Privacy policy

Who is responsible

The data controller is Matti Hansen. Write to kontakt@mattihansen.com with questions or to use your rights.

Practising without an account

Without logging in, your progress is only stored in your own browser and is not sent to us. That covers:

• which questions you have answered and whether you were right (for “My mistakes”)
• your choice of language and answer style
• how many free rounds you have used
• a round you haven't finished (only until you close the tab)

The site also keeps a copy of itself so it works offline. You delete all of it by clearing the site's data in your browser.

Visitor statistics

We use Vercel Web Analytics to count page views and a few events: when a round is started, resumed or finished (which area, answer style, topic, number of questions and score). This happens without cookies and without recognising you from visit to visit or across other sites. The purpose is to see what is used so we can improve the site (legitimate interest, GDPR Art. 6(1)(f)).

When you create an account

We store:

• your name and email
• your password as a one-way encrypted value (hash). We can't see or recover it.
• whether your email is confirmed, and when the account was created, changed and last used
• for each login: your IP address and which browser you use, so you can stay logged in and so we can detect misuse
• your progress while you are logged in: which questions you have answered, whether you were right, and when, so it follows you to your other devices. What you practised without logging in, in the same browser, is added when you log in.

The account is the basis for the service you ask for (GDPR Art. 6(1)(b)). We keep IP address and browser for security (legitimate interest, Art. 6(1)(f)). To stop password guessing and misuse we also briefly count attempts per IP address and per account; those counts are deleted automatically after a few minutes.

We only send emails that belong to your account, such as confirming your email, a link to choose a new password (it works for an hour) or a notice before an unused account is deleted. No newsletters and no marketing.

Logging in with Google

If you choose to log in with Google, we receive your name, email and profile picture from Google, and Google confirms that the email is yours. We don't get your Google password or access to anything else in your Google account. Google's own privacy policy covers what happens at Google.

Cookies

Without logging in, the site uses no cookies. When you are logged in, we use one necessary cookie that keeps you logged in. It expires after 30 days and is renewed when you use the site. During a Google login we also set a short-lived security cookie. Necessary cookies don't require consent, and we use no others.

Who processes data for us

We use these providers as data processors. They may only use the information to provide their service to us.

• Vercel: runs the site and the visitor statistics. The login functions run in Frankfurt (EU).
• Neon: the database with accounts and progress, located in Frankfurt (EU).
• Resend: sends the emails for your account.

Vercel, Neon and Resend are US companies. If information is transferred to the US, this happens on the basis of the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses.

How long we keep information

• Your account: until you delete it, or until you haven't used it for a year. A month before, we email you so you can log in and keep it.
• Your progress on the account: as long as you have the account. It is deleted along with it.
• An account that isn't confirmed within 24 hours is deleted.
• A login (IP address and browser): until it expires, at most 30 days after you last used the site.
• Counts of login attempts: a few minutes.

Your rights

You have the right to see the information we hold about you, have it corrected or deleted, restrict or object to its use, and receive it in a common format. Write to kontakt@mattihansen.com and we will reply within a month. Under “My account” in the account menu you can download everything we store about you as a file, and delete your account yourself. You can also write to us; you don't need to give a reason.

You can also complain to the Danish Data Protection Agency, Datatilsynet.

Changes

If we change what we store or who processes it, we update this page and the date at the top.