Privacy notice

Supabase Auth and Postgres

Code purpose: account, authentication, subscription and learning persistence

Data: account identifiers, email, sessions, learning activity and billing state

Role: configured infrastructure provider

Article 13 legal basis: Contract performance and legitimate interests in secure service operation

Recipients: Supabase as authentication and database processor

Transfers: Provider locations and safeguards described in the Supabase data processing terms

Retention: Account lifetime plus deletion, fraud, tax and legal retention periods

Rights: Access, correction, export and deletion through account controls or support

OAuth providers through Supabase Auth

Code purpose: optional OAuth sign-in (Google on Faust; Apple when enabled; GitHub retained for other products)

Data: OAuth account identifiers and the profile data returned by the selected provider

Role: identity provider selected by the account holder; Supabase handles the callback

Article 13 legal basis: Contract performance when the user chooses OAuth sign in

Recipients: The OAuth provider selected by the user

Transfers: Provider locations and safeguards in the selected provider terms

Retention: Account lifetime and provider controlled retention

Rights: Disconnect the provider and exercise account data rights through support

Stripe

Code purpose: Checkout, recurring billing, receipts and Customer Portal

Data: purchaser identity, address, payment and subscription identifiers

Role: payment and billing provider

Article 13 legal basis: Contract performance and legal obligations for billing records

Recipients: Stripe as payment processor

Transfers: Stripe locations and safeguards described in its data processing terms

Retention: Subscription lifetime plus statutory accounting, dispute and fraud periods

Rights: Billing access, correction and cancellation through Stripe Portal or support

Resend

Code purpose: authentication, billing and durable contract/action confirmations

Data: email address, message content and delivery metadata

Role: configured email provider

Article 13 legal basis: Contract performance, legal obligations and secure account operation

Recipients: Resend and its delivery infrastructure

Transfers: Resend locations and safeguards described in its data processing terms

Retention: Delivery logs for operational, legal and abuse prevention periods

Rights: Email and account rights may be exercised through support

AI model providers selected by feature

Code purpose: chat, marking, image generation and generated practice

Data: user prompts, uploaded practice content, tool inputs and generated outputs

Role: OpenAI, Anthropic, Google, Groq or AWS Bedrock/Anthropic is called only for the selected model and configured request

Article 13 legal basis: Contract performance when the user requests an AI practice feature

Recipients: Configured AI model providers acting under provider terms

Transfers: Provider locations and contractual safeguards configured for the selected model

Retention: Provider request retention plus Faust account and learning retention periods

Rights: Avoid optional AI features or request access and deletion through support

ElevenLabs

Code purpose: speech-to-text for the speaking room and text-to-speech for listening and proctor audio

Data: the audio a candidate records in a speaking room, the exam or proctor text to be spoken, and the requested language and voice settings

Role: sole speech provider; recorded speaking audio is sent to it for transcription and the returned transcript and generated audio are stored with the session

Article 13 legal basis: Contract performance when the user starts a speaking or listening feature

Recipients: ElevenLabs as the sole configured speech provider

Transfers: Provider locations and contractual safeguards for the selected voice service

Retention: Transient processing plus bounded account and learning result retention

Rights: Do not submit voice audio or request access and deletion through support

Language reference services used by the chat toolkit

Code purpose: dictionary, etymology, pronunciation, frequency, thesaurus and grammar-check lookups requested during chat

Data: only the word or text passage the lookup is performed on, plus the requested language; no account identifier, session identifier or authentication header is sent

Role: LanguageTool, Wiktionary, Wikimedia Commons, DWDS, OpenThesaurus and the Free Dictionary API are public endpoints called per lookup

Article 13 legal basis: Article 6(1)(b) GDPR: performing the chat tutoring the account holder asked for. The lookup only happens when the account holder requests a dictionary, etymology, pronunciation, frequency, thesaurus or grammar-check result.

Recipients: LanguageTool, Wiktionary, Wikimedia Commons, DWDS, OpenThesaurus and the Free Dictionary API, each called as a public endpoint for the single lookup requested. No account identifier, session identifier or authentication header is sent.

Transfers: LanguageTool, DWDS and OpenThesaurus are operated in the EU. Wiktionary, Wikimedia Commons and the Free Dictionary API may be served from outside the EEA. Only the word or passage looked up is sent, with no identifier attached to it, so no personal data is transferred by the request itself.

Retention: Faust stores no record of the lookup. The request is made, the result is shown in the chat, and nothing about the lookup is written to the Faust database.

Rights: Access, rectification, erasure, restriction, portability and objection under Articles 15 to 21 GDPR are exercised against Faust at the complaint contact below. Because no identifier is sent, these lookups hold no personal data at the reference services to exercise them against.

Guest allowance limits (no third-party recipient)

Code purpose: enforcing the free reading paper and chat-turn allowance for signed-out visitors

Data: a first-party guest identifier and a keyed HMAC-SHA-256 hash of the client IP address; the IP address itself is never written to storage

Role: processed by Faust in its own Supabase database and disclosed to no one; the hash is keyed so it cannot be reversed to an address without the server secret

Article 13 legal basis: Article 6(1)(f) GDPR: the legitimate interest in stopping one visitor from consuming the free allowance repeatedly. The interest is limited by never storing the address itself.

Recipients: No one. The guest identifier and the keyed hash are processed by Faust in its own Supabase database and disclosed to no third party.

Transfers: None beyond the Supabase Postgres instance already described in the Supabase data flow. The record leaves no other system.

Retention: Kept for the allowance window the limit is enforced over, then deleted. The IP address itself is never written to storage at any point.

Rights: Access, rectification, erasure, restriction, portability and objection under Articles 15 to 21 GDPR are exercised against Faust at the complaint contact below. Objection under Article 21 GDPR is available because this flow rests on legitimate interest.

sb-<project>-auth-token

Purpose: Supabase Auth session. Strictly necessary: without it a signed-in request cannot be authenticated.

Lifetime: until sign-out or session expiry

faust_guest

Purpose: signed httpOnly identifier for a signed-out visitor so the free reading paper and chat-turn allowance can be counted. Strictly necessary for the free allowance.

Lifetime: 400 days

faust_oauth_redirect

Purpose: remembers where to return after an OAuth sign-in or reauthentication round trip. Strictly necessary.

Lifetime: 10 minutes

faust_reauth_challenge

Purpose: binds a pending reauthentication to this session and origin before an account export or deletion. Strictly necessary security cookie.

Lifetime: 10 minutes, or until the challenge is consumed

faust_reauth_grant

Purpose: proof that this session reauthenticated, required to export or delete an account. Strictly necessary security cookie.

Lifetime: 5 minutes; cleared as soon as the operation completes

faust_recovery_proof

Purpose: binds a password recovery link to the browser that opened it. Strictly necessary security cookie.

Lifetime: 10 minutes, or until recovery completes

faust_account_delete_continuation

Purpose: lets an interrupted account deletion resume instead of leaving the account half-deleted. Strictly necessary.

Lifetime: until the deletion completes

faust_coach_tour (and its faust.coachTour localStorage mirror)

Purpose: records that the onboarding coach marks were completed or skipped, so they are not shown again.

Lifetime: 400 days

faust.account.pendingReauth (sessionStorage)

Purpose: holds the export or deletion request across an OAuth reauthentication redirect so it can resume on return. Cleared on use and never sent to a server.

Lifetime: until the browser tab is closed

goethe.examDate and goethe.examDatePromptDismissed (localStorage)

Purpose: the exam date a visitor entered, and whether they dismissed the request for one, so the countdown works before sign-up and the card asks once rather than after every paper. A signed-in account stores the same date in its profile instead.

Lifetime: until the visitor clears site data