Privacy Policy

Who we are

The Spanish Blitz (thespanishblitz.com) is an independently run Spanish vocabulary-practice service and is the controller of the personal data described here. You can reach us about anything in this policy at privacy@thespanishblitz.com.

What we collect

We keep this deliberately small. In total:

• Account details — your email address, display name, chosen role (student or teacher), avatar and password (stored only as a salted hash, never in readable form).
• Study data — which cards you studied, whether each answer was correct, incorrect or marked hard, quiz scores, accuracy, XP and streaks.
• Spoken-answer transcripts — the text of what speech recognition heard. Text only; we do not store audio.
• Content you create — vocabulary sets and cards, classrooms, and Missions you assign.
• Subscription status — whether an account is on the Free or paid plan, and the Stripe customer reference. We never receive or store your card number.
• Basic technical data — the standard server and CDN logs (IP address, browser, requested page) needed to serve the site and to detect abuse.

Why we use it, and on what basis

We use account and study data to run the service: to sign you in, save your progress, show it back to you, and — if you have joined a classroom — show your completion of assigned Missions to that teacher. This is processing necessary to perform our agreement with you.

We use technical logs and abuse signals to keep the service secure and working, and we show advertising to fund the Free plan. These rest on our legitimate interest in operating a secure, sustainable service.

Where the law requires consent — in particular for personalised advertising cookies for visitors in the EEA and the UK — we rely on consent, which you can withdraw at any time.

Voice recognition

Voice practice is optional and only ever starts after you grant microphone permission in your browser. Audio is processed to produce a transcript and is not stored by us; only the resulting text is saved, so you can see how a past answer was scored.

Depending on your browser, recognition may be performed by that browser's own service (for example the Web Speech API in Chrome), in which case the audio is handled under that provider's privacy policy rather than ours. You can revoke microphone permission at any time in your browser settings; the rest of the site continues to work without it.

Text-to-speech

Spanish audio playback uses your browser's built-in speech synthesis. No audio is generated on, or sent to, our servers.

Advertising and Google AdSense

The Free plan is supported by advertising served through Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this and other websites, to cap how often you see the same ad, and to detect invalid activity.

Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and other sites on the internet. We do not have access to the contents of those cookies, and we do not share your account details, study data or transcripts with advertisers.

You can opt out of personalised advertising at google.com/settings/ads, or opt out of participating vendors at aboutads.info/choices and youronlinechoices.eu. Members on a paid plan do not see ads at all. Our Cookie Policy has the full breakdown.

Payments

Paid memberships are processed by Stripe. Stripe collects and handles your payment details directly under its own privacy policy; we receive only the fact that a subscription is active, its plan, and a customer reference. We never see or store your full card number.

Who else sees your data

We do not sell personal data. It is shared only with:

• A teacher whose classroom you have chosen to join — they see your display name and your progress on the Missions they assigned, not your email password or activity outside their classroom.
• Google, as our advertising provider, in the manner described above.
• Stripe, as our payment processor, for paid memberships.
• Our hosting and infrastructure providers, which store the data on our behalf and may not use it for their own purposes.
• Anyone we are legally required to disclose to, such as in response to a valid legal request.

Children

The Spanish Blitz is used in classrooms, so some users are children. We do not knowingly create accounts for children below the age of digital consent where they live without the involvement of a parent, guardian or teacher, and we do not use children's data to build advertising profiles.

If you are a parent or teacher and believe a child has an account that should not exist, write to privacy@thespanishblitz.com and we will remove it and its data.

How long we keep it

Account and study data are kept for as long as the account is open, so your progress and streaks survive between sessions. When you delete your account we delete the account and its study data, and remove or anonymise associated records; backups age out on their normal cycle. Technical logs are kept only for a short operational period. Records we must retain for legal or accounting reasons, such as payment records, are kept for the period the law requires.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or provide it in a portable form. Where we rely on consent, you can withdraw it at any time. Some of this you can do yourself: profile details are editable on the Profile page, and an account can be deleted from there.

For anything else, write to privacy@thespanishblitz.com from the address on the account and we will respond within one month. If you are in the EEA or the UK and are unhappy with our response, you have the right to complain to your national data protection authority.

Security

The site is served over HTTPS, passwords are stored only as salted hashes, and access to production data is limited to those who need it. No system is perfectly secure, but if a breach ever affected your data we would notify you and the relevant authority as the law requires.

International transfers

Our infrastructure and service providers may process data outside your country, including in the United States. Where data is transferred out of the EEA or the UK, it is done under the safeguards those laws require, such as the European Commission's standard contractual clauses.

Changes to this policy

We update this policy when the service changes. The "last updated" date above always reflects the current version, and material changes will be announced on the site.

Contact

Privacy questions and data requests: privacy@thespanishblitz.com. Anything else: support@thespanishblitz.com.