Privacy policy
Last updated: July 2026
This English text is a translation. The German version is legally authoritative.
Controller
Leo Köpke, Nernstweg 6, 22765 Hamburg, Germany, info@pathtowords.com.
Principle
We only process personal data insofar as it is necessary to operate, secure and provide the service. We do not use any tracking, analytics or advertising tools, and we do not use personal data as consideration for advertising, tracking or profiling.
Processing, purposes, legal bases
| Data | Purpose | Legal basis |
|---|---|---|
| Email, password (hash), account status | Account | Art. 6(1)(b) GDPR |
| Learning progress, courses/levels, own words/lists, settings, time zone | Learning service | Art. 6(1)(b) GDPR |
| Server logs, IP, user agent | Operation, IT security | Art. 6(1)(f) GDPR |
| Signals from the bot-protection widget, IP | Protection against abuse/spam | Art. 6(1)(f) GDPR |
| Email address | System / transactional emails | Art. 6(1)(b), (f) GDPR |
| Word you enter (only when adding your own word) | AI classification | Art. 6(1)(b) GDPR |
Our legitimate interest (Art. 6(1)(f)) lies in the secure, stable and abuse-free operation of the service, the prevention of automated access and the deliverability of security-relevant system messages.
Recipients (processors, Art. 28 GDPR) , by category
- Hosting & delivery (processing in the USA)
- Database & authentication (servers located in the EU)
- Bot / abuse protection (processing in the USA)
- Sending of system / transactional emails (EU)
- Domain email mailbox (Switzerland)
- AI word classification, only when this feature is used (processing in the USA)
We will provide information on the specific recipients and the respective safeguards on request.
Third countries
Some service providers in the categories hosting/delivery, bot/abuse protection and AI word classification may process personal data in the USA. Any transfer only takes place where an adequacy decision applies to the respective recipient , in particular a certification under the EU-US Data Privacy Framework , or where appropriate safeguards under Art. 46 GDPR exist, in particular EU standard contractual clauses. Switzerland is covered by an adequacy decision of the EU Commission.
Cookies / local storage
We only use technically necessary cookies and local storage, in particular for login/session, language, display settings and, where applicable, beta access. This storage is required to provide the service you have expressly requested (§ 25(2) TDDDG); a consent banner is therefore not required.
Retention
We store account and learning data until your account is deleted. Server and security logs are generally kept for up to 30 days and then deleted or anonymised, unless longer storage is required to investigate abuse, attacks or malfunctions.
Necessity of providing data
Providing your email address, password and technical session data is necessary to use the account; without this data no user account can be provided. Using the AI-assisted word classification is optional.
No automated decision-making
There is no automated decision-making within the meaning of Art. 22 GDPR.
Your rights
Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21). You can delete your account yourself in the settings; otherwise an email to info@pathtowords.com is sufficient. You also have the right to lodge a complaint with the competent supervisory authority (for Hamburg: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit).