Privacy policy

Takes effect

This policy is written in English.

This is what Odyssey for Today keeps about you, why, who else handles it, and how to have it deleted. We show no ads, we do not track you across other apps or sites, we do not sell or share your data, and we load no analytics or outside scripts.

Who we are

Languages for Nomads runs this service. It goes by Odyssey for Today, Curious as Ever and Languages for Nomads. One account works under all of them. "We" in this policy means Languages for Nomads.

What we keep and why

  • Your email address, to sign you in, to send the codes that confirm your address or reset your password, and to send review reminders if you turn them on.
  • Your username, which you choose. We show it in the app and beside any feedback you send.
  • Your password, authenticator key and passkeys, held by Amazon Cognito to sign you in. We never see your password.
  • Your learning: the courses you take, each card's schedule and stage, and for each review when it happened, how many tries and hints it took, and how long. This is how we choose what you review and when. The answers you type are checked on your device and never sent to us.
  • Your settings: language, answer precision, letterforms, notes, and any answers you add as also right. If you have not chosen a language, we keep which of ours your browser asked for.
  • Feedback you send about a card, module or course: the message, what it is about, and your username.
  • Reminders, only if you turn them on: the hours they may come and your time zone, and when we last sent one. For browser notifications, the address your browser's push service gives us, the keys that lock messages to it, the device's time zone, and your browser and system name, so Settings can tell your devices apart. For the iPhone and Android apps, the push token Apple or Google gives the phone, the Amazon SNS address we make for it, and the phone's time zone. For Telegram, the chat number Telegram gives us.

We do not record your IP address ourselves. AWS keeps some records of its own, set out under how long we keep it.

What stays on your device

  • Cookies, all our own and none for tracking: your sign-in (1 hour, and another lasting 7 days, renewed as you use the app, up to 90 days after you sign in), short-lived ones while you sign in or add a passkey (5 minutes) or confirm your email (15 minutes), the page to go back to after signing in (15 minutes), your chosen language (400 days), the outcome of the last form you sent (1 minute), and once reminders are on, which browser or app to stop reminding when you sign out (400 days).
  • Offline copies, so you can review without a connection: your review queue, pages you have opened, and answers given offline until they reach us. Signing out clears the queue and pages; answers not yet sent wait for that account's next sign-in.
  • Small notes: your theme, and which account last used this device.

Clearing this site's data in your browser removes all of it.

Who handles data for us

  • Amazon Web Services hosts the service. Your account and learning are kept in the United States, in AWS's US West (Oregon) region. Pages reach you through Amazon CloudFront. AWS's firewall counts requests from each IP address to fend off abuse and keeps a small sample of them, addresses included, for up to three hours. Amazon Cognito holds your sign-in, and Amazon SES sends our email. AWS works for us under its data processing terms, which bind it to use your data only to run this service and to guard it as this policy does.
  • Push services, if you turn on browser notifications. Each reminder goes through the service your browser's maker runs: Apple, Google, Mozilla or Microsoft. It is encrypted so that only your browser can read it; the push service sees only where and when to deliver it.
  • Apple's and Google's push services, if you turn on reminders in the iPhone or Android app. We hand each reminder to Amazon SNS, which sends it through Apple's push service to an iPhone or Google's Firebase Cloud Messaging to an Android phone, and the phone shows it.
  • Telegram, if you link it. We send reminders to your chat through Telegram's bot service, and Telegram handles them underits own privacy policy. We never keep the messages you send the bot.

Nobody else receives your data.

Services you choose to connect

We may add services you can choose to connect, as Telegram is now. Each is off until you turn it on, and we list it here before it is offered. Once you connect one, what passes through it is also handled under that service's own privacy policy, and you can disconnect it in Settings.

How long we keep it

  • Your account, learning, settings and feedback: for as long as you have an account.
  • The receipt for each review, which stops one answer counting twice: 1 year.
  • A browser notification address: until you turn notifications off, your browser withdraws it, or it fails 8 times in a row.
  • A phone's push token and its SNS address: until you turn reminders off, sign out on that phone, or delete your account, or until Apple or Google withdraws the token or sending fails 8 times in a row.
  • Your Telegram link: until you unlink it or block the bot. A link code lasts 15 minutes.
  • Server logs: 30 days. They name the page or action, the outcome and the time taken. Some lines name your account number, and a failed email names the address it was for.
  • Backups: the database keeps a rolling backup for 35 days, so anything deleted is gone from it 35 days later.
  • If an email to you bounces or is marked as spam, Amazon tells us in a notice naming your address. We delete the notice once it is dealt with.
  • Mail you send to privacy@languagesfornomads.com or support@languagesfornomads.com: held for up to 14 days on its way to us, then deleted.
  • AWS's own records. Amazon Cognito keeps sign-in security events (the time, IP address, device and rough location) for up to two years, and may keep them after your account is deleted. AWS's audit log keeps a record of each sign-in and of a deletion, tied to an account number but not your email, for 90 days.

Deleting your account

Settings > Delete account removes everything kept under your account: your sign-in, passkeys and two-step settings, profile, progress and review history, review receipts, added answers, settings, reminders and devices, and feedback you sent. What is left in backups is gone within 35 days, and from logs within 30 days.

You can also write to privacy@languagesfornomads.com from the address on your account, and we will delete it for you.

Your choices

  • Turn browser notifications, email and Telegram reminders on or off in Settings, and set the hours they may come. Turning one off deletes what it needed.
  • Unlink Telegram in Settings, or block the bot.
  • Add an authenticator app or a passkey for two-step sign-in in Settings.
  • Sign out of every device from Settings.
  • Ask for a copy of what we keep about you, or for it to be put right, by writing to us.

Children

This service is for people aged 13 and over. It is not directed at children under 13, and we do not knowingly collect their data. If we learn that an account belongs to a child under 13, we delete it. To tell us of one, write to privacy@languagesfornomads.com.

Changes

When this policy changes, the new text is posted here with the day it takes effect. If a change widens what we keep or who handles it, we will tell you in the app before it takes effect.

Contact

For privacy questions and deletion requests, write to privacy@languagesfornomads.com. For help with the app, write to support@languagesfornomads.com. Our own emails come from an address that takes no replies.

Home