In short: Hablena uses no tracking or analytics tools and loads nothing from third parties such as Google Fonts. We only set a cookie when you log in, so that you stay logged in. For a user account we store only what is needed for it.
1. Controller
Nico Christiansen
Neue Str. 62
27576 Bremerhaven
Germany
Email: kontakt@hablena.com
2. Hosting and delivery of the website
This website is delivered via Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When you open a page, Cloudflare processes technically necessary data, in particular your IP address, the date and time of access, the requested address and browser and device information. This data is needed to deliver the website and protect it against attacks.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and fast provision of the website. Cloudflare processes the data as a processor on our behalf. Data may be transferred to the USA; Cloudflare is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR).
3. Cookies and tracking
We do not use analytics, advertising or tracking services. Fonts are loaded from our own server, not from third parties. No social media plugins are embedded.
When you sign up or log in, we set a single cookie (“__Host-hablena_session”). It contains a random session identifier so that you stay logged in, and it expires after 30 days or is deleted when you log out. This cookie is strictly necessary for the login you requested (§ 25 (2) no. 2 TDDDG), so no consent is required. The legal basis for the processing is Art. 6(1)(b) GDPR.
If you turn sounds off in a lesson, your browser remembers this setting in its local storage (localStorage, entry “hablena-sfx-muted”). The entry stays on your device, is never sent to us and only serves to keep the setting you chose (§ 25 (2) no. 2 TDDDG). You can delete it at any time in your browser settings.
4. User account
For a user account we store your email address, optionally your first name, your chosen language, the time of registration and of your last login, and your password. We never store the password in plain text, only as a salted hash (PBKDF2). When you complete lessons, we also store your learning progress: which lessons you completed, your best result, the number of attempts and the time. For your daily goal and streak we store, for each calendar day on which you learned, the experience points (XP) you earned and the number of lessons. The data is kept in a database at Cloudflare (Cloudflare D1), which acts as our processor (see section 2).
Pronunciation in the lessons is generated from the course content (such as “buenos días”) with an AI speech synthesis service, and we store the recordings ourselves. We only send these course texts to the service, never any data about you. If a recording is unavailable, your browser’s speech output may be used instead; depending on the browser, it may send the course text being read aloud to your browser vendor.
The legal basis is Art. 6(1)(b) GDPR, as we need the data to provide the account. You can delete your account yourself at any time under “Your account”. Your account data, learning progress, learning activity and all sessions are then deleted immediately.
To protect against password guessing and mass registrations, we briefly store failed login attempts and registrations, only as an irreversible hash of the email or IP address together with the time. These entries are deleted after 24 hours at the latest. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the security of the accounts.
5. Contact by email
If you contact us by email, we process your details to answer your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract, otherwise Art. 6(1)(f) GDPR. We delete the data once it is no longer needed for handling your request and no statutory retention obligations apply.
6. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). Simply contact us by email.
You also have the right to lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of the Free Hanseatic City of Bremen, which is responsible for us.
7. Changes
As soon as new features such as payments are added, we will update this privacy policy.
Last updated: October 2026