Who we are
Verstanden is made by Kocak Consultancy, who is responsible for your data (the “controller” in data protection law). For anything about your data, write to info@kocakconsultancy.com.
Your account
To make an account, you give us your email address and a password.
- Your email is how you sign in, and where we send the six-digit codes that confirm it’s you or reset your password. We send nothing else: no newsletters, no marketing.
- Your password is stored scrambled (hashed), so nobody can read it, us included. When you choose one, we check that it isn’t on Have I Been Pwned’s list of leaked passwords. Only the first five characters of a scrambled form of it are sent for that, never the password.
- Each sign-in is kept with the IP address and the browser or app it came from, for security, until you sign out or 60 days after it was last used.
- To stop people guessing passwords and codes, we count recent attempts from each IP address.
We need the email and password to give you an account (GDPR Article 6(1)(b)). The sign-in records and the counts keep accounts safe, which is in your interest and ours (Article 6(1)(f)).
What your account keeps
So you can carry on where you left off, on the web and in the app, your account keeps:
- where you stopped in each episode, and the day you first finished it
- the words you save, and when each one is next due for review
- how long you listen each day, counted per device. Each device gets a random name; we don’t record which device it is.
This is what the account is for (Article 6(1)(b)).
On your device
- On the web, your browser keeps your progress, saved words and listening time, your settings (such as playback speed and your level) and your quiz results, plus one cookie that keeps you signed in. That cookie is the only one, and signing in needs it. Signing out clears your progress, words and listening time from the browser.
- In the app, your phone keeps the same, plus the episodes you download. Your sign-in is kept in the phone’s secure storage. The daily review reminder is set on the phone itself: no server is involved.
How Verstanden is used
We use PostHog to see how Verstanden is used: which stories people start and finish, where they stop, and where they get stuck. It tells us what to make next and what to fix. PostHog keeps this on its servers in the EU (Frankfurt, Germany).
While you’re signed in, it records
- what you do: the stories you start and finish, how long you listen, the quizzes and reviews you finish and the words you save, and in the app, downloads and changes to the reminder
- the pages or screens you open, what you click on the web, and errors
- your device: browser or app version, system, device model, screen size and language, and your IP address with the rough location (country and city) it points to
- on the web, a recording of each visit: the pages as you saw them, with your clicks, taps and scrolling, so we can see where people get stuck. Everything you type is hidden in it, and so is your email address.
All of it carries your account’s id, a random string, never your email address.
Before you sign in (on the welcome and sign-in pages, and this one), the same is recorded, recordings included, but without an id. If you then create an account or sign in, that visit is joined to your account.
Nothing is saved on your device for it: no cookies, and nothing that recognises you next time. It goes to PostHog through our own address, without our cookies.
To turn it off, go to You › Account and switch off “Share how I use Verstanden”. From then on nothing is sent from that browser or phone while you’re signed in to that account. The choice is kept on each device, so switch it off on each one you use. Before you sign in there’s no switch.
We do this on the basis of our legitimate interest in understanding how Verstanden is used and making it better (Article 6(1)(f)). You can object at any time: the switch does it, or write to info@kocakconsultancy.com.
Who else handles your data
A few companies run parts of Verstanden for us. They handle your data only on our behalf:
- Cloudflare hosts the website and the app’s server, keeps the accounts in its database (in Europe) and serves the audio. Its request logs, which include IP addresses, are kept for up to seven days to find faults.
- Resend sends the emails with your codes.
- PostHog keeps the usage data described above, in the EU.
Cloudflare and Resend are American companies, so your data may be handled outside the EU, under the safeguards EU law asks for. If you get the app from Google Play or the App Store, Google or Apple handle the download under their own privacy policies.
How long it’s kept
- Your account and everything in it: until you delete it.
- Sign-ins: until you sign out, or 60 days after the last use.
- Email codes: ten minutes, or until used.
- Usage data: up to a year in PostHog, recordings up to 30 days.
- Cloudflare’s request logs: up to seven days.
Delete your account
- On the web: sign in at verstanden.app, open You, and choose Delete account at the bottom.
- In the app: open the You tab and choose Delete account at the bottom.
Your email, password, progress, saved words and listening time are deleted straight away. It can’t be undone. The usage data tied to your account’s id is deleted from PostHog within 30 days.
Can’t sign in any more? Write to info@kocakconsultancy.com from the account’s email address, and we’ll delete it for you.
Your rights
You can ask us for a copy of your data, to correct it, to delete it, or to stop using it for analytics. Write to info@kocakconsultancy.com, and we’ll answer within a month. You can also complain to a data protection authority, for example the one where you live.
Changes
If we change how we use your data, we’ll update this page and the date at the top.