Privacy policy

This page describes what data Esperantopedia collects at the moment and why.

#Cookies

Without signing in, the site sets no cookies and no tracking IDs in your browser. If you sign in, we set three cookies: ep_s keeps you signed in for 30 days (scripts on the page cannot read it), and ep_u and ep_a only mark that you are signed in or an administrator, without any personal data. Signing out removes them. We do not sell personal data.

The site also keeps some data in your browser’s local storage: your colour theme (light, dark or system); after you sign in, your name, e-mail address and profile address and, for a few minutes, the number of your new friend invitations and unread messages, so that the account menu can show them (signing out removes them), and the date on which the site last checked your sign-in; your learning progress and saved words, described below (signing out removes them from this browser); the e-mail address you entered to sign up as an Android tester, so that the page can show that you are signed up; if you turn on notifications, the address of your browser’s notification service (see “Friends and messages”); after you sign in, whether to count your learning time and whether you are in a class or run one (with the date it was checked and a short hash of the account’s e-mail address, so that it is checked again when another account signs in on this browser), a short list of your classes (number, name and your role) and, if you are in a class, your open tasks (class, kind, target, title, the teacher’s note, due date and progress) for the task bars in the course and the flashcards, and, while your time is counted, the learning minutes that have not been sent yet – up to 15 minutes if you are in a class, otherwise up to an hour – tied to your account, the active seconds of a minute that has not yet reached 30 seconds (so that the next page can add to them) and the time they were last sent (signing out removes all of this, and the unsent minutes are also removed when you switch accounts; see “Classes”); whether the one-time note about counting your learning time has already been shown for your account (with a short hash of the account’s e-mail address and the time it was shown), so that it is not shown again (it stays after you sign out); while you sign in on a class page, the code of that class in the tab’s storage (sessionStorage), so that you return to the join form afterwards; and other settings and interface state, such as whether sounds are on, where you stopped in a lesson and which banners you closed. Local storage as a whole is not sent to us – we receive only your learning progress (and only if you sign in) and what you send us yourself, such as the tester form or turning on notifications.

#Statistics

We count visits with Cloudflare Web Analytics, a privacy-first service that does not use cookies or fingerprinting and does not track individual visitors. It shows us totals, such as how many people visited a page and from which country, so we know which pages to improve.

#Messages you send us

When you use the "Report an error" form – on this site or in our app (the “Help us improve Saluton” card in More, the flag in a lesson step or the link at the end of a lesson) – we store:

• your message and the type you chose (error, idea, other);
• the address of the page you were on and its language – in the app instead: the platform (iPhone or Android), the app version, the app’s language and, if you report from a lesson, the lesson, the step and the word, sentence or question shown in it;
• the country, as estimated by our hosting provider from your connection;
• your e-mail address – only if you enter it, so that we can reply.

We do not store your IP address. To stop spam, the form keeps a one-way hash of the connection for one hour and then deletes it. Messages are stored with our hosting provider, Cloudflare, and are used only to fix the site and answer you. We delete them 30 days after they are handled, and in any case after 12 months.

If you sign up to test our Android app (on the page Test the Saluton app on Android), we store the e-mail address you enter, the language of the page and the date in the same way. We use the address only to add you to the test in Google Play – Google receives it for this and handles it under its own privacy policy – and to write to you about the test. We delete it after the test ends, and at any time on request.

#Account and sign-in with Google, Apple or e-mail

Signing in is optional; the course, the dictionary and the tools work without an account. On the website you can sign in on the account page with your Google account, your Apple Account or an e-mail address (described below). In our apps you can sign in with Google, and in the iPhone app also with your Apple Account (the Android app offers only Google); the apps do not offer e-mail sign-in. Google sends us your Google account ID, e-mail address and name. Apple sends us your Apple account ID and your e-mail address – your real address or, if you choose “Hide My Email”, a private relay address from Apple – and, only the first time, the name you choose to share. We store these with the dates of your first and last sign-in, to keep you signed in and to give administrators access to the admin panel. If you sign in with Apple or with an e-mail code using the e-mail address of an existing account, you reach that account instead of a new one, and we store both ways of signing in with it; Google does this only for Gmail addresses and Google Workspace accounts – with any other address, signing in with Google creates a separate account; likewise, signing in with Apple or with a code does not reach an account created with Google using such an address, but creates a separate one. While signed in, you can also connect another way of signing in on the account page – Google, Apple or an e-mail address, one of each (useful if you use Apple’s “Hide My Email”); we then store its ID with your account as well (for an e-mail address: the address), and you can disconnect it again, except the one you used to create the account. Signing in later with a way you have disconnected creates a separate new account. When you open this site from our app while signed in there, the app asks us for a one-time code that signs you in on the site too; the code works once and for 60 seconds, and we store only a fingerprint (hash) of it with your account ID until it is used or, if it is not, until it is cleared when the next code is created. We never receive your Google or Apple password and get no access to your Google or Apple account. When you sign in with Apple, we also store a token from Apple that we use only to tell Apple to end our access when you delete your account. We also store with your account how many times you have signed in; for each sign-in, the date and time, the way you signed in (Google, Apple or an e-mail code), where you signed in (this website, the iPhone app or the Android app – or only “app” if the app cannot be recognised) and, if the app sends it, the app version; the way and place of your last sign-in; which of these places you have used; when you were last active while signed in (updated at most once a day); and the language of the page where you signed in. We work out whether a sign-in or visit comes from the website or from an app, and from which app, at the moment it happens – from the kind of sign-in, from the platform the app reports or from the technical name of the app’s network software that every request carries; we store only the result (for example “iPhone app”), never your IP address or that technical name. We use this to run and protect your account (for example to see unusual sign-ins when you ask us for help), to answer you in your language and to understand how the site and the apps are used, so that we know which ways of signing in and which platforms to support. Each sign-in is deleted automatically after about 13 months (400 days); the rest is kept as long as the account. If you sign in, we also keep counts of your learning progress (for example the number of completed lessons) with your account; administrators see only these numbers, not your answers. To protect sign-in from abuse, we count failed sign-in attempts per connection, under a keyed hash of the network address and the hour; the count is deleted after that hour.

Activity days. For every day (in UTC) on which you use the site or an app while signed in, we store that date and whether you used the website, the iPhone app or the Android app that day – not the time and not the pages you visited. Requests that your browser or the app makes without you, for example when a notification arrives, do not count. We store this for every account, also without a public profile, and delete days older than about 13 months (400 days) automatically. We use it to count how many accounts are active each day, week and month and how many people come back after creating an account.

Statistics for administrators. From these data, administrators see totals: accounts active per day and in the last 7 and 30 days, active accounts by platform, sign-ins and new accounts by way of signing in and by platform, and the share of accounts created in a given week that came back the next day, a week later and a month later; administrators’ own accounts are left out of these totals. Daily totals contain no personal data and are kept without a time limit. When administrators open a single account in the admin panel (for example when you ask for help or the account is reported), they also see its latest sign-ins and its activity days.

Keeping your account record is necessary to provide the account you asked for (Article 6(1)(b) GDPR). The sign-in history, the activity days with the platform and the statistics for administrators are based on our legitimate interest in protecting accounts and in running and improving the site and the apps (Article 6(1)(f) GDPR); you can object to this at any time by writing to us (see “Your rights”). Your sign-in history (date and time, way of signing in, platform, app version) and your activity days with the platform are included in “Download my data” and are deleted together with your account.

Sign-in with an e-mail code. If you choose “Continue with e-mail”, you enter an e-mail address and we send a six-digit code to it; typing the code on the site signs you in, and if no account uses that address yet, the account is created when the code is correct. There is no password, and – unlike with Google or Apple – we receive no name, only the address you type. We do this to provide the sign-in you asked for (Article 6(1)(b) GDPR); the limits, counters, bot check and list of undeliverable addresses described below protect it from abuse on the basis of our legitimate interest in the security of the site and its accounts (Article 6(1)(f) GDPR). What we process:

• The code. While a code is valid we store the address, a keyed hash (HMAC) of the code – not the code itself – when it was sent and when it expires (a code works for 10 minutes), how many times it was tried (at most 5), the language of the page, a one-way hash of your IP address and the hour, and, if you are adding an address to an account you are signed in to, the ID of that account. A code works once; asking for a new code does not cancel earlier ones, so each code stays valid until it is used or expires. The record is deleted when the code is entered correctly and otherwise at the first clean-up after it expires (the clean-up runs every 5 minutes).
• Counters. To stop guessing of codes and mass sending, we count code requests per address, code requests and wrong codes per address from one connection, and code requests per connection per hour and per day. The counters are stored under a keyed hash of the address and a one-way hash of your IP address with the hour or the date – not under the address itself – and are deleted at the first clean-up after their time window ends: 1 minute, 10 minutes, 15 minutes, 1 hour or 24 hours. Wrong codes are counted per address and connection for one hour, so wrong codes typed by someone else do not lock you out. We also count wrong codes in a row for each address: the count is reset when you sign in with that address and deleted 30 days after the last wrong code; after 100 wrong codes in a row, codes for that address are sent only on the website, at most one every 10 minutes. We also count all codes sent per day, in total, not linked to any person.
• Undeliverable addresses. Before sending a code, we check whether the domain of the address (the part after @) can receive e-mail by asking Cloudflare’s DNS service; only the domain is sent, and the answer is kept in memory for at most an hour. If a message with a code cannot be delivered, or its recipient marks it as spam, Resend informs our server and we stop sending codes to that address for a time: 3 days, 30 days after a spam report, or one year if the address does not exist or its e-mail provider refuses all messages to it. For this we store only a keyed hash of the address, the reason, the date and the end of the block; it is not linked to any account. The block ends earlier if you sign in with that address through Apple, or through Google with a Gmail or Google Workspace address, or if an administrator lifts it at your request.
• Link to your account. We store the address with your account – as the account’s e-mail address if the account was created with a code, otherwise as an additional way of signing in – together with a link from the address to the account, so that the next code finds your account. Both are deleted with your account and are included in “Download my data”.
• The message. The message goes to the address you entered and contains only the code and a short note – no links, images or marketing. It is sent through Resend (see “Hosting and third parties”).

Administrators can suspend an account that breaks the rules: we then store the date, the reason and which administrator did it, and the account cannot sign in until the suspension is lifted. Every action an administrator takes on an account (for example a suspension, a deletion or a data export) is recorded in an internal log with the date and the administrator; e-mail addresses in the log are masked, and the log is kept for 24 months. For statistics, we count sign-ups, sign-ins and active accounts per day as totals only, and sign-ups also by the place that led to them (for example a lesson, the flashcards, an invitation or the app); these totals are not linked to any account.

The Google and Apple sign-in scripts are loaded only when you choose to sign in – on the account page or after you click a sign-in button – and Google and Apple process that under their privacy policies (Google, Apple). Likewise, the Cloudflare Turnstile script, which protects the e-mail form from bots, is loaded only when you open the address field (see “Hosting and third parties”). You can delete your account at any time on the account page or in the app: the record is removed immediately and you are signed out, and if you signed in with Apple, we tell Apple to end our access. We then keep only your account ID for 31 days, so that sessions on your other devices also end; signing in again with the same Google or Apple account creates a new account and removes it.

Learning progress works with or without an account: the lessons you mark as completed, your latest exercise scores, the exercise items you answered wrongly (your review list), the dictionary words you save and your flashcard progress, each with the date and time of the change (including removals, so that they sync correctly). Without an account, this stays only in your browser. If you sign in, we also store it with your account so that it syncs between your devices; it is deleted together with your account, and you can download it with your other data on the account page. Progress you made in this browser before signing in is added to your account the first time you sign in. When you sign out, the site first sends your latest progress to your account and then removes your learning progress from this browser – lessons, scores, review list, saved words, flashcards, where you stopped in a lesson, the class marker and unsent learning minutes; settings such as the colour theme and sounds stay. So that one person’s progress never reaches another person’s account on a shared computer, the browser also keeps with your progress a short code derived from your account ID (not your e-mail address); if someone else signs in in that browser, the progress stored there is not sent to their account but replaced with theirs. To delete it from a browser without signing out, clear this site’s data in the browser settings. To prevent abuse, we count how many times a day your progress is saved; only these numbers are stored, with your progress, and they are deleted with it. For the review list and flashcards, each item also has the time of your last answer and two numbers worked out from your answers – how long you are likely to remember it and how hard it is for you – which set the date of its next review.

Learning time. While you are signed in, the site also counts your active learning time and shows it to you on the account page (“Your learning time”); outside classes you can turn counting off there. What is counted and stored, and for how long, is described in “Classes”, because learning time is kept in the same database.

#Public profile

Signing in does not create a public profile. You can create one on the account page if you are at least 16 years old. We then store what you enter: your profile address (for example /u/your-name), display name, “About me” text, native languages, languages you are learning, Esperanto level, country and photo – everything except the address is optional – together with your visibility settings, whether you confirmed that you are at least 18 (with the date and time), whether you want to appear in the list of learners and whether you are looking for a conversation partner, the date and time you confirmed that you are at least 16, and the dates the profile was created and last changed. Your e-mail address and your Google or Apple account ID are never shown on the profile.

• Photo. You choose and crop the photo in your browser, which reduces it to 256 × 256 pixels before it is sent to us. We also remove any embedded data such as the camera model or location (EXIF and XMP) before storing it. A public photo may stay in Cloudflare’s cache for up to 10 minutes after you change or remove it or make your profile private.
• Activity. Your profile shows, as dots for the last year, the days (in UTC) on which you used the site or an app while signed in since you created the profile – only the dates, not the time or the pages you visited. These days belong to your account (see “Account and sign-in”), so deleting the profile does not delete them; they are deleted with the account or automatically after about 13 months.
• Who can see it. A public profile can be seen by anyone who opens its address. At the moment, profile pages ask search engines not to index them. You can hide the whole profile (then only you, your friends and the people you invite can see it) or only your activity, and change this at any time.
• Learning progress. Unless you turn it off, your profile shows a short summary of your learning: how many of the 12 lessons you have completed, how many flashcard words you have and how many you have learned, how many review items you have mastered and your current streak of days on which you used the site or the app while signed in. We work it out from your learning progress (see above) and store it with the profile.
• Finding people. Signed-in people can search for public profiles by display name or profile address. Profiles visible only to friends do not appear in search results.
• List of learners. Your public profile appears in the list of people – on the friends page (“People on Esperantopedia”) and on the “Learners” page – unless you turn this off: when you create your profile, “Show my profile in the list of people” is already ticked. You can leave the list straight away or at any time in your profile settings or on the “Learners” page. Only signed-in people who have a profile can see the list and filter it by languages, country, level, whether someone is looking for a conversation partner and whether someone helps in conversation circles. It shows your photo, name, profile address, languages, level, country, the beginning of your “About me” text (up to 200 characters), whether you are looking for a conversation partner and, if you lead conversation circles, the badge “Helps in conversations”, ordered by the last day you were active; we store that day (only the date) for this and do not show it. Profiles visible only to friends never appear in the list, and only people who have confirmed that they are at least 18 can mark themselves as looking for a conversation partner. We do this on the basis of our legitimate interest in helping learners find each other (Article 6(1)(f) GDPR); you can object at any time by turning the list off.
• Invite link. You can create a personal invite link. We store its code, the date and how many people became your friends through it. Anyone who has the link can see your photo, name, profile address, languages, level and country – even if your profile is visible only to friends – and, after signing in, becomes your friend straight away. You can replace the link or switch it off at any time; it is deleted with your profile.
• Reports. Anyone can report a photo, description or name on a profile, or a whole profile. If you are signed in, we store your account; if not, we ask for your name and e-mail address (except for reports about the safety of children) and a confirmation that the report is made in good faith, and store them so that we can reply. We also store the profile, what was reported, the category, your explanation and the date. To limit abuse of reports sent without an account, we count them per connection, under a keyed hash of the network address and the hour; the count is deleted within minutes after that hour. A report about the safety of children sent without an e-mail address gets a random identifier instead of any details about the sender. Administrators use reports only to remove content that breaks the law or our community guidelines; the reported person is not told who sent the report. Handled reports are deleted after 12 months, and reports about an account are deleted together with it.
• Decisions. If administrators remove something from your profile or one of your messages, suspend your account, exclude you from conversation circles, pause your circles or decline your application to lead circles, we store what was done, the category, the reason, whether it was based on the law or on our community guidelines, the date and whether you have read it, and show it to you on the account page and in the app. We keep these records for 24 months or until you delete your account.
• Limits. To prevent abuse, we count how many changes, photos and reports an account sends per hour and per day; only the number is stored, and it is deleted with your account.

You can change or delete your profile at any time on the account page. Deleting it removes the profile, photo and reports about it immediately (your activity days stay with your account), as well as your friends and conversations (see below). Deleting your account removes these too, as well as the reports you sent. The “Download my data” button on the account page includes your profile, photo, activity, invite link, the decisions about your account and the reports you sent.

#Friends and messages

If you have a public profile, you can add friends and write private messages to them.

• Friends. When someone becomes your friend through your invite link, the friendship starts immediately. When you invite someone, we store who invited whom, the date and an optional note (up to 200 characters), and then whether and when the invitation was accepted. If the other person declines, we keep the declined invitation, without the note, for 30 days, so that the same invitation cannot be sent again straight away. Either of you can say that you have met in person; the other person has to confirm it, and we store the date of the confirmation. Your friends and the people you invite can see your profile even if it is visible only to friends.
• Messages. You can write to your friends and, if you have confirmed that you are at least 18, to advisors (see “Conversation circles”); an advisor can reply to people who wrote to them. We store each message (up to 2,000 characters) with its date and time and the conversation it belongs to, and up to which message each of you has read the conversation, so that we can count unread messages – the sender does not see whether a message was read. When you accept an invitation, its note becomes the first message of the conversation. Messages are stored with our hosting provider, Cloudflare, like the rest of your account; they are not end-to-end encrypted. Administrators do not read conversations: they see only how many friends, conversations and messages an account has, and the text of a message only if one of the two people reports it. If you write to an advisor from the link after a lesson, we also store the number of that lesson with your first message; both of you see it next to the message. When you write to an advisor, your profile name, profile address and the beginning of your question (up to 500 characters) may also be sent to the advisor by e-mail, through Resend (see “Conversation circles”).
• Blocking. You can block a person: they can no longer invite you or write to you, your friendship ends, and while signed in they cannot see your profile. We store who blocked whom and when. The blocked person is not notified, and blocks set by others are not included in their data download.
• Reports. You can report a message you received. We store a copy of the reported message with the date it was sent, who sent it, who reported it, an optional note and the date of the report. Administrators see only the reported message and the note, never the rest of the conversation, and use them only to remove messages or suspend accounts that break the rules; the sender is not told who reported it. When a report is handled, the copy of the message is deleted; handled reports are deleted after 12 months.
• Notifications. If you turn on notifications on the account page, your browser gives us the address of its push service, which is run by the browser maker (for example Google, Mozilla, Apple or Microsoft). We store it with your account and the date, and the time of the last notification about each conversation, so that we send at most one notification per conversation every 10 minutes. The notification itself contains no text: your browser then asks us how many new messages and invitations you have. Turning notifications off, signing out or deleting your account removes the address. To prevent abuse, we count how many times notifications are turned on per connection and hour (under a keyed hash of the network address and the hour, deleted after that hour) and per account and day (only the number, deleted with your account).
• Limits. To prevent spam, we count how many invitations, messages, blocks and reports an account sends per day; only the number is stored, and it is deleted with your account.
• How long. Friendships, conversations and blocks are kept until you change them or delete your profile or account. If you or your friend end the friendship, the conversation stays, but neither of you can write any more.
• Deletion and download. Deleting your profile deletes your friendships, invitations and all your conversations – also for the people you talked to, because a conversation with nobody on the other side no longer serves its purpose; your blocks stay, so that people you blocked cannot contact you again if you create a new profile. Deleting your account also deletes the blocks you set and the blocks of you, the reports you sent and the reports about your messages. “Download my data” on the account page includes your friendships, your conversations (the messages of both people), the people you blocked and the reports you sent.

#Conversation circles

Conversation circles are small online conversations in Esperanto led by volunteers. The conversation itself takes place in a video meeting service that the host chooses – one of those we accept links to: Zoom, Google Meet, Microsoft Teams, Jitsi Meet, Whereby, Webex or Discord. To take part you need an account, a public profile and the confirmation that you are at least 18, and you accept the rules of the circles; we store the date of that acceptance.

• Volunteers. If you apply to lead circles, we store what you write about yourself (up to 600 characters, seen only by administrators), the levels and explanation languages you offer, your time zone, how many circles a week you want to lead, whether you want to appear on the list of hosts, whether you also want to be an advisor, the date you accepted the rules for hosts and the administrators’ decision (with its date, the reason and which administrator decided). For your circles we store the day, time, time zone, level, language, length, number of seats, whether cameras are expected, the topic, the link to your meeting (for the weekly circle and, if you set a different one, for a single date; up to 500 characters) and whether you opened it with the “Join” button. We count how many people you helped, the minutes and circles you led and the thanks you received; your public profile shows the badge “Helps in conversations” and the number of thanks.
• List of hosts. If you lead a weekly circle and your profile is public, the circles page shows you on the list of hosts, which anyone can see – unless you turn this off in the “Help in conversations” card on the account page; there you can also choose to appear on the list when you are not leading a weekly circle. The list shows only what your public profile already shows (name, photo and the beginning of your “About me” text, up to 160 characters), your levels and explanation languages, the number of thanks, when your next circle is and how many circles you have in the next 4 weeks. People you have blocked, and people who blocked you, do not see you there while they are signed in.
• Advisors. If you choose to be an advisor in the “Help in conversations” card and your profile is public, the circles page shows you on the list of advisors, which anyone can see: your name, photo, the beginning of your “About me” text (up to 160 characters), your levels and languages; your profile shows the badge “Advisor”. Anyone signed in with a profile who has confirmed that they are at least 18 can then write to you even if you are not friends, and you can reply to people who wrote to you; these messages are stored and handled like all other messages (see “Messages”), and you can block or report anyone. To prevent abuse, we count how many new conversations with advisors an account starts per day (at most 10); only the number is stored, and it is deleted with your account. People you have blocked, and people who blocked you, do not see you on the list. When someone who isn’t your friend writes to you because you are an advisor, we send an e-mail to your account’s address with their profile name and profile address, the lesson the question is about (if any), the beginning of the question (up to 500 characters) and a link to the conversation – at most one e-mail per conversation every 6 hours and 20 a day. To keep to these limits, we count the e-mails sent under keyed hashes, which are deleted after a day. You can turn these e-mails off in the “Help in conversations” card or with the link in each e-mail. If we send you an invitation link to become an advisor, we store only a one-way hash of the link (not the link itself), its language, a note from our team (without personal data), its expiry date (30 days) and when and by which account it was used; an application sent with a valid link is approved straight away, and we record that it was approved through an invitation.
• Seats. When you book a circle, we store your seat and its status (booked, waiting list, cancelled, attended, did not come, removed), when you booked, which reminders were sent, when you first opened the meeting link with the “Join” button, and – if you give them – your rating (great, OK, problem) and a thank-you note of up to 200 characters, which only the host can read. After the circle, you count as having attended if you opened the link; we estimate your minutes from that moment (or from the start, if you opened it earlier) to the end of the circle. At an open table (no booking), the “Join this circle” button gives you a seat and shows the link. The host sees the names, profile addresses and photos of the people who booked.
• Meeting link. People with a seat see the meeting link only from 15 minutes before the start until 15 minutes after the end; the host and our administrators can see it at any time; everyone else sees only the name of the service. The link opens the meeting in the service’s own website or app: what happens there (your name, picture and voice, the chat, any recording) is handled by that service under its own terms and privacy policy, not by us. We do not run the meeting, do not receive its sound, video or chat, and record nothing. Please do not share the link – it is meant only for the people in the circle. The link opens in a new tab without telling the service which page you came from, and we pass the service no information about you.
• Reports. You can report a person or a problem in a circle on the circle’s page, during the circle or up to 30 days after it. We store who reported, whom it concerns (if given), the category and your note (up to 1,000 characters); handled reports are deleted after 12 months. Reports sent from our former video room may contain a copy of its chat, which is deleted when the report is handled.
• Reminders and calendar. If you turned on notifications, we send reminders without text 24 hours, 2 hours and 15 minutes before your circle, and when you move up from the waiting list or a circle is cancelled. Reminders, calendar files and Google Calendar links never contain the meeting link – only the address of the circle’s page on this site, which shows the link to people with a seat. Calendar files and Google Calendar links are created when you ask for them; we store nothing about them.
• How long. Circles and seats (including the meeting links set by hosts) are kept for 12 months and then only as anonymous monthly totals; thank-you notes for 12 months; the log of when people opened the meeting link for 90 days. Everything is included in “Download my data” and deleted together with your account. To prevent abuse, we also count how many bookings, reports and changes to circles an account makes per day; only the number is stored, and it is deleted with your account.

#Classes

A teacher can create a class on this site, and students join it with a link or a code. To take part you need an account. Classes, their members and learning time – also of people who are not in any class – are stored in a separate database that Cloudflare keeps in the European Union.

• Teachers. To create a class, you confirm that you are at least 18 and accept the rules for teachers; we store the dates of both. For each class we store its name, the institution (if you give one), the name you show to students, the code, the time zone, the last day of the class (optional), a weekly goal in minutes (optional), whether students can join and whether you accept new students first, when the class was created, changed or ended (and whether it ended by itself – see “How long”) and when you last opened the class panel (updated at most once a day). You can run up to 3 classes at a time, each with up to 60 students.
• Students. To join, you confirm that you are at least 16; we store the date of that confirmation, the name you give in the class, whether you share your e-mail address with the teacher (off unless you turn it on), your status (waiting for approval, in the class, left, removed or rejected) and when you joined or left. Before you join, the class page shows who runs the class and exactly what the teacher will see.
• Tasks. A teacher can give the class tasks (optional, up to 100 per class): a course lesson, a range of the 1000 most common words in the flashcards, a number of minutes of learning, or a page of this site. For each task we store its kind, the target, a title and a note from the teacher (optional), a due date (optional) and when the task was created and changed. Minutes for a task of minutes count from the start of the quarter of an hour in which the teacher added it until the end of its due date (without one, until now), and only from the moment you joined. About an hour after the due date, we save each student’s result as one number (the minutes counted for the task); it is deleted with the task or the class, when you leave the class, are removed or your request is rejected, and when the teacher changes the due date (the task is then counted again). Tasks are shown only to students who have been accepted, and not while the class is suspended. Tasks are deleted with the class (a class hidden because of a report not yet handled keeps them until the report is handled).
• Learning time. While you are signed in, the site counts your active learning time – not only in classes: a minute counts when a learning page (the course and its lessons, the flashcards, the page for joining a conversation circle, or a page for reading such as the home page, grammar or the dictionary) is open in the active window and in use: every activity (a click or tap, typing, scrolling, moving the mouse or a recording playing) counts for 30 seconds, and a minute counts when it has at least 30 active seconds. For each day we store which minutes were active and of which kind (lessons and exercises, flashcards or reading), totals per quarter of an hour and your last active minute. Together with the minutes, the site sends the current time of your device so that a wrongly set clock can be corrected; we do not store it. We do not store which pages you opened, your answers or anything you type. We use this to show you your own learning time on the account page (“Your learning time”: this week by day, the last 8 weeks, this month and days in a row) and, if you are in a class, to show it to your teacher – only from the moment you joined their class. Administrators see daily totals of all accounts together (how many people learned and for how many minutes) and, when they open a single account in the admin panel, its learning time by week. The Saluton app counts your learning time in the same way while it is open and in use (screens with lessons, exercises, flashcards and reading) and sends the same data; until it can send them, the minutes wait on your device.
• Turning counting off. You can turn counting off on the account page (“Count my learning time”), also while a request to join a class is waiting. Once you are accepted into a running class, counting cannot be turned off and your time is counted even if you turned it off before, because it is part of the class you chose to join; your setting stays and applies again when you are no longer in a running class. When you turn counting off, we store that you did and when, and immediately delete all your stored minutes except those that a class you are in, or have asked to join, can still see (from the day you joined until the class ended, while the class is stored); those are deleted at the next daily clean-up after you leave the class or are removed from it, or the class is deleted. Turning counting back on deletes the setting. Outside classes, we count learning time on the basis of our legitimate interest in showing you your learning and in understanding how the site is used for learning (Article 6(1)(f) GDPR); turning counting off is how you object. In a class, it is part of the course you chose to join (see “Who is responsible”).
• Progress in the class. While you are in a class or waiting to be accepted, the classes database also holds, from your synced learning progress, so that you and your teacher can see your progress: the number of completed course lessons, exercises done and flashcards in learning (with the date they were counted); for each course lesson, whether and when you completed it, how many of its exercise blocks you did and the totals of your latest scores in them; and how many of your flashcard words are in each of the three ranges of the 1000 most common words (1–100, 101–300 and 301–1000), and when each range first became complete. These are updated when your progress syncs; individual answers are not stored there. For a task with a page of this site, we store that you marked it as done and when (you can undo this); these marks are deleted when you leave the class or are removed, and when the task or the class is deleted.
• What the teacher sees. For each student: the name in the class, the date of joining, the learning time since joining (today, the last 7 days, this week, this month, in total, in each of the last 12 weeks, by day and by kind), the learning sessions of the last 14 days (the day, the start and end time of each session in the class time zone and how many of its minutes were active, by kind; a break of more than 10 minutes starts a new session), whether they have reached the weekly goal or are on track for it, for each task whether it is done (and when, if known), done late, overdue or still open, with progress (exercise blocks of the lesson, words in the range, minutes counted for the task) and, for lessons, the exercise score in percent; the completed course lessons with the date and the score; for a lesson or a flashcard range completed before the student joined, the teacher sees only “before joining” instead of the date; the number of completed course lessons, exercises done and flashcards in learning; the last activity; and days with more than 8 hours, which are only marked for the teacher to check. Scores are worked out from the latest attempts. For the whole class: how many students were active this week, the average minutes per student per week, how many are on track for the goal, the share of tasks done on time, the students who have not learned for 7 days or more, and totals for the last 12 weeks. The e-mail address is shown only if the student shares it. The teacher never sees your account ID, your individual answers or which ones were wrong, your saved words, the pages you visit, your profile, your friends or your messages. The teacher can download this as a CSV file or print it.
• Who is responsible. We provide classes so that you can take part in a course you chose to join (Article 6(1)(b) GDPR). The teacher – and, for an official course, their institution – decides how to use what they see in the class and is responsible for that as a separate controller; ask them how they use it.
• Reports. Anyone can report a class, also without signing in, in the same way as a profile (see “Public profile”). We store the class, the category, your explanation, the date and, if you are signed in, your account – otherwise your name and e-mail address (optional in reports about the safety of children) and a fingerprint of the e-mail address or, without one, of the IP address and the hour (a hash made with a secret key, from which they cannot be read), so that the same person cannot report a class several times. You must confirm that you report in good faith, but we do not store the confirmation. For each report we also store its status (open, handled, dismissed), the date it was handled and the e-mail address of the administrator who handled it. Administrators can suspend a class or stop an account from creating classes (which suspends all of its classes); we store the date, the reason (which the teacher sees), which administrator did it and, once a class is restored, the period of the suspension. While a class is suspended, the teacher sees only the reason and no student data, and learning time from the suspension period does not count for that class even after it is restored. A report is not lost when the teacher deletes the class or their account or when the class ends: the list of students is deleted as usual, but the class itself (its name, the institution, the teacher’s name and account ID) is hidden – only administrators can see it – until the reports are handled; the administrators’ activity log then records the class name, the teacher’s account ID and why it was hidden. Handled reports are deleted after 12 months or together with the class.
• How long. A class lasts until its last day or, if it has none, until the teacher ends it; the last day can be at most 5 years after the class was created. If the teacher does not open the class panel for 12 months, the class ends by itself, and we store that it ended this way. After the end, the teacher can view and export the class for 60 more days, and then it is deleted together with its list of students, its tasks and its reports (a class with a report not yet handled – as described above). If you leave a class, are removed or your request is rejected, the teacher loses access straight away. If you leave or your request is rejected, your entry in the class is deleted after 30 days; if the teacher removes you, after 30 days we delete your name, the dates and your confirmation from the entry and keep only a marker (which class and which account), so that you cannot rejoin on your own – until the class is deleted. Requests without a decision are deleted after 30 days. Learning minutes are kept for about 14 months (430 days) – for everyone, also outside classes and after you leave a class – and older ones are deleted at the daily clean-up. The course numbers and progress details stored for teachers are deleted at the next daily clean-up once you are no longer in any class and are not waiting to be accepted. To prevent abuse, we count wrong class codes per hour (by account or, without an account, by a fingerprint of the IP address and the hour – a hash made with a secret key, from which the address cannot be read), reports without an account per hour (by the same fingerprint), and per account how many classes are created and changed, joins, reports, changes to tasks, tasks marked as done and changes to the counting setting per day; only the number is stored, and it is deleted when its time window ends. A day of learning minutes can be saved at most 300 times; after that, no more minutes are saved for that day (the number of saves is kept with that day). Everything is included in “Download my data” and deleted together with your account.

#The app for iPhone and Android

Our app “Saluton: Learn Esperanto” works without an account: the lessons, exercises and word list are inside the app, and your progress (finished lessons, the review list, flashcards and the days you studied) is stored on your device – deleting the app deletes it. If you sign in in the app with Google or Apple, it is the same account as on this site, described above: your finished lessons, review list and flashcards then sync with your account and your other devices, the app keeps your sign-in in the device’s keychain (iPhone) or in its private storage (Android), and you can sign out or delete your account in the app (More → Account). Signed in, the app also counts as use of your account, as on the site: the server notes when you were last active, the date as an activity day together with the platform (iPhone or Android app), and for each sign-in its date, the way you signed in, the platform and the app version (see “Account and sign-in”); the streak of study days itself stays on your device. In the app, your sign-in is valid for 180 days and is renewed when you use the app, so you stay signed in as long as you open it at least every 180 days. Pronunciation recordings in the app – copies of recordings from Wikimedia Commons – are loaded from this site when you press play and, in the step-by-step lessons, automatically while sounds are turned on (you can turn them off in More); versions of the app released before November 2026 load them directly from Wikimedia Commons. If you turn on study reminders, they are scheduled by your device; we receive nothing about them. On Android, only signing in with Google is offered, and it goes through your device’s Google account sign-in (Google Play services). If you back up your device with iCloud or Google, the app’s data on the device can be part of that backup, stored by Apple or Google. The app contains no analytics, advertising or tracking. Downloads are handled by Apple (App Store) and Google (Google Play) under their privacy policies (Apple, Google); they give us only anonymous totals, such as the number of downloads, and crash reports and usage statistics only from people who allowed sharing them with app developers in their device settings. Pages of this site that you open from the app, such as the dictionary, are covered by the rest of this policy.

#Hosting and third parties

The site is hosted by Cloudflare, which processes technical connection data (such as IP addresses) to deliver pages and protect the site from attacks; see the Cloudflare privacy policy. Pronunciation recordings in the dictionary are loaded from Wikimedia Commons when you press play; see the Wikimedia privacy policy. In the step-by-step lessons and the flashcards, copies of the same recordings are loaded from this site – when you press play and, in the lessons, automatically while sounds are turned on (you can turn them off on the account page). If you choose to donate, the payment is handled by Ko-fi and its payment providers (Stripe or PayPal) under their own privacy policies; we receive only what Ko-fi shares with creators, such as the name and message you enter there.

E-mail sign-in. The messages with sign-in codes are sent by Resend, Inc. (USA), which acts for us as a processor. It receives the recipient’s address and the content of the message, including the code, and, according to Resend, keeps the message and its delivery log for 30 days. We send from Resend’s EU region (eu-west-1), but Resend states that it stores customer data in the United States – the region sets where messages are routed and sent from, not where data is stored – and that transfers to the United States are made under the EU Standard Contractual Clauses included in its data processing addendum and, additionally, under its participation in the EU-U.S. Data Privacy Framework; see Resend: GDPR and the Resend data processing addendum. On the website, the e-mail form is protected from bots by Cloudflare Turnstile, which is loaded from Cloudflare only when you open the address field. According to Cloudflare, Turnstile processes signals from your browser – such as your IP address, TLS fingerprint, User-Agent header and the site key and origin of the page – only to tell people from bots; Cloudflare does this on our behalf as a processor, and also uses the same signals, as a controller, to improve Turnstile. Our server then checks the result with Cloudflare, sending it the check’s token and your IP address. Cloudflare does not state how long it keeps these signals; see the Turnstile privacy addendum. Resend also sends the e-mails that tell advisors about new questions (see “Conversation circles”); for these it receives the advisor’s address and the content of the e-mail.

Meeting services. Conversation circles take place in the video meeting service chosen by the host, who organises the meeting there (see “Conversation circles”). When you open a meeting link, you use that service yourself, under its own terms and privacy policy: it is not our processor, it decides what it processes (for example your name, picture, voice and the chat) and is responsible for it. We pass it no information about you.

#Delete account

You can delete your Esperantopedia account, and the data stored with it, at any time. The website esperantopedia.org and the app Saluton: Learn Esperanto (developer: Esperantopedia) use the same account, so deleting it in one place deletes it for both.

• On the website: sign in, open the account page, choose Delete account and confirm with Delete my account.
• In the app: open More → Account → Delete account and confirm.
• If you cannot sign in or no longer have the app: write to us from the e-mail address of your account, using the address on the contact page, and ask us to delete the account. We delete it once we have checked that it is yours.

What is deleted. Deletion takes effect immediately and cannot be undone; you are signed out. We delete your account record (name, e-mail address and the ID of the Google or Apple account you signed in with), the link between your sign-in e-mail address and the account, your sign-in history and activity days, and any sign-in code that has not been used yet; the learning progress stored with the account (finished lessons, latest exercise scores, review list, saved words and flashcard progress); your public profile with photo, description and invite link; your friendships, invitations and conversations (also for the people you talked to) and the blocks you set or that were set against you; your seats, ratings and thank-you notes in conversation circles, and your application, dates and meeting links as a host; the classes you run (with their lists of students, tasks and reports; a class with a report not yet handled stays hidden until it is handled – see “Classes”), your entries in classes you joined, the tasks you marked as done and the saved results of your tasks of minutes, your learning minutes and your setting for counting them, and the course numbers and progress details stored for teachers; the reports you sent and the reports about you or your messages; the decisions about your account, with their reasons; and the address of your browser’s notification service. If you signed in with Apple, we also ask Apple to end our access.

What we keep, and for how long.

• Only the ID of your account (a random string, without your name or e-mail address): 31 days, so that sessions on your other devices also end. Signing in again with the same Google or Apple account creates a new account and removes this ID; signing in again with the same e-mail address also creates a new account, but the old ID stays for the 31 days.
• Counters of the e-mail code sign-in for your address (stored under a keyed hash, not linked to your account): up to 24 hours from the first request in their time window, and the count of wrong codes in a row up to 30 days after the last wrong code, so they can outlast your account; and, if messages to your address could not be delivered or were marked as spam, the keyed hash of the address on the list of undeliverable addresses: until the block ends (3 days, 30 days or one year).
• Entries in the administrators’ log about actions taken on your account, if there were any (for example a suspension): 24 months, with e-mail addresses masked.
• Totals that are not linked to any account, for example the number of sign-ups and deleted accounts per day: without a time limit.
• A message you sent us through the “Report an error” form is not tied to your account: we delete it 30 days after it is handled, and in any case after 12 months; write to us if you would like it removed sooner.
• Copies of our database that our hosting provider Cloudflare keeps for recovery after a failure: they expire on their own after at most 30 days.

Data stored only on your device – in the browser or in the app – is not affected by deleting the account: delete the app or clear this site’s data in the browser settings.

#Your rights

You can ask us what we store about you, or ask us to correct or delete it. If you have an account, you can delete it yourself on the account page. Use the "Report an error" form, choose "Something else" and include the e-mail address you used, so that we can find your message and confirm the deletion. Where we process data on the basis of our legitimate interest (Article 6(1)(f) GDPR) – the sign-in history, activity days and statistics, the counting of learning time outside classes and the list of learners – you have the right to object at any time: you can turn off the counting of learning time on the account page and the list of learners in your profile settings yourself, and for the rest write to us in the same way. If you live in the European Union, you also have the right to complain to your data protection authority.

#Changes

We may add new features to accounts that collect more data. Before that happens, we will update this page and the date at the top, and explain what is collected and why.