This policy covers the Multiverbo website, the Multiverbo app and Premium, the paid plan inside the app. It explains what we collect, why, how long we keep it, who helps us handle it, and the rights you have. We have written it the way we would explain it to a friend; where a legal term matters, it is there too.
The short version
- No ads, no analytics, no trackers. We don’t sell your data, and we don’t share it for marketing.
- No AI in the app. Nothing you write or answer is sent to an AI service.
- The website sets no cookies of its own, and the server it runs on keeps no record of your visits.
- The app stores what it needs to teach you: your account, your progress and review schedule, your own cards and your study history.
- Your typed answers are checked on your device. Only whether you were right reaches us, never the words you typed.
- You can download all of it as one file, or delete your account and everything in it, from Settings, whenever you like. A deletion waits 30 days, in case you change your mind.
- A few providers help us run the service: Cloudflare, an email service and, for Premium, Stripe. Below, we say what each one does with your data.
- Questions and requests go to info@multiverbo.com. You can also complain to the Czech data protection authority, ÚOOÚ.
Who is responsible
Multiverbo is run by Multiverbo s.r.o., a limited liability company (společnost s ručením omezeným), with its registered office at Preslova 72/25, Smíchov, 150 00 Praha 5, company ID (IČO) 30063701, entered in the commercial register kept by the Municipal Court in Prague (Městský soud v Praze), file number C 456666. In data protection terms we are the controller of the personal data described here: we decide why and how it is used.
We have not appointed a data protection officer, because the law does not require one of a company of our size and kind (Article 37 GDPR). For anything about your data, write to info@multiverbo.com. Our other contact details are in the Legal notice.
The website
This part is about the Multiverbo website, https://multiverbo.com: the pages you read before you sign up.
Delivered through Cloudflare
The website runs on Cloudflare’s network (Cloudflare Workers). Cloudflare answers every request to it, receives anything you send, such as a message through the contact form, and shields the site from attacks. To do that, Cloudflare handles the technical details of each request: your IP address, the time, the address you asked for and what your browser says about itself. Cloudflare does this for us, as our processor, only to deliver and protect the site (see Who else handles it).
When Cloudflare’s protection against automated traffic is switched on, it may set one cookie in your browser. It helps tell people from bots, holds nothing that identifies you to us, and expires after 30 minutes without activity. It is strictly necessary to keep the site secure, so the law does not require your consent for it (Section 89(3) of the Czech Electronic Communications Act, No. 127/2005 Coll.).
The legal basis is our legitimate interest in a website that works and stays safe (Article 6(1)(f) GDPR).
No logs, no analytics
The website keeps no log of visits: no record of who opened which page. There is no analytics, no advertising, no tracking pixel, no social media plugin and no fingerprinting. The fonts, images and scripts all come from the website itself, so opening a page never sends a request to anyone else.
If we show a link to our Instagram profile, it is only a link. Nothing from Instagram loads until you follow it, and from then on Instagram’s own privacy policy applies.
Your theme choice
If you press the light/dark switch, your browser remembers your choice, so the next page opens in the same theme. It stays on your device and is never sent to us. Nothing is stored until you press the switch, and you can remove it at any time by clearing the site’s data in your browser. Because it only does what you asked for, it needs no consent (the same Section 89(3)).
The waiting list
The app is not open yet. If you join the waiting list, on the home page or at https://multiverbo.com/waitlist/, we keep your email address and the day you joined, and nothing else: no name, no network address, no time of day. We use it for one thing: to write to you once, when the app opens. We send that email ourselves, through the API of Brevo, our email provider, which receives your address only to deliver it (see Who else handles it). We don’t share it with anyone else, and we don’t send you anything else.
We keep it only because you asked us to (your consent, Article 6(1)(a) GDPR). You can withdraw it at any time by writing to info@multiverbo.com, and we remove your address; that does not change anything we did with it before. We keep the list in a database at Cloudflare, stored in the EU. When we remove an address, Cloudflare’s backups can still restore it for 7 days, and then it is gone. How long an address stays on it is under How long we keep it.
To keep the list from being flooded, the website counts how often each network address sends the form, exactly as for the contact form below: in memory only, for 24 hours or less.
The contact form
The contact form is not open yet. Until it is, a message sent through it is turned away by the website: it is neither delivered nor stored.
Once it opens, it will ask for your name, your email address, a topic and your message. We will use them only to reply to you: on the basis of our legitimate interest in answering the people who write to us (Article 6(1)(f) GDPR), or, when you write about your account or Premium, to deliver the service you have with us (Article 6(1)(b)). Messages will reach our mailbox through our email provider and be kept for 3 years after our last reply.
To keep the form from being flooded, the website counts how often each network address sends it. The count is kept in memory only, never written to disk, for 24 hours or less, and it disappears whenever the server restarts. This happens for every sending of the form, open or not, on the basis of our legitimate interest in protecting it from abuse.
The app
This part is about the Multiverbo app, https://multiverbo.app: the place where you learn. It lists everything the app stores about you. We provide it under our Terms of Service, and we process this data because we need it to give you the service you signed up for (Article 6(1)(b) GDPR), unless a different basis is named.
To create an account you need to give a username, an email address and a password. Without them we cannot give you an account. Everything else comes from using the app.
Your account
- Your username and email address.
- Your password, stored only as an Argon2 hash. We cannot read it, and anyone who stole our database would find it very slow and hard to work out — all the more so if your password is long and used nowhere else.
- When your account was created and when you confirmed your email address.
- Your settings: the language you are studying now and the languages you have taken up, your weekly study rhythm (Off or 1–5 days), and your theme and sound preferences.
- Your time zone, as your browser reports it when you open the app, and when it last changed, so that “today” and “this week” mean your day and your week.
Your learning
- Lesson progress: which of each lesson’s ten steps you have finished.
- For each word you learn: which box of the review schedule it is in, when it is next due, when you last answered it, how often you have answered it right and wrong, and how often it has slipped back to the start.
- A record of each answer: right or wrong, whether you typed it or recognised it, the word’s place in the schedule before and after, whether it changed the schedule, and when you answered. Not what you typed: typed answers are checked in the app, on your device, and only the result is sent. The app uses these records for your statistics. We may also use them, stripped of your name and account details, to check that the review schedule works as intended.
- Study sessions: the mode, the score, how many cards and how long it took. Personal bests in the games.
- Study days: how many cards, sessions and lesson steps you did on each day you studied, per language.
- Your standing in each language (a score from 0 to 100, and the highest band you have reached and when), your XP and what earned it, your achievements, and which band or tier the app last celebrated with you.
When you delete one of your own cards, the records of your answers to it stay with your account, without the card’s words, so that your statistics stay right. They go when your account goes.
Your own cards
The folders and decks you make (with each deck’s name and language), and each card’s front, back, note and example sentence. They are yours: we store them to show them to you, and you can take them with you at any time (see Your rights).
Signing in and keeping your account safe
- A sign-in cookie. When you sign up or sign in, the app sets one cookie so that it knows it is you on each request. It cannot be read by scripts and travels only over encrypted connections. It lasts until you close your browser, and a day at most, unless you tick Remember me on this device when you sign in: then it lasts 30 days from the last time you used the app, so a device you use every week stays signed in. It is deleted when you sign out. It is strictly necessary for signing in, so it needs no consent. On our server the sign-in is recorded with your account’s internal number, your username, when you signed in and a fingerprint of your password hash (so that changing your password ends every other sign-in). That record is deleted when you sign out, and otherwise cleared automatically once the sign-in expires: within a day of your last visit, or 30 days if you asked the app to remember you.
- Codes and links. Email confirmation codes and password reset links are stored only as hashes. A code works for 10 minutes, and a reset link for 60 minutes and once; both are deleted when used, and a daily clean-up removes any that have expired.
- Two-factor authentication, if you turn it on: your authenticator’s secret, encrypted with AES-256-GCM, and your recovery codes, stored only as hashes.
- Limits on attempts. To stop password guessing and floods of requests, our server counts requests per network address, per account and per name typed into the sign-in form. When someone tries to sign up with an address that already has an account, or to move another account to it, we email its owner, and remember that address for 15 minutes so that the notice cannot be used to flood an inbox. We also remember, for an hour, the addresses we have sent a code to confirm a change of email address, so that no address receives more than five in that time. All of this is kept in memory only, for an hour at most, and disappears when the server restarts. Basis: our legitimate interest in keeping accounts and the service safe (Article 6(1)(f) GDPR).
- Server logs. Our server writes short technical logs: errors, and failed sign-in attempts noted by your account’s internal number (or, for a name we don’t know, a short fingerprint of it). Never a password, and never anything you type while learning. They are kept for 30 days, on the same legitimate-interest basis.
The emails we send
Only emails about your account and the service you use:
- About your account: your confirmation code when you sign up, and a welcome once you have; a password reset link when you ask for one, and a notice whenever your password changes; when you change your email address in Settings, a code to confirm the new address and a notice to the old one once it has changed; a notice if someone tries to sign up with your address, or to move another account to it; a notice when two-factor authentication is turned on or off; warnings before a dormant account is deleted; and, when you ask to delete your account, the date it will be deleted and then a confirmation once it is.
- Service notices: changes to our Terms of Service or to this policy and, once Premium is on sale, the confirmation of a purchase, the reminder before a 3-month, 6-month or yearly plan renews, notice of a change to Premium’s price, a Premium Family invitation and the notice when you join or leave one, and our replies when you cancel, withdraw or complain.
- Receipts for Premium payments, if you get them by email, come from Stripe on our behalf.
No newsletters and no marketing. The app’s emails, among them the confirmation code when you sign up and the link when you reset your password, are sent for us by Brevo, our email provider (see Who else handles it). To send one, Brevo receives your email address and the email itself.
On your device
The app keeps a few things in your browser so that it opens fast and works offline:
- A copy of your account details (your username, email address, plan, languages and preferences), so the app can open without a connection. It is cleared when you sign out.
- Your preferences: your theme, the language you are studying and how you like to read stories. For each story, where you left off, which words you have revealed, and that you have seen a one-time note.
- Offline copies of the app itself and of up to 24 audio recordings you have played (each kept for up to 60 days).
- Progress you made while offline, waiting to be sent: kept for up to one day, and sent when you are back online.
None of this is sent anywhere except the waiting progress, which goes to our server. These items serve the offline app you chose to use, so they need no consent. Apart from the copy of your account details, they stay after you sign out, so on a shared device, clear the site’s data in your browser when you are done; clearing it, or uninstalling the app, removes them all.
Premium
Premium is not on sale yet. When it is, payments will be handled by Stripe.
- You pay on Stripe’s page. Your card details go straight to Stripe. We never see or store your full card number.
- What Stripe gets from us: your email address and your account’s internal number, so that the payment is linked to the right account.
- What we keep: your Stripe customer number, the state of your subscription and the date it is paid up to. Stripe also shows us each payment (the amount, the date, and the card’s type and last four digits), which we need for refunds and for our accounts.
- Billing records (what was paid, when, and the VAT) are kept for 10 years, because accounting and tax law require it (Article 6(1)(c) GDPR).
Stripe also uses some payment data on its own account (see Stripe below).
Premium Family
Premium Family gives Premium to the person who pays for it and up to five people they invite (the Terms of Service explain how).
- An invitation. The payer gives us the email address of the person they invite, and we use it to send that person one invitation email. If the invitation is not accepted within 7 days, we delete it, and the address with it. If you received an invitation you did not want, ignore it: nothing else is sent.
- What you see of each other. The payer sees each member’s name and email address. Each member sees the payer’s name and email address and the date the plan is paid up to. Nobody sees anyone else’s lessons, progress, answers, cards or study days.
- Only the payer deals with Stripe. Members’ details are never sent to Stripe.
- Leaving. When a member leaves or is removed, or the plan ends, we delete the link between the accounts at once. Each account and everything in it stays as it was.
You need to cancel Premium before you can ask to delete your account. When your account is deleted, we delete your Stripe customer record too. The billing records the law makes us keep stay for the period above.
Why we are allowed to use it
The GDPR allows personal data to be used only on a legal basis. Ours, in one place:
| What we do | Legal basis |
|---|---|
| Run your account and the app, and deliver Premium | The contract with you (Article 6(1)(b) GDPR) |
| Keep billing records for Premium | A legal obligation: accounting and tax law (Article 6(1)(c)) |
| Send a Premium Family invitation to someone who has not joined yet | Our and the payer’s legitimate interest in passing the invitation on (Article 6(1)(f)) |
| Show the payer and the members of a Premium Family to each other | The contract with each of them (Article 6(1)(b)) |
| Keep your address on the waiting list and tell you when the app opens | Your consent (Article 6(1)(a)), which you can withdraw at any time |
| Protect the website, the app and your account: Cloudflare, limits on attempts, logs, security emails | Our legitimate interest in a safe service (Article 6(1)(f)) |
| Answer the messages you send us | Our legitimate interest in replying (Article 6(1)(f)), or the contract when you write about your account or Premium (Article 6(1)(b)) |
| Check that the review schedule works, using answer records stripped of your name and account details | Our legitimate interest in a schedule that helps you remember (Article 6(1)(f)) |
| Keep a minimal record after you delete your account, and establish or defend legal claims | Our legitimate interest (Article 6(1)(f)) |
We ask for your consent only for the waiting list, the one thing you choose to join. Nothing else we do needs it: there are no cookies beyond the strictly necessary, and no marketing. Where we rely on legitimate interests, you can object (see Your rights).
Who else handles it
A few companies help us run Multiverbo. Each one works for us under a data processing agreement (Article 28 GDPR), for the job below. Where one also uses data for its own purposes, such as its own legal duties, we say so under its name.
Cloudflare
Runs the website and the app on its network (Cloudflare Workers), keeps the waiting list and the app’s database stored in the EU, and protects both from attacks.
- Provider: Cloudflare (Cloudflare, Inc., San Francisco, USA)
- Where: United States, with the website and the app served from Cloudflare’s global network of data centres, including in the EU; the waiting list and the app’s database are stored in the EU
- Safeguard: EU-U.S. Data Privacy Framework certification, and the Standard Contractual Clauses in Cloudflare’s Data Processing Addendum
Delivers the app’s emails (about your account, and about Premium once it is on sale), the one email that tells the waiting list the app is open, and, once the contact form opens, the messages sent through it.
- Provider: Brevo (Sendinblue SAS, Paris, France)
- Where: European Union, on servers in France and Belgium
- Safeguard: Storage stays in the EU; access by Brevo’s US sub-processors is covered by the Standard Contractual Clauses and the EU-U.S. Data Privacy Framework
Mailbox
Holds our mailbox and the messages you send us, by email or through the contact form.
- Provider: Seznam Email Profi (Seznam.cz, a.s., Prague, Czech Republic)
- Where: Czech Republic
- Safeguard: None needed: the data stays in the EU
Stripe
Takes payments for Premium, from the day Premium goes on sale.
- Provider: Stripe (Stripe Payments Europe, Limited, Dublin, Ireland; for Premium sales, its affiliate Sold through Link, LLC, USA, as merchant of record)
- Where: Ireland (EU) and the United States, with Stripe’s support providers in other countries
- Safeguard: Stripe, LLC’s EU-U.S. Data Privacy Framework certification, and the Standard Contractual Clauses in Stripe’s Data Transfers Addendum
Stripe also uses some payment data on its own account, as a controller: to prevent fraud and to meet the financial rules that apply to it. For those purposes Stripe’s own privacy policy applies.
Apart from these, we share personal data only when the law obliges us to, for example with a court or a public authority that has the power to ask for it.
Data leaving the EU
The app’s database and the waiting list are stored in the EU, in Cloudflare’s EU jurisdiction. Cloudflare and Stripe belong to groups based in the United States and may handle some data outside the EU. Where they do, the transfer is covered by the safeguard named for each of them above: the European Commission’s adequacy decision for the EU–US Data Privacy Framework, or the Commission’s standard contractual clauses (Articles 45 and 46 GDPR). You can ask us for a copy of the safeguards that apply.
How long we keep it
| What | How long |
|---|---|
| Your account, progress, own cards and study history | Until your account is deleted: 30 days after you ask, unless you keep it (see below), or until we delete it after 1 year without a sign-in (we email you twice first, so that you can keep it) |
| An account whose email address was never confirmed | Deleted after 7 days |
| A sign-in (the sign-in cookie and its record on our server) | Until you close your browser, and a day at most; 30 days from your last visit if you tick Remember me on this device; ended when you sign out |
| Email confirmation codes and password reset links | 10 and 60 minutes; deleted when used, or by the daily clean-up once expired |
| The app’s counts of attempts | An hour at most, in memory only |
| Your address on the waiting list | Until 30 days after we email you that the app is open, and never more than 2 years after you joined, or until you ask us to remove it |
| The website’s counts of contact form and waiting list sendings | 24 hours or less, in memory only |
| Server logs | 30 days |
| Billing records for Premium | 10 years |
| A Premium Family invitation that is not accepted | 7 days |
| Messages you send us | 3 years after our last reply |
| A record that your account existed and was deleted, and what we wrote to each other about a complaint or a claim | 3 years after deletion, the time in which legal claims can be raised |
| Your theme choice on the website | In your browser, until you clear it |
| The app’s copies on your device | The copy of your account details: until you sign out. The rest: in your browser until you clear the site’s data or uninstall the app (audio recordings up to 60 days, progress waiting to be sent up to one day) |
When you ask to delete your account, we sign you out everywhere and email you the date it will be deleted, 30 days later. Until then nothing is deleted, and you can change your mind: sign in and choose Keep my account. On that date we delete your account and everything in it: your details, progress, cards, answer records, study days, standing and achievements. We then send one last email to confirm it. What remains is only what the law makes us keep (billing records); the minimal record named above; until they are rotated out, server log lines that name your account’s internal number; and the records our providers keep themselves, such as Stripe’s records of your payments and our email provider’s record of the emails it delivered to you.
What we never do
- Sell your data, or give it to anyone for their own marketing.
- Show ads, or let advertising networks, analytics services or social media plugins into the website or the app.
- Send what you write or answer to an AI service. There is no AI in the app.
- Build a profile of you for anything other than your own learning.
- Make decisions about you by automated means that have legal or similarly significant effects on you (Article 22 GDPR).
Your rights
You have these rights under the GDPR, and using most of them takes a minute in Settings:
- See your data (Article 15). Settings → Your data → Download my data gives you your account details, your folders, decks and cards, and the full record of your study, as one file. It leaves out the secrets that protect your account (your password hash, two-factor secret and codes) and a few internal technical fields, such as when your time zone last changed, your current sign-in records and our Stripe reference. Ask us and we send you those too, and anything else we hold about you.
- Take it with you (Article 20). The same file is in a common, machine-readable format.
- Correct it (Article 16). You can change your username, your email address and your preferences in Settings.
- Delete it (Article 17). Settings → Your data → Delete your account deletes your account and everything in it, for good, 30 days after you ask (sign in and choose Keep my account before then to stop it). It asks for your password (and a two-factor code if you use one), so that nobody else can do it for you. If you have Premium, cancel it first.
- Restrict it (Article 18): ask us to pause using some of your data while a question about it is settled.
- Complain. You can complain to the Czech data protection authority, Úřad pro ochranu osobních údajů (ÚOOÚ) (Office for Personal Data Protection), Pplk. Sochora 27, 170 00 Praha 7, https://uoou.gov.cz, or to the authority in the EU country where you live or work (Article 77). We would be glad to hear from you first, but you don’t have to write to us before complaining.
Your right to object (Article 21). Where we use your data on the basis of our legitimate interests — protecting the service, answering your messages, checking the review schedule, keeping a record after deletion — you can object at any time, on grounds relating to your particular situation. We then stop, unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the data is needed for legal claims.
For any request, write to info@multiverbo.com, if you can from the email address on your account, so that we can tell it is you. It costs nothing. We answer within one month; if a request is complex we may need up to two more months, and we will tell you so within the first month (Article 12(3)).
Children
Multiverbo is for people aged 13 and over. When you create an account you confirm that you are 13 or older; we don’t ask for your date of birth or verify it, because that would mean collecting more data about you than we need. We use account data because it is needed to provide the service you signed up for, not on the basis of consent, so the age at which a child can consent to online services on their own (15 in the Czech Republic) does not come into play. If you are a parent or guardian and believe a child under 13 has an account, write to us and we will delete it. Under-18s may buy Premium only with a parent’s or guardian’s permission, which you confirm at checkout; the Terms of Service explain how.
How we protect it
- Everything travels encrypted, over HTTPS.
- Passwords are hashed with Argon2; confirmation codes, reset links and recovery codes are stored only as hashes; two-factor secrets are encrypted with AES-256-GCM.
- A sign-in ends when you close your browser, and after a day at most. If you tick Remember me on this device, it lasts 30 days from the last time you used the app; leave the box unticked on a shared computer. Changing or resetting your password signs out every other device.
- Two-factor authentication with an authenticator app is there for anyone who wants it.
- Limits on attempts protect the sign-in and the forms from guessing and floods.
- Nothing you type while learning reaches our logs.
- The app’s data is stored in the EU.
If a breach of security ever puts your rights and freedoms at high risk, we will tell you without undue delay (Article 34 GDPR).
Changes to this policy
When this policy changes, the new version appears on this page with a new date. If a change affects how we use your data, we will also email everyone with an account at least 30 days before it takes effect.
Contact
Privacy questions and requests: info@multiverbo.com.
By post: Multiverbo s.r.o., Preslova 72/25, Smíchov, 150 00 Praha 5.