Privacy Policy

Effective 12 August 2026 · Last updated 20 August 2026
Changed since first publication: account deletion is now a button in the app, not only an email request (section 12), and the email list now has a section of its own (section 7).

1. Who this is, and what it covers

This site, spanish.caminantes.co, is operated by AFK Ventures, a sole proprietorship (enkeltmandsvirksomhed) registered in Denmark, CVR 46057791, owned by August Frederik Kramer.

Address: Marskensgade 2, 3. tv., 2100 København Ø, Denmark.
For anything in this document, write to contact.afkventures@gmail.com.

Under the GDPR, AFK Ventures is the data controller for the personal data described here. There is no Data Protection Officer: the criteria in Article 37 do not apply to an operation this size, so the controller above is who you contact about any of it.

This policy covers this site only. The Caminantes mobile application and the caminantes.co website are a different product with a different stack, and they have their own privacy policy. Having one account here does not give you an account there, and neither one knows about the other.

2. If you do not have an account

You can use the free sample without signing in, and this is the important part: none of it reaches us.

The words you rate, the practice session you are part way through and the progress bar you see are all held in your own browser, in localStorage, under the key wordlist:try:v1. The code that writes it makes no network request at all. Clear your browser data, or use the app in a private window and close it, and that record is gone. We cannot restore it, because we never had it.

Two other on-device entries exist for preferences: wordlist:theme and wordlist:level. They hold a theme choice and a display setting. They are not sent to us either.

The ordinary mechanics of the web still apply: to send you the page at all, our server and the networks in front of it necessarily see your IP address. Section 6 covers what happens to it.

3. If you do have an account

How signing in works

Accounts are handled by Firebase Authentication, a Google service. You give it an email address and a password, and it gives us back a token proving you are you.

We never receive your password. It is set, checked, reset and stored entirely by Google, and there is no point in our system where the plain text of it exists. The same goes for the emails that verify an address or reset a password: Firebase sends those, not us.

Signing in with Google instead

There is a second way in: Sign in with Google. If you use it, your browser is sent to Google's own sign-in page, you choose an account there, and Google sends your browser back to us with a code we exchange for proof of who you are. That exchange happens between our server and Google's, not in your browser.

Using it tells Google that you signed in to this site, in the same way signing in to anything with a Google account does. We ask Google for three things and nothing else: that you are signed in, your email address, and your basic profile. What we keep afterwards is the same as for any other account, and it is the list directly below. If you never press that button, your browser never contacts Google on our behalf.

What we store about you

In our own database, an account consists of:

• Your email address, and the account identifier Firebase assigns you.
• When the account was created and when it was last used.
• Your settings, which today means a theme choice.
• Which version of the terms you accepted, and when. Written once, when the account is created, and never changed afterwards. It is kept because an agreement nobody can evidence is not much of an agreement, and because you are entitled to see which text you actually agreed to. Your account screen shows it back to you. Accounts made before this was recorded have no entry, and say so rather than being given one.

What we store because you made it

• Your words. The Spanish, the English, any notes, tags and grammatical form you add, and a confidence rating.
• Your review history. Every time you rate a word we keep a row: which word, what you rated it, when, whether it came from the list or from practice, and which direction you were tested in. This is what the statistics and the practice scheduling are made of. It is, unavoidably, a fairly detailed record of when you were studying.
• Your goals, and whether you have archived them.
• Which courses your account holds, and when it got them.

What you put in a note is up to you, within reason

Words carry free-text notes and tags. We do not read them, we do not scan them, and nothing in the app looks at what is inside one.

That also means nothing stops you putting something in there that does not belong. Please keep other people's personal details out of them, and keep anything genuinely sensitive about yourself out of them too: health, beliefs, and so on. This is a vocabulary app run by one person, and it is not built to be the right home for that. The terms say the same thing in more detail.

Staying signed in

One cookie, named wl_session. It is HttpOnly so no script on the page can read it, Secure so it only travels over HTTPS, and SameSite=Lax so another site cannot make your browser send it. It lasts at most 30 days, and expires after 14 days of not being used.

What we keep in the database is the SHA-256 hash of the session token, never the token itself. A session token is a bearer credential: anyone holding it is signed in as you. Storing only the hash means a stolen copy of our database is not a set of working logins.

There is one other, and it exists for ten minutes at most. If you press Sign in with Google, a cookie named wl_oauth holds the handful of one-use values that make the round trip to Google safe, so that the answer coming back can be checked against the request that went out. It is HttpOnly, Secure and SameSite=Lax like the other one, it is confined to the sign-in paths, and it is destroyed the moment it is read, whether the sign-in worked or not. It contains no personal data and it is never set unless you press the button.

Both cookies are strictly necessary to provide a service you asked for, so they need no consent and there is no banner asking for them. They are the only cookies this site sets. There is no advertising cookie, no tracking cookie, and no third party setting a cookie through us.

The same reasoning covers the on-device entries named in section 2. The rules about storing things on your device are not only about cookies, so wordlist:try:v1, wordlist:theme and wordlist:level are named here too: they exist to hold the practice you are in the middle of and the way you asked the app to look, they are read only by this site, nothing in them is sent to us, and none of them is used to recognise or follow you.

4. If you sign up after trying it

When you make an account after using the free sample, the app offers to carry your progress over. If you accept, the ratings held in your browser are sent to us once and written to your new account, and from that point they are account data like any other. If you decline, they are not sent, and the new account starts empty.

The transfer is checked before it is applied: the sample is versioned, and progress recorded against an older version of it is refused rather than being written onto whatever words now sit in those positions. This is a correctness measure, but it is also the reason we can say your ratings land on the words you actually rated.

5. Looking words up

Signed-in users can look up a definition or fetch example sentences. That sends the word being looked up to Wiktionary (the Wikimedia Foundation) and Tatoeba. Those requests carry the word and nothing that identifies you: no account id, no email, no session cookie.

Visitors without an account cannot reach these features at all, so nothing is sent on their behalf.

Translating something

Two places ask a machine to translate: looking up an English word while adding it, and Read, where you paste a passage. In both cases the text you submit is sent to DeepL, a German company, and processed in the EU. Nothing identifying you goes with it: no account, no email address, no session cookie. DeepL states it does not keep the text of API requests after translating them.

Worth saying plainly for Read: whatever you paste there leaves this service. Do not paste anything you would not hand to a third party, and particularly not somebody else's private correspondence.

Translations are cached on our own server, keyed by the text, so asking twice costs nothing. That cache holds words and sentences, not who asked for them.

At the time of writing this is switched off. The feature is built but no key is configured, so nothing has been sent to DeepL at all. It is described here because it will be turned on, and a privacy policy that appears the same day as the thing it describes is one nobody had a chance to read first.

Definitions from Wiktionary are licensed CC BY-SA 4.0 and sentences from Tatoeba CC BY 2.0 FR. That is a licensing obligation rather than a privacy one, and the credit is in the footer of the app.

6. IP addresses

We keep no log of them. The server writes no access log containing your address. Nothing you do while signed in - reading, rating, practising, buying - records the address you did it from, and nothing attached to your account has a column for one.

Your address is held briefly in the server's memory to count requests, so that one visitor cannot flood the free sample or grind through passwords. Those counters expire on their own: a minute for ordinary use, fifteen minutes for failed sign-in attempts, and an hour for the email-list form, which is deliberately the tightest limit here because a person fills that form in once. Nothing is written to disk, and a restart clears them entirely.

There is exactly one exception, and it is deliberate. If you tick the box to join the email list, the address you submitted from is written to that one row, once, beside the sentence you agreed to and the moment you agreed to it. Article 7(1) of the GDPR puts the burden on us to show that a particular person agreed to a particular thing at a particular time, and that is the whole of what it is for. It is not used to recognise you, it is not linked to an account, and no other action anywhere on this site stores it. It goes when that row goes, and section 7 says when that is.

Our hosting provider and the network in front of the site process your address in order to deliver the page and to block attacks, which is section 9.

7. The email list

Separately from all of the above, this site offers a free sequence of Camino Spanish lessons by email, and news about the courses. It is optional, it has nothing to do with having an account, and nothing here is withheld from you if you do not join.

The legal basis is your consent, Article 6(1)(a) of the GDPR. It is the only thing on this site we ask you to consent to. There is no pre-ticked box and no bundling it into something else: you join by ticking an empty box next to the sentence itself, which reads:

That sentence is stored on your row exactly as it appeared on your screen, rather than as a yes or a no, so that what you agreed to is a matter of record rather than of our memory. If the wording is ever changed, rows already on the list keep the wording that was actually shown to them.

What is stored, and nothing beyond it:

• Your email address.
• Which page the form was on, so we can tell where the people who want the lessons are finding them.
• The language your browser reported, so that a message can eventually be sent in a language you read.
• The IP address you submitted from, the sentence above, and the date and time. Together these are the evidence that the consent was real and was yours. Section 6 explains why this one address is kept when no other one is.
• Two random tokens: one that confirms the address is yours, and one that unsubscribes you. The unsubscribe token is created the moment you join rather than when the first message goes out, so the way out exists before the way in has been used.

There is no name field, no profile, and nothing about you is inferred or added from anywhere else. Joining the list does not create an account and does not give you access to anything.

Nothing has been sent to this list, and nothing can be yet. No email provider has been chosen and no sending of any kind is wired into this service, so every address on it currently sits unconfirmed and unmailed. When a provider is chosen it will be a processor under a written agreement, it will be named in the table in section 9, this section will say so, and the first thing you receive will be the message asking you to confirm that you meant it.

Where it is held. In the same PostgreSQL database as the rest of this service, run by Railway in their EU West region. It is not passed to anybody else, and until a provider is chosen there is nobody to pass it to.

How long it is kept.

• If you confirm the address, until you unsubscribe or ask to be removed.
• If it is never confirmed, 30 days from the day it was given, and then we remove it. An address nobody confirmed is not a list, and holding one indefinitely against a send that may never happen is not something a tick box covers.
• If you unsubscribe, the row is kept but marked as gone, so that a later submission of that address - by anybody, including one you did not make - cannot quietly put you back on. If you would rather it were deleted outright, say so and it will be.
• Deleting your account also deletes any list row with the same address, in the same operation.
• A deletion here is immediate and complete: unlike account data, there is no backup copy of this list waiting to age out afterwards.

Withdrawing your consent. Every message that is ever sent will carry a one-click unsubscribe link, and until one has been sent you can write to contact.afkventures@gmail.com and we will take the address off. Leaving is meant to be at least as easy as joining was, and joining is one field and no account. Withdrawing does not make anything done beforehand unlawful, which is what Article 7(3) of the GDPR says, and it changes nothing else about you or your account.

Everything in section 12 applies to this list as well: you can ask what is held about you, have it corrected, have it deleted, and have it handed to you as a file. And if you think we have handled it badly you can complain to Datatilsynet, the Danish Data Protection Agency, Carl Jacobsens Vej 35, 2500 Valby, Denmark, datatilsynet.dk, or to your own national authority if you live elsewhere in the EU.

8. Where it is kept

The application and its PostgreSQL database run on Railway, in their EU West region. Cloudflare sits in front of the site, terminating HTTPS and serving the parts that can be cached.

Backups are taken daily, and once more whenever the app restarts, and kept in Cloudflare R2 for 30 days, after which they are deleted automatically. They are encrypted on our server before they are uploaded, with a key Cloudflare does not have, so what R2 holds is ciphertext. A bucket left open by mistake would expose an unreadable file rather than your vocabulary and email address.

9. Who else processes it

These are the only third parties involved, each doing one job on our instructions:

Paddle is different from the others in the table, and the difference matters. They are the merchant of record: the sale is a contract between you and them, so for the payment they are their own controller under their own privacy policy, not a processor acting on our instructions. What we receive back is that a payment succeeded, for which account, and a customer reference. We never see or hold your card details. If you never buy anything, Paddle receives nothing about you at all.

One page loads code from Paddle, and only one. The payment page, /checkout.html, loads Paddle's script from their servers so the payment form can open. From that moment Paddle can see the ordinary things any website you visit can see: your IP address, your browser and the fact that you are on that page.

The complete list of third-party code that runs in your browser on this site is two entries long. Paddle's script, on the payment page only, as above. And Plausible, on every page, which is the analytics described in section 10: it is cookieless, assigns you no identifier, and is named here as well as there because a list of what runs on a page is not the same claim as a list of who receives data.

Nothing else does. That is why signing in uses Google's REST interface rather than Google's own script, and why the payment page is a page of its own rather than a form on the shelf.

Sign in with Google is a different thing, and worth separating from that. No Google code runs on our pages. Pressing the button navigates your browser to Google's own sign-in page, the way any link to another site does, and Google sees you there under its own privacy policy rather than as our processor, exactly as it would if you signed in to anything else with that account. Everything after that happens between our server and Google's.

Each of them is under a written data processing agreement, which Article 28 of the GDPR requires and which we hold rather than merely assume. Google's is the Firebase Data Processing and Security Terms, incorporated into the Firebase agreement. Cloudflare's is its Data Processing Addendum, incorporated by reference into the Self-Serve Subscription Agreement. Plausible's applies by use of the service, in its own words. Railway's is executed separately.

We do not sell personal data, we do not share it for advertising, we do not use it to train anything, and we do not hand it to anyone not listed above except where the law requires it.

There is no automated decision-making and no profiling. Nothing here makes a decision about you without a person, and nothing builds a picture of you to predict or influence what you will do. Article 22 of the GDPR gives you rights about that sort of processing; they do not arise, because it does not happen. This is stated rather than left out, because a policy that is silent on it leaves you unable to tell whether it was considered.

The practice scheduling is the one thing that might look like it. It decides which card to show you next from your own ratings, by a fixed rule you could work out on paper. It produces no judgement about you, it is not compared against anybody else, and nothing it does has any effect outside the next flashcard.

One exception, stated in advance. If this service or the business behind it is ever sold or transferred, the data described here would transfer with it, because an account without its words is not an account. The buyer would be bound by this policy as it stands at that moment, you would be told before it happened, and you would be able to export everything and delete your account first. That is the only circumstance in which your data goes anywhere not on this page.

Transfers outside the EU. Google and Cloudflare are United States companies and personal data may be processed by them outside the European Economic Area. Those transfers rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework, under the terms those providers publish.

10. Analytics

We use Plausible Analytics, which is hosted in the European Union. It sets no cookies, stores no personal data, assigns you no identifier and cannot follow you to another site or recognise you on your next visit.

What it records is aggregate: how many people viewed a page, which site they arrived from, and which country they were in. We use it to find out whether anyone is using this, which is a genuinely open question. Because no personal data is processed and no cookie is set, there is nothing here to consent to and no banner.

11. Legal bases, and how long we keep things

Under Article 6 of the GDPR, we rely on:

• Performance of a contract for your account and the words, reviews and goals in it. Without them there is no service to provide.
• Legitimate interests for keeping the service standing up: rate limiting and backups. We have weighed these against your interests and kept them narrow, which is why the IP counters live in memory - minutes for most of them, an hour for the email-list form - and are never written down.
• Consent, Article 6(1)(a), for the email list and for nothing else. You give it by ticking an empty box next to the sentence it belongs to, and you can withdraw it at any time without losing anything else. Section 7 sets it out in full.
• Legal obligation for the records that go with a purchase: accounting records under Danish bookkeeping law, and being able to show what you agreed to when you bought something. Those records are Paddle's, not ours. They are the seller, so the invoice and the accounting record sit with them under their own retention rules, and so does the record that you asked for immediate access and which version of the terms you were shown when you did. On our side a purchase is one row saying which courses your account holds and when it got them, and deleting your account deletes it with everything else. We keep nothing back for accounting, because there is nothing we are the ones obliged to keep.

Analytics is deliberately absent from that list. Plausible processes no personal data at all, as section 10 sets out, so there is nothing there for a legal basis to apply to. If that ever changes, this section changes with it and it would need its own entry.

There is still no consent banner, and that is not an oversight. A banner exists for things put on or read from your device. Both cookies, and the handful of on-device entries named in section 2, are strictly necessary to provide a service you asked for, which is the exemption they fall under, and our analytics is cookieless and stores nothing on your device at all. So there is nothing here for a banner to ask you about.

The email list is the one place consent is the basis, and it is a different mechanism on purpose: it is asked for in the form itself, in the same sentence as the thing being agreed to, rather than in a banner across a page you came to read something else on. It is withdrawn with the unsubscribe link rather than with a preference centre. Section 7 is the whole of it.

One thing we do ask you to agree to, and it is not this. Before a payment starts you are asked to agree that your purchase is delivered immediately and that you therefore give up the 14-day right to withdraw. That is a consumer-law consent about the sale, not a GDPR consent about data, and agreeing to it changes nothing about how your personal data is handled. The terms explain it.

Retention.

• Account data is kept until you delete the account, or ask us to. There is an outer limit: an account not signed into for 24 months may be deleted, after we email you at least 30 days beforehand. Signing in is enough to keep it. The terms set this out. Holding somebody's email address and study history for years after they stopped caring is keeping it longer than there is any reason to. This outer limit does not apply if you have ever paid for anything, because a course sold as yours to keep cannot be taken back by a quiet spell. Those accounts are kept until you delete them.
• Sessions expire after 30 days, or 14 days unused, and are removed.
• Backups are deleted 30 days after they are written. This means a deleted account can survive in an encrypted backup for up to 30 days after deletion, and then does not.
• Rate-limit counters last minutes, or an hour for the email-list form, and are never written down.
• Email list entries are kept until you unsubscribe or ask to be removed. An address that is never confirmed is removed 30 days after it was given. Section 7 has the rest, including what happens to the IP address stored with it.

12. Your rights

You have the right to get a copy of your data, to have it corrected, to have it erased, to restrict or object to how we use it, and to have it handed to you in a portable form. Where we rely on your consent - which is the email list in section 7, and only that - you also have the right to withdraw it at any time.

Deleting the account removes the account row, and every word, review, goal, session and course entitlement attached to it, in one operation. Nothing of yours is kept back, and you are signed out on every device you were signed in on. Your sign-in record at Google is deleted in the same request, immediately afterwards. In the rare case that second step fails, the app tells you so plainly rather than reporting success: your data is gone either way, but your email address would still be on file at Google, and we will remove it by hand if you write to us. Encrypted backups written before the deletion age out within 30 days, as above.

If you think we have handled your data badly, please tell us first, but you are entitled to complain directly to the Danish Data Protection Agency: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark, datatilsynet.dk. If you live elsewhere in the EU you may complain to your own national authority instead.

13. Children

This is not aimed at children, and accounts are not for under-13s. We do not knowingly hold data from one. If you believe a child has made an account here, write to us and it will be removed.

On the age of digital consent. Article 8 of the GDPR sets an age for consent to online services, and member states have chosen differently within it: Denmark 13, several others 16. That rule applies where a service relies on consent. The legal basis for an account is the contract between us, as section 11 sets out, so the Article 8 threshold is not what governs an account. The one place we do rely on consent is the email list in section 7, and the same floor applies there: it is not for under-13s either, and if we are told that a child gave us an address it is removed rather than kept.

The 13 above is our own floor, and it is deliberately at the bottom of that range rather than the top. If you are under 16, please have a parent look at this page and the terms with you before making an account. Whether a minor can enter a contract at all is a question of national law rather than data protection, and it is one more reason this is a poor service for a young child regardless.

14. Security

Everything is served over HTTPS. Passwords are Google's to hold, not ours. Session tokens are stored hashed. Backups are encrypted before they leave the server. Accounts are separated in the database by owner, and that separation is checked by an automated test suite on every change, because "we were careful" is not a control.

No system is perfectly secure, and this one is run by one person. If you find a way in, please tell us at the address above rather than anyone else, and we will fix it and thank you.

If there is ever a breach that puts your data at risk, we will report it to the Danish Data Protection Agency within 72 hours of becoming aware of it, as the GDPR requires, and we will tell you directly if the risk to you is high. We would rather send you an awkward email than have you read about it somewhere else.

15. When you write to us

This policy asks you to email us several times over: to ask what we hold, to have something corrected, to have an account deleted, to complain, or to report a security flaw. Each of those emails is itself personal data, so here is what happens to it.

What we hold. Your email address, whatever you wrote, and our reply. If you are asking about an account, that thread will usually contain enough to identify which account, because it has to.

Where it sits, and a limitation worth being straight about. In an ordinary consumer Gmail mailbox, not a Google Workspace one. That distinction matters: the processors in section 9 each operate under a written agreement that binds them to act on our instructions, and a consumer mailbox is not one of those. Google handles that mail under its own consumer terms, as it does for everyone else's email.

The practical consequence is the one in the note below: treat email to us as ordinary email, because that is what it is. Moving business mail onto a footing that carries a processor agreement is a known improvement rather than a solved problem, and it is recorded as such internally rather than glossed over here.

Why we may keep it. To answer you, and afterwards to be able to show what was asked and what we did. A deletion request that we cannot evidence having honoured is a problem for both of us. The basis is our legitimate interest in handling and evidencing requests, supported by the accountability duty in Article 5(2) of the GDPR, which requires us to be able to demonstrate compliance; and for anything that becomes a legal matter, establishing or defending a claim.

How long. Ordinary correspondence is kept while it is useful and cleared out periodically. Records of formal requests, such as deletion or access requests, are kept for two years, which is long enough to answer a question about whether we did what we said. You can ask us to delete correspondence sooner and we will, unless it is the evidence that we honoured a request you made.

One practical note. Ordinary email is not a secure channel. Please do not send passwords, and do not send us anything sensitive that we did not ask for.

16. Changes

If this policy changes in a way that matters, the date at the top moves and, where it is significant, the app will say so.

Earlier versions are kept and you can have one. Every version of this document is held in the version control the code lives in, so which text was in force on a given day is a matter of record rather than of memory. That repository is private, because it contains the courses themselves, so the history is not something you can browse. Ask us for the version that applied on a particular date and we will send it to you.

This policy is version 2026-08-20. Versions are numbered so that "which policy applied when" has an answer. The number is shared with the Terms of Service, because the two are agreed to together, so it moves when either of them changes. This policy's own text was last changed on 20 August 2026: the email list has a section of its own for the first time (section 7), the sections after it moved down by one, section 6 was corrected to say that the address you join the list from is stored as the evidence of that consent, and the claim that consent is relied on for nothing was replaced with the true position. Before that, on 18 August, it began stating that there is no automated decision-making or profiling, and said so about the practice scheduling in particular. Before that, on 16 August, Paddle was added to section 9, Sign in with Google was described in section 3 alongside the cookie it uses, and the retention section was corrected to say that an account which has paid for something is never deleted for going quiet.

17. Contact

contact.afkventures@gmail.com

AFK Ventures · CVR 46057791
Marskensgade 2, 3. tv., 2100 København Ø, Denmark

See also the Terms of Service.