Last updated

Privacy Policy

This Privacy Policy describes how the Georgian Course application ("we", "us", or "the service") collects, uses, and protects information when you use it. By creating an account or otherwise using the service, you agree to the practices described below.

1. Information We Collect

When you register and use the service, we collect the following information that you provide directly:

  • Username — the name you choose to sign in with (3–30 characters, letters and digits).
  • Password — stored only as a bcrypt hash; we never store or log the plaintext version.
  • Email address (optional) — if you choose to provide one, used only to help you recover your account. We do not send marketing email.
  • Security question and answer — used solely to verify your identity if you forget your password. The answer is normalized (trimmed, lowercased) and stored as a SHA-256 hash.

We also automatically collect and generate the following as you use the service:

  • Learning progress — which lessons you have started and completed, and the scores you achieved.
  • SRS (spaced-repetition) card state — the scheduling parameters for each review card the system has created for you.
  • Activity log — for each exercise you answer, we record the exercise, your answer, whether it was correct, and how long it took you to respond. This data powers the progress dashboard and helps us debug the service.
  • Session metadata — when you sign in we create a session record containing a session id, your user id, the creation and expiration times, your IP address, and your browser's User-Agent string.
  • Server logs — standard HTTP request logs (timestamp, method, path, status, response time). These are used for debugging and security.

2. How We Use Your Information

We use the information we collect only to:

  • Provide the core service: authenticate you, deliver lessons, and run exercises.
  • Save and restore your learning progress across devices and sessions.
  • Schedule review cards using the FSRS algorithm so you see the right items at the right time.
  • Diagnose bugs, investigate abuse, and keep the service secure.
  • Improve the product — for example, by understanding which lessons users find difficult.

We do not sell your personal data, and we do not share it with data brokers.

Advertising on the service is served by Google AdSense. Google may set or read cookies (including the DoubleClick cookie) and may process data about your visits — for example, to display and measure advertisements and to personalize the ads you see — in accordance with its own policies. To learn how Google uses data when you use websites that partner with it, and to manage your advertising preferences, see How Google uses data and Google Ads Settings.

3. Payment Processing

Purchases of Ad-Free Premium are processed by Paddle.com, which acts as the Merchant of Record for all orders. When you make a purchase, Paddle receives your email address and payment details (such as your payment card information) in order to process the transaction and handle refunds. Paddle processes this data in accordance with its own privacy policy, available at https://www.paddle.com/legal/privacy. We do not store your payment card details on our servers.

4. Data Storage and Security

Your data is stored in a SQLite database managed by the application's server. We apply the following technical safeguards:

  • Passwords are hashed with bcrypt before being stored. We do not have the ability to recover your original password — only to verify a candidate.
  • Session tokens are JWTs (JSON Web Tokens) signed with a server-side secret. They are transmitted in an HTTP-only, SameSite=Lax cookie. The Secure flag is enabled whenever the service is served over HTTPS.
  • Password-reset tokens are random 256-bit values; only their SHA-256 hash is stored in the database.
  • CSRF protection is enforced on state-changing requests via a synchronizer-token pattern.
  • Rate limiting protects authentication and password-reset endpoints from brute-force attacks.
  • Security headers (CSP, HSTS, X-Frame-Options, and others) are set on every response.

No method of transmission over the internet, however, is 100% secure. We cannot guarantee absolute security of your data.

5. Your Rights

Depending on where you live, you may have some or all of the following rights with respect to your personal data:

  • Access — request a copy of the personal data we hold about you.
  • Rectification — correct inaccurate or incomplete data (e.g. update your email from the Account page).
  • Erasure — request that we delete your account and all associated data. The Account page includes a "Delete my account" action that does this immediately.
  • Data portability — receive your data in a machine-readable format. The Account page includes an "Export my data" action that downloads a JSON envelope of your progress, SRS state, and activity log.
  • Restriction of processing — ask us to pause certain processing while a question is being resolved.
  • Objection — object to processing that is based on our legitimate interests.
  • Withdrawal of consent — where we rely on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, use the controls on the Account page, or contact us at the address listed in section 9 below. We will respond within the timeframes required by applicable law (typically 30 days under GDPR).

6. Cookies and Tracking

We set only one category of cookies ourselves: a single HTTP-only session cookie that authenticates you to the server. We do not set any advertising, analytics, or cross-site tracking cookies ourselves, and we do not otherwise embed third-party scripts that set their own cookies.

Advertising served by Google AdSense may set or read third-party cookies, including the DoubleClick cookie, in order to serve and measure ads and to build ad-interest profiles. Google's use of these cookies is governed by Google's own policies (see section 2 above), and you can opt out of personalized advertising at https://adssettings.google.com.

A legacy non-HTTP-only userId cookie may be set on older API paths; it is not used for tracking and is cleared when you sign out.

Your browser's local storage is used to remember your theme preference (light / dark / system). This stays on your device and is not transmitted to the server.

7. Children's Privacy

The service is not directed at children under the age of 13, and we do not knowingly collect personal data from children under 13. Where local law sets a higher minimum age for the lawful use of online services (for example, 16 in some EU member states under GDPR), that higher age applies.

If you believe a child under the applicable age has created an account, please contact us and we will delete the account and its data.

8. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date at the top of this page and, for material changes, notify signed-in users through the application. We encourage you to review this page periodically.

9. Contact

If you have any questions about this Privacy Policy, want to exercise your rights, or have a privacy concern, please contact us at: