• Email service logs (Resend): per Resend's own retention (typically 30–90 days).

7. Your rights

Under GDPR you have the right to:

• Access your personal data (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure — "right to be forgotten" (Art. 17)
• Restriction of processing (Art. 18)
• Portability (Art. 20)
• Object to processing based on legitimate interest (Art. 21)
• Complaint to your data-protection authority. The lead supervisory authority for our processing is Datatilsynet (Norway), as the operator is resident in Norway. Czech residents may alternatively file with ÚOOÚ (uoou.cz); other EU/EEA residents may file with their local DPA.

Two of these rights can be exercised directly from the Letesh app while signed in:

• Right to portability (Art. 20): open Settings → Account → "Download my data" to get a JSON export of your account data, study state, and activity log.
• Right to erasure (Art. 17): open Settings → Account → "Delete my account" to permanently remove your account and all server-side data after password confirmation.

For any other right or question, email jiri.suder.92@gmail.com. We reply within 30 days.

8. Security measures

• All traffic over HTTPS (Let's Encrypt, TLS 1.2+, HSTS enforced)
• Passwords stored only as bcrypt hash (cost 12)
• Session cookies are HttpOnly + Secure + SameSite=Strict
• Server behind nginx reverse proxy with per-IP rate limits
• Cloudflare Turnstile CAPTCHA guards the registration form
• fail2ban watches SSH for brute-force attempts

9. What we do NOT do

• We do not sell or rent your personal data to any third party.
• We do not send marketing or promotional emails. Account emails are limited to transactional content — email verification and password reset.
• No automated decision-making or profiling (GDPR Art. 22). The SM-2 spaced-repetition algorithm operates only on your own study data to schedule card reviews; it does not produce decisions with legal or similarly significant effects on you.
• No cross-site tracking, no analytics, no advertising pixels. See our Cookies notice for the full list of browser-side storage we use.

10. Data breach notification

Should a personal-data breach occur that is likely to result in a risk to your rights and freedoms, we will notify Datatilsynet without undue delay and at the latest within 72 hours (GDPR Art. 33) and inform affected users via email (Art. 34).

11. Age requirement

Letesh is intended for users 16 years or older. If you are under 16, please obtain a parent or guardian's consent before registering. We do not knowingly collect personal data from children under 16; if we learn of such collection, we will delete the account.

12. Changes to this policy

We may update this policy from time to time. The effective date at the top of this page reflects the current version. Material changes will be communicated by email to registered users.

13. Contact

Jiří Suder · jiri.suder.92@gmail.com