Data processing and storage
0.01.31 · Alpha · 2026-10-17.1
1. Controller and scope. Aleksey Zubov is the controller for project processing; contact details are shown below. This test can fail, but its test status does not remove data-protection obligations. No sale of subscriptions, advertising tracking or online AI is active in this version.
2. On your device. Books, originals, progress, bookmarks, notes, vocabulary and settings are stored in browser storage (IndexedDB/OPFS/localStorage). Reading does not upload a whole book. Account and guest areas are separate. There is no separate application encryption of every local file. Browser clearing, eviction, private mode or domain/device changes may cause loss. You control exported and device backups; account deletion does not erase them.
3. Server records. Depending on the feature, we process account ID, email, login-provider identifier, optional display name; token hashes and session/device IDs and dates; version, hash, language and date of acceptance and the 18+ declaration; deletion requests, feedback, delivery status, audit and security records. Translation quotas are aggregate counters without book identity or searched words. Optional private profile photos are described separately below; public biographies are not stored.
4. Purposes and bases. Requested account/services and feedback are processed for contract performance or steps requested before it; protection and proportionate administration for legitimate interests; mandatory retention for legal duties. Optional processing needing consent requires a separate choice and withdrawal option. Neither acceptance of terms nor Google sign-in grants cloud-drive access or advertising consent. Providing required login/age fields is necessary for account access; local reading remains separate. No automated decisions with legal or similarly significant effects are intended.
5. Recipients. Cloudflare delivers and protects the site and processes relevant network/technical data and D 1 records; Turnstile checks protected forms. Google OAuth supplies identity/email. Microsoft Azure Translator and Google Cloud Translation receive selected translation text/languages. Wikimedia/Wiktionary, FreeDictionaryAPI.com and dictionaryapi.dev receive dictionary queries when selected/enabled. External dictionary websites receive ordinary connection data and possibly the searched word when followed. Voice/text/audio handling is controlled by the browser/device voice provider and may be online. Sign-in links and feedback notifications are sent through Resend. It receives the recipient address, message contents and delivery data.
6. Retention. Ordinary identifying account data is deleted within 30 days of a closure request, with seven days to cancel inside that period. Minimal opaque references needed by existing publications or retained audit remain separately; documented statutory/incident holds are reviewed. Sessions last up to seven days; expired/revoked session and security records are ordinarily cleaned within 30 days of expiry/revocation/event. Closed feedback is kept for 12 calendar months. Open feedback is kept while handled. Local trash normally lasts 30 days; dictionary cache has its own bounded seven-day expiry. General quota counters have no direct account IDs; provider/period totals may remain for service accounting. Some sessions may last up to 30 days; revocation ends access.
7. Infrastructure and transfers. Third-party retention, infrastructure logs and backup rotation follow applicable provider settings and agreements and may differ from project records. Processing is not guaranteed to occur exclusively in the EU. Where international-transfer safeguards are required, the applicable adequacy decisions or provider contractual safeguards must be used; information/copies can be requested from the controller. Linked product privacy notices describe vendors’ own processing. Details of account-specific regions/backups are available on request, not inferred merely from an Italian account.
8. Storage and security. Technical host-only cookies are used for sessions and short OAuth challenges. The offline cache stores only a fixed public shell, not authenticated API responses or books. Browser storage supports requested local functions. HTTPS, bounded requests, server permissions, short-lived tokens and protection checks reduce risk but do not guarantee absolute security. Optional advertising/analytics require separate information and choices before activation.
9. Rights. Where applicable, request access, correction, erasure, restriction, portability, objection or withdrawal of consent at [email protected]. Proportionate identity confirmation may be needed. The usual response period is one month, with legally permitted extensions and notice. You may complain to the competent authority, including Italy’s Garante. Server account erasure and local data deletion are distinct; direct statutory requests are considered separately from the cancellation button.
10. Changes. Material processing changes will be described in a dated revision before activation, with additional notices/consents when required. Only necessary data may be retained for documented legal duties, disputes or incident investigation; an exception is not a blanket indefinite retention rule.
Optional public dictionaries and local model files are stored separately in this browser, can be shared by accounts on the same device and are not included in personal book backups. Removing an account does not remove these public packages. Remove them through the offline tools or browser site-storage controls. Installation downloads packages from the project’s configured server; lookup/inference does not send the selected text to a translation API. Package space, browser eviction and device limits can prevent offline use.
9. Optional cloud storage. With separate permission, the selected archive passes through the Septalingua server to private Cloudflare R2 or personal Google Drive, OneDrive, Dropbox or Yandex Disk. We process the archive, name, size, checksum, opaque account/file IDs, permission and operation status. Personal-cloud tokens are encrypted on the server, separate from files, and never given to the client. Access is restricted to app files. System iCloud selection uses device permissions. Cloud quotas and request limits are account-linked; ordinary local reading sends nothing to cloud storage.
10. Disconnecting immediately removes stored tokens and pending connection requests. Archives remain until separately deleted or the account is closed. After the seven-day cancellation period, project copies and cloud metadata are erased within the overall 30-day period, subject to the stated legal-retention and incident exceptions. Cleanup failures do not restore access; the owner must monitor the queue. Personal-cloud copies remain in your storage until you delete them; external retention and terms are controlled by that provider. Check your personal cloud before repeating an uncertain upload.
14. Profile photo is optional. Your browser resizes JPEG/PNG/WebP to at most 128 pixels on the longest side and creates a PNG without the original metadata. Only this copy is uploaded, not the original photo. The server validates and re-encodes the PNG; it is stored in private Cloudflare R2 and currently accessible only to the signed-in account owner. A public community photo is not enabled. You can replace or delete it in your profile. Deletion immediately removes it from display; physical cleanup occurs when the queue is successfully processed, subject to documented lawful holds and account-deletion rules.
15. Project counters, when enabled, count site openings and installation events reported by the browser. They do not identify unique people or provide a complete installation total. Events contain no name, email, page address, referrer or book content and create no cookie or persistent visitor identifier. Random event ids prevent duplicates and are removed after two days by scheduled cleanup; daily totals remain. Abuse limits use a temporary HMAC of the network address, removed after one day by maintenance. Hosting network logs are governed separately as described above.
If you explicitly link Telegram in your profile, we store the Telegram identifier, application identifier, account link and linking/last-login dates for additional sign-in. Only identity verification is requested, without your phone, messages or permission for a bot to contact you. The server exchanges the code; the Telegram access token is not retained. An attempt lasts ten minutes; its residual record is deleted after expiry plus one day, except during an active retention hold. Unlinking deletes the link and revokes sessions; email or Google remains available. Account erasure also covers the Telegram link; audit records follow the separate rules above.
If you choose to add a passkey, we retain its public key, opaque identifiers, counter, backup status and dates. The private key and biometric data remain with your device or chosen manager; its terms govern key synchronisation. An attempt lasts five minutes; its residual record is removed after expiry plus one day, except during active retention holds. Revoking removes the website link and revokes sessions, but does not delete the key from your system manager. Account erasure also covers these records.
When you explicitly choose an AI action, the selected excerpt and specified neighbouring context may be sent to the selected OpenAI, Google Gemini or DeepL provider; the whole book, its title and identifier are not sent. Septalingua keeps request, account and model identifiers, time, token or DeepL character counts, internal-credit reservations and charges for accounting, without prompt or answer text. Completed reservation records are deleted after 90 days unless an active lawful retention hold applies; uncertain outcomes are kept until the operator reconciles them. The provider has separate processing and retention terms. Disabling API response storage does not mean the provider retains no data.
If you open a Stripe payment page, Stripe processes payment and technical data under its privacy policy: https://stripe.com/privacy. Card details are entered on Stripe; Septalingua does not receive the full card number or security code. The operator may receive transaction identifiers, dates, amounts, currency, status, payer contact details and information needed for accounting, refunds and abuse prevention. These data serve to process your chosen contribution, fulfil legal obligations and protect legitimate interests in disputes, not to grant additional benefits in Septalingua. Required accounting records are retained for the statutory period; other information only as long as needed for the transaction or a specific dispute. Stripe applies its own retention and international processing rules. Deleting your Septalingua account does not override mandatory retention of payment records.