Last updated: July 2026
This English text is a translation. The German version is legally authoritative.
Leo Köpke, Nernstweg 6, 22765 Hamburg, Germany, info@pathtowords.com.
We only process personal data insofar as it is necessary to operate, secure and provide the service. We do not use any tracking, analytics or advertising tools, and we do not use personal data as consideration for advertising, tracking or profiling.
| Data | Purpose | Legal basis |
|---|---|---|
| Email, password (hash), account status | Account | Art. 6(1)(b) GDPR |
| Learning progress, courses/levels, own words/lists, settings, time zone | Learning service | Art. 6(1)(b) GDPR |
| Server logs, IP, user agent | Operation, IT security | Art. 6(1)(f) GDPR |
| Signals from the bot-protection widget, IP | Protection against abuse/spam | Art. 6(1)(f) GDPR |
| Email address | System / transactional emails | Art. 6(1)(b), (f) GDPR |
| Word you enter (only when adding your own word) | AI classification | Art. 6(1)(b) GDPR |
Our legitimate interest (Art. 6(1)(f)) lies in the secure, stable and abuse-free operation of the service, the prevention of automated access and the deliverability of security-relevant system messages.
We will provide information on the specific recipients and the respective safeguards on request.
Some service providers in the categories hosting/delivery, bot/abuse protection and AI word classification may process personal data in the USA. Any transfer only takes place where an adequacy decision applies to the respective recipient , in particular a certification under the EU-US Data Privacy Framework , or where appropriate safeguards under Art. 46 GDPR exist, in particular EU standard contractual clauses. Switzerland is covered by an adequacy decision of the EU Commission.
We only use technically necessary cookies and local storage, in particular for login/session, language, display settings and, where applicable, beta access. This storage is required to provide the service you have expressly requested (§ 25(2) TDDDG); a consent banner is therefore not required.
We store account and learning data until your account is deleted. Server and security logs are generally kept for up to 30 days and then deleted or anonymised, unless longer storage is required to investigate abuse, attacks or malfunctions.
Providing your email address, password and technical session data is necessary to use the account; without this data no user account can be provided. Using the AI-assisted word classification is optional.
There is no automated decision-making within the meaning of Art. 22 GDPR.
Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21). You can delete your account yourself in the settings; otherwise an email to info@pathtowords.com is sufficient. You also have the right to lodge a complaint with the competent supervisory authority (for Hamburg: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit).