1Who is responsible
The controller within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR) is:
- Name
- Pavel Sergienko
- Address
- 1210 Wien, Österreich
- privacy@kenne.app
For any question about your data, or to exercise any of your rights, write to privacy@kenne.app. No data protection officer has been appointed; none is required.
2What we process, and why
We process only what Kenne needs in order to work. We do not sell personal data, show advertising, or use analytics or tracking tools.
- Your account
- Your name and email address, and your password, which is stored only as a one-way hash and cannot be read back. If you sign in with Google or Apple, we receive from that provider an identifier for your account there, your name and email address, from Google also the address of your profile picture, and the sign-in tokens the provider issues. Purpose: to create your account and let you sign in. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
- Sign-in sessions
- A session identifier, and the IP address and the browser or device description from which each session was started. Purpose: to keep you signed in and to protect your account against misuse. Legal basis: Art. 6(1)(b) GDPR, and our legitimate interest in the security of the service (Art. 6(1)(f) GDPR).
- Your learning
- The language you speak and the courses you study; your settings, such as new words per day, target recall and time zone; every answer you give, with its time, its result and, where you type an answer, what you typed; the review schedule this produces for each word; placement test results; the notes you write; and the problems you report on a word. Purpose: to provide the course, schedule your reviews and show your progress. Legal basis: Art. 6(1)(b) GDPR.
- Your public profile
- Only if you create a public link: your name, your courses, the number of words you know, your streaks, your study calendar, your milestones and the words you learned most recently, visible to anyone who has the link. Your email address and the hours at which you study are never shown. Purpose: to share your progress at your request. Legal basis: Art. 6(1)(b) GDPR. You can remove the link at any time (Profile → Stop sharing); the page then ceases to exist.
- Emails
- Your email address and the content of the message. We send only what the service requires: codes to confirm your address, to sign in and to reset your password, and a notice when someone tries to register with an address that already has an account. We send no newsletters and no marketing. Legal basis: Art. 6(1)(b) GDPR.
- Delivering the website
- When you open a page, your IP address, the address requested, the time of the request and your browser’s technical details are processed so that the page can be delivered and attacks fended off. Legal basis: our legitimate interest in a working and secure service (Art. 6(1)(f) GDPR).
You are under no obligation to provide personal data. Without an email address, or a Google or Apple account, you cannot create an account; the dictionary and the rest of the public website remain available to you.
3On your device
Kenne stores the following on your device. All of it is strictly necessary to provide what you ask for, so no consent is required (§ 165(3) of the Austrian Telecommunications Act 2021). Nothing is used for advertising or to track you.
- Session cookie
- Keeps you signed in. Set when you sign in; removed when you sign out, and expires 60 days after your last visit.
- Language and appearance cookies
- Remember the interface language and the light or dark appearance you chose. Set only when you make that choice; kept for two years.
- Local storage
- Answers our server has not yet received, so that none are lost when the connection drops; your sound settings; and which hints you have already seen. Kept until you clear your browser’s data.
Pronunciation uses the speech synthesis built into your device or browser. Depending on your device and the voice selected, the maker of your device or browser may process the text being spoken; that processing is governed by their terms, not this policy.
4Who else processes your data
We use the following service providers. Each is bound by a data processing agreement under Article 28 GDPR and may use your data only on our instructions:
- UpCloud Ltd, Finland — the server and database that hold all of Kenne’s data, located in Frankfurt am Main, Germany.
- Cloudflare, Inc., USA — delivers the website and protects it against attacks, sends our emails, and stores our encrypted off-site backups.
- Mailgun Technologies, Inc., USA — sends our emails when Cloudflare cannot.
If you choose to sign in with Google (Google Ireland Limited) or Apple (Apple Distribution International Ltd., Ireland), that provider processes your sign-in as an independent controller under its own privacy policy.
We disclose personal data to public authorities only where the law obliges us to.
5Transfers outside the EU
Cloudflare and Mailgun are established in the United States. Transfers to them are based on the European Commission’s adequacy decision for the EU–U.S. Data Privacy Framework (Art. 45 GDPR) where the provider is certified under it, and otherwise on the Standard Contractual Clauses adopted by the Commission (Art. 46(2)(c) GDPR). You can obtain a copy of these safeguards by writing to privacy@kenne.app.
6How long we keep it
- Account and learning data: for as long as you have an account. We do not delete inactive accounts of our own accord.
- Sessions: until you sign out, and at most 60 days after your last visit.
- Codes sent by email: valid for 10 minutes, then deleted.
- Backups: a copy of the database is made every night; each copy is deleted after 14 days.
- Problem reports: kept to improve the dictionary. When you delete your account, the link to you is removed and only the content of the report remains.
When you delete your account (Settings → Account → Delete account), your account, sessions, linked sign-ins, learning data, notes and public profile are erased immediately, and disappear from our backups within 14 days.
7Your rights
Under the GDPR you have the right:
- to access your data and to receive a copy of it (Art. 15);
- to have inaccurate data rectified (Art. 16);
- to have your data erased (Art. 17);
- to have its processing restricted (Art. 18);
- to receive the data you provided in a structured, commonly used, machine-readable format, or to have it transmitted to another controller (Art. 20);
- to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 21).
To exercise these rights, write to privacy@kenne.app. We respond within one month (Art. 12(3) GDPR). You can change your name and settings, and delete your account, yourself in Settings.
You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). In Austria this is the Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, Österreich, www.dsb.gv.at.
8Automated decisions
Kenne decides automatically, from your answers, which words to show you and when. These decisions only arrange your study; they produce no legal effects concerning you and do not similarly significantly affect you, and so are not decisions within the meaning of Article 22 GDPR.
9Children
Kenne is not directed at children under 14. Under Austrian law, a child under 14 may use a service such as Kenne only with the consent of a parent or guardian (§ 4(4) of the Austrian Data Protection Act).
10Security
All connections to Kenne are encrypted (TLS). Passwords are stored only as salted hashes. The database cannot be reached from the internet, and off-site backups are stored encrypted. We take technical and organisational measures appropriate to the risk (Art. 32 GDPR).
11Changes to this policy
We update this policy whenever what we do with personal data changes. The date at the top shows when the current version took effect. If a change materially affects you, we will tell you by email before it takes effect.
This policy is available in English, German and Russian. Where the versions differ, the German version prevails.