LEGAL
Privacy Policy
What Germanium stores, where it is stored, who can see it, and how to delete it — in plain language, for a product that collects almost nothing.
VON GERMANIUM
Operator — Divyansh Sharma (Germanium)
DIE ROADMAP · 77 TAGE · A1 → A2
Tag 001 — beginne den Weg
Who is responsible
Germanium is operated by Divyansh Sharma (Germanium). Questions, requests, or complaints about data go to [email protected] — a human reads it.
What we collect — and what we deliberately don't
- Email address and password — only if you create an account. The credentials are held by Auth0 (the identity provider); Germanium stores only the account's identifier alongside your data. No newsletter, no marketing, no sale, no sharing.
- Learning progress — archived days, worksheet answers (including what you typed on graded items), review-queue state, and self-rated confidence. This is the product working; it is stored per account and visible only to you.
- Your Anki deck, if you import one — parsed in your browser. The media cache lives on your device (IndexedDB) and never leaves it. Germanium's servers never receive your deck.
- Purchase records, if you buy an exam kit — the kit bought, the amount, the transaction hash, the wallet the payment came from, and the timestamps. Kept as the receipt and ledger that prove your purchase and back the 15-minute refund window; visible only to you and the operator.
- Nothing else. No analytics trackers, no advertising pixels, no fingerprinting, no social plugs, no third-party ad networks. Signed-out visitors generate no stored data at all — progress in a signed-out session lives in your browser's memory and vanishes when you close the tab.
Where your data lives
| Data | Stored in | Who can read it |
|---|---|---|
| Account (email, password) | Auth0 — the identity provider | Only the operator, for account recovery |
| Purchase records (kit, amount, TXID, sending wallet) | Supabase Postgres, locked by row-level security | Only your account (and the operator, to process refunds) — a claim is immutable once written |
| Learning progress | Supabase Postgres, one row per user, locked by row-level security | Only your account — enforced at the database layer, not the application layer |
| Anki media cache | Your browser (IndexedDB) | Only your device |
Your rights
- 01Access — email us and we export your full progress row as JSON within 30 days.
- 02Erasure — email us and your account and progress row are deleted within 30 days. Signing out and clearing your browser removes everything on your side immediately.
- 03Portability — your progress row is already a single JSON document; export on request, or via the desk's download at any time.
- 04Objection — the data exists only to run the product. Decline by not creating an account; the full course works signed-out (progress just isn't saved between sessions).
Third parties
- Supabase — database hosting (the infrastructure your progress and purchase records sit on), with the account identifier provided by Auth0. Supabase acts as data processor; their DPA applies.
- Auth0 — the identity provider that holds your credentials and issues the token every request carries. Auth0 acts as data processor for your account details.
- Cloudflare — static site hosting and delivery. Cloudflare processes connection metadata (IP address, request data) as any host does.
- Deutsche Welle / YouTube — the course lessons link out to DW's platform; when you watch a lesson you are on their infrastructure under their terms. Nothing about your Germanium usage is sent there by us.
Children
Germanium is a language course open to everyone, but accounts are not directed at children under 13 (or 16 in the EU, whichever applies to you). If you believe a child created an account, email us and it will be removed.
Changes
If this policy changes materially, the change is dated at the top of this page. Continued use after a change means acceptance — but data collected under the old policy is never retroactively re-scoped.
Is Germanium GDPR compliant?
Germanium is built on the GDPR's data-minimization principle: collect almost nothing, store it once per account, lock it with row-level security, and delete it on request within 30 days. Data-minimization is the compliance strategy — there is simply very little to protect.
Does Germanium sell or share my personal data?
No. Germanium collects only an email address, your learning progress, and — if you buy one — the record of that purchase. None of it is shared with advertisers or data brokers, and the only processors are the infrastructure providers needed to run the site at all: Auth0 for identity, Supabase for data, Cloudflare for delivery.
How do I delete my Germanium account and data?
Email the address at the top of this page and your account and progress row are deleted within 30 days. Signed-out sessions store nothing, so most visitors have nothing stored to delete.