Privacy policy

Last updated: 2026-09-02 · In short: without an account we store no personal data about you. With an account we store your email, a password hash and your learning state – none of it is shared or used for advertising.

1. Controller

Laukart Media S.L., Calle Júpiter 94, 04640 Pulpí (Almería), Spanien, email: info@laukart-media.de. The General Data Protection Regulation (GDPR) and the Spanish data protection act LOPDGDD 3/2018 apply.

2. Use without an account

Your learning state (seen and saved cards, streak, stats) lives only in your browser (localStorage) and is not sent to us. You can delete it any time under “Stats → Delete all local data”. This storage is strictly necessary for the service (Art. 5(3) ePrivacy Directive / Art. 22.2 LSSI-CE), so no consent banner is required.

To understand which cards work well, we send anonymous usage events to our server: a random ID generated in your browser (not a device or advertising ID), the event type (e.g. “card seen”, “quiz correct”), the card number, the language, the time spent on a card and whether the site is installed as an app. IP addresses are not stored. The legal basis is our legitimate interest in improving the service (Art. 6(1)(f) GDPR); we cannot link the events to you. Events are deleted after 12 months.

For measurement, the site stores a random identifier in your browser’s localStorage (dl_anon). It is used solely for our own audience measurement, is not shared with other sites, not combined into profiles and not passed to third parties – under the criteria of the Spanish supervisory authority AEPD for first-party audience measurement, no consent is required for this (Art. 22.2 LSSI-CE). You may object to the measurement at any time (Art. 21 GDPR): in the feed under Stats → “Do not send anonymous usage statistics from this browser”. After that, nothing is sent from this browser any more – on the other pages either.

For abuse protection (rate limits) we briefly store a daily re-salted hash of your IP address that cannot be reversed; these entries are deleted within 24 hours.

3. Use with an account

We also record, per visit, where it came from and what it was made with: the referring domain (domain only, not the full address) or campaign parameters from the link (utm_*), device type (phone/tablet/desktop), operating system, browser with major version, screen and window width, the browser language setting, the page paths visited and – if a service in front of our server (e.g. Cloudflare) provides it – the country. Again: no IP address, no cookie, no link to a person and no third-party service. The legal basis here, too, is our legitimate interest in comprehensible audience measurement and in improving the service (Art. 6(1)(f) GDPR). A “visit” ends after 30 minutes of inactivity. This data is also deleted after 12 months.

If you create an account we store: email address, password as a hash (Argon2id), chosen language, timestamps of registration, confirmation, last login and last sync, and your learning state as a record. The purpose is providing the account and syncing between devices (Art. 6(1)(b) GDPR). To confirm your address and for “forgot password” we send emails with one-time links; the links are stored only as hashes and expire after 24 hours or 1 hour respectively. If you choose “stay signed in”, we set a cookie with a random token (30 days).

We do not send newsletters and never share your email address. You can delete your account any time under “Account → Delete account”; all account data is removed immediately.

4. Cookies

We use only strictly necessary cookies: dl_lang (language choice, 1 year), dl_sess (session, set only once you open a form such as sign-in or sign-up) and dl_remember (only if you choose “stay signed in”). No tracking or advertising cookies, no third parties. Audience measurement uses no cookies but the localStorage identifier described above.

5. Server logs and hosting

When you access the site, the web server necessarily processes IP address, time, requested URL, browser identifier and referrer in log files (Art. 6(1)(f) GDPR, security and operation). These logs are deleted after 14 days. Hosting provider (processor under Art. 28 GDPR): Hetzner Online GmbH, Gunzenhausen, Deutschland.

6. Share function

When you share a card, an image of the card is generated on our server and you decide where to send the link or image. We do not transmit anything to third parties.

7. Reporting cards

When you report a card, we store the reason, your optional message, language, time and the anonymous browser ID; if you are signed in, also your account so we can follow up. Reports are deleted after handling, at the latest after 12 months.

8. External links

Every card links to its source (e.g. Wikipedia, public authorities, studies). Clicking takes you to that site, where its own privacy notice applies. Under “Projects” we also link to other services of the same operator; their own notices apply there. We embed no external content, fonts or scripts.

9. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You can exercise access and portability directly under “Account → Download my data” and erasure under “Delete account”. For anything else write to info@laukart-media.de. You may also lodge a complaint with a supervisory authority, in Spain the Agencia Española de Protección de Datos (AEPD).

10. Minors

Use without an account is open to all ages. In Spain, an account may be created from age 14 (Art. 7 LOPDGDD); younger users need parental consent.

11. Changes

If processing changes, we update this policy and the date above.