Your data at LeseLaut
Updated 26 October 2026. LeseLaut is a German-learning beta. Contact leselaut.team@gmail.com about privacy or your account.
What is saved
Your account email, username and display name connect your learning history across devices. Saved data includes progress, tutor drafts, attempts, feedback, transcripts you submit and usage allowances. Supabase handles passwords and Google sign-in. LeseLaut does not store your password in its learner database.
AI practice
AI features send the text, photo or recording needed for your requested task to Groq, or to OpenAI when configured. A recording is transcribed; its text can then be assessed. Original uploads are processed for the request rather than stored in LeseLaut’s learner database. Transcripts, extracted text and feedback can be saved in practice history. Provider processing and retention depend on their policies and account settings. Avoid submitting sensitive information or other people’s private data.
Browser storage
This browser stores sign-in sessions, your theme, learning progress and recovery drafts. Clearing site data removes browser copies but does not delete your account. Other browsers and the original LeseLaut address have separate browser storage.
Optional visitor analytics
If you choose Allow analytics, AWS CloudWatch RUM receives public-page visit times and paths, random browser and session identifiers, visible-page heartbeats, browser/device and approximate region information, page performance, and selected browser or network errors. We use this to monitor visits and fix technical problems. We do not send your account email, learning answers, request bodies or authentication tokens to RUM, and do not enable session replay. Account, authentication and AI-practice pages are excluded. Resource URLs, query strings and URL fragments are not collected by our configuration.
Analytics stay off until you opt in. Your browser’s Do Not Track or Global Privacy Control signal also disables them. Use Analytics preferences in the footer to decline later; this stops browser telemetry and removes its RUM cookies and cached telemetry credentials. The random browser cookie lasts up to 30 days. The preference is remembered for up to 180 days. AWS retains RUM events for 30 days; the additional CloudWatch log copy is retained for seven days. Analytics identifiers are separate from your LeseLaut account, so deleting that account does not identify or erase these separate visitor records. You can contact support about those records using the random visitor/session IDs if available.
Operational logs
The server records request time, method, path, status, duration and response size for operations and security. These access logs exclude query strings, client IP addresses, request bodies, cookies and authorization headers, and have seven-day CloudWatch retention. They count requests, including bots, rather than named visitors. AWS necessarily receives connection information to deliver its services; its processing is governed by its policies.
How long data stays
Saved account and practice data stays until you delete the relevant practice or your account; there is no automatic inactivity purge. AWS application logs have a seven-day retention setting. Database backups use a 30-day expiry policy, with a further seven days for older object versions. Deletion does not immediately remove those backups. A minimal record of the deleted account ID is retained to block old sessions and prevent delayed requests from recreating your data.
Your choices
Use Account to download your saved data or delete your account. If automatic deletion is unavailable, contact support. If deletion is queued, your learner data is removed and access is blocked while authentication deletion is retried. Clear site data on your other devices to remove local copies. Providers may retain records independently under their own policies.
Hosting and access
AWS hosts the application and learner database; Supabase provides authentication. Authorized operators can access account information when needed to maintain the service or resolve a support request. Do not email passwords, API keys or recordings to support.