1. Who is responsible for your data
Polski-testy is a free Polish grammar trainer. The data controller under the GDPR is Aleksei Eliseev, a private individual. For any question about your data, write to elja1989@gmail.com.
2. In short
- You can play without an account. Your settings and test history then stay in your browser.
- If you sign in with Google or Facebook, we keep your name, email, profile picture and results.
- Visit statistics are on only if you allow them. They set no cookies.
- There are no ads. We don’t sell your data and share it only with the services the site runs on.
3. What we collect and why
Without an account. Your settings, sound and recent test history are kept in your browser’s localStorage and never reach the server. Like any host, Vercel sees your IP address and browser details with every request and keeps them in technical logs for a short time. The legal basis is our legitimate interest in keeping the site running and secure (Art. 6(1)(f) GDPR).
Account (Art. 6(1)(b) GDPR: the features you sign in for need this data). When you sign in, Google or Facebook give us your name, email and profile picture, which are refreshed on every sign-in. We also keep your account ID at the provider and the sign-in tokens. Your account stores:
- finished tests: mode, seed, test code, score, accuracy, streaks, lives lost, time and outcome;
- your answer to each item: which item it was, whether you were right, what you typed, how long it took and whether you opened the explanation;
- settings that follow you between devices: difficulty, levels, cases and verb categories, number of questions, lives, seed, auto-advance, theme, language and character.
This is what your history, mistake review, statistics and synced settings are built from.
Sign-in session (Art. 6(1)(b) and 6(1)(f) GDPR). While you are signed in, the database holds a session record: a random token, your IP address and your browser’s user-agent. The token lets the site recognise your browser; the IP address and user-agent are kept for security. A session lasts 30 days and is extended while you use the site.
Visit statistics (Art. 6(1)(a) GDPR, your consent). We use Vercel Web Analytics, and it turns on only after you press “Allow”. It sees the page address, where you came from, your country, browser, operating system and device type. It tells unique visitors apart by a hash of the request that resets every day, and sets no cookies. The site also sends five events: a test started, a test finished, an explanation opened, the difficulty changed and a test link copied. They contain only the mode, the section (cases, verbs or mix) and numbers such as the number of questions, lives and accuracy. Sentences, your answers and the seed are never included. You can withdraw consent at any time under “Privacy settings” at the bottom of the page.
4. Cookies and localStorage
Your browser only stores what the features you use need: language, theme, sign-in and test settings. This does not require consent. Visit statistics store nothing in your browser.
| Name | Purpose | Lifetime |
|---|---|---|
locale | Interface language | 1 year |
theme | Colour theme | 1 year |
character | The character you picked | 1 year |
consent | Your answer about visit statistics | 1 year |
__Secure-better-auth.session_token | Keeps you signed in | 30 days, extended while in use |
__Secure-better-auth.session_data | A copy of the session so pages don’t query the database each time | 1 hour |
__Secure-better-auth.oauth_state | Protects Google and Facebook sign-in from forgery | 10 minutes, during sign-in only |
polski-testy.* (localStorage) | Test and interface settings, sound, when settings were last changed, and up to 200 recent tests | Until you delete it |
You can delete all of this in your browser settings or with “Erase data in this browser” on the data deletion page.
5. Who we share data with
- Vercel Inc.: site hosting and visit statistics.
- Neon: the database that holds accounts, sessions and results.
- Google and Meta: sign-in. Signing in happens on their side and under their terms. They give us your name, email, profile picture, account ID and sign-in tokens.
Vercel and Neon process data on our behalf. We share nothing with anyone else: we don’t sell data, show ads or make automated decisions about you.
6. Transfers outside the EEA
Vercel and Neon are US companies, so your data may be processed in the United States. These transfers rely on the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.
7. How long we keep data
- Your account and everything linked to it: until you delete it. Data is removed from the database at once, and from Neon’s backups automatically when their retention period ends.
- A session: 30 days after its last use. Signing out deletes it.
- Vercel’s technical logs: briefly, under Vercel’s own rules.
- Visit statistics: kept by Vercel in anonymised form.
- Data in your browser: until you delete it.
8. Your rights
Under the GDPR you can:
- find out what data we hold about you and get a copy;
- correct inaccurate data;
- have your data deleted;
- restrict how it is used;
- receive it in a machine-readable format;
- object to processing based on legitimate interest;
- withdraw consent to visit statistics at any time; this doesn’t affect what was counted before.
You can delete your account and everything linked to it yourself with “Delete my data” in your profile or on the data deletion page. For anything else, write to elja1989@gmail.com; we reply within one month.
If you believe we break data protection law, you can complain to the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) or to the authority in your own country.
9. Other services
- The explanation of an item has ChatGPT, Claude and Perplexity buttons. Each opens that service with a ready-made question containing the sentence, the correct answer, its dictionary form and, if you got it wrong, your answer. Nothing is sent until you click; after that, the service’s own terms apply.
- The Buy Me a Coffee button and the Wikipedia links are ordinary links to other sites.
- Your profile picture loads straight from Google’s or Facebook’s servers, so they see that request.
10. Children
You must be 16 or older to create an account, or have a parent’s or guardian’s consent. If you know we hold an account of a child under 16 without such consent, write to us and we will delete it.
11. Changes
If this policy changes, the new version will appear here and the date at the top will change.