Privacy & your data

Chunkible is a small project, run by one person. This says exactly what is stored, who else sees it, and how to have it deleted.

How to delete your data

In the app: Settings → “Request account deletion”. You confirm once, and your account is deleted within 7 days. You get an email when it is done.

Or email privacy@chunkible.com from the email address you signed in with and ask for deletion. No reason needed.

Your account and everything associated with it is removed: your practice record, session history, review log, settings, any problems you reported, and your purchase records, both ours and RevenueCat's. It is done by hand, within 7 days of your request. Backup copies expire within 30 days of that.

Deleting your account does not cancel an Apple subscription. Only you can cancel it, with Apple: Settings, then your name, then Subscriptions, on your iPhone or iPad. If yours is still renewing, the app tells you so before you delete. Apple keeps its own record of what you bought.

You can also clear your practice for a single language yourself at any time, without deleting your account: Settings → “Reset data for this language”.

What is stored, and why

• Your email address. It is your account. There is no password. Held by Supabase, our sign-in provider.
• Your practice record. How many times you have drilled each chunk and sentence, your review schedule, and a log of each Test answer with its timestamp, whether you got it right, and how long you took. This is what makes the spaced repetition work, and it is also how we find which sentences people find hard, so the course can be improved.
• Your session history. Date, mode, module, number of reps and how long you practised.
• Your settings. Voice, theme, toggles, whether adjectives about you should agree as masculine or feminine, and a display name if you set one.
• When you open the app, and which module you open. Just the fact and the time, so it is possible to tell whether people who sign up ever get as far as practising. Nothing about what else you do.
• The country you signed up from. A two-letter country code (GB, IT), worked out from your internet connection by Cloudflare the first time you open the app signed in, and then left alone. It tells us whether someone testing the Italian course has Italian around them, which changes how to read what they report. It is recorded once and never updated, so it is not a record of where you go; it is wrong whenever you sign up on a VPN or away from home; and it is a country, never anything narrower.
• Where your account started. One word, ios, android or web: which version of the app you were using the first time you opened it signed in. It decides whether your account needs a subscription, because accounts that start on Android or the web stay free until subscriptions exist there. It is recorded once and never updated, and it says nothing about your device beyond those three words.
• Your purchases, if you subscribe in the iPhone and iPad app. For each subscription: which one it is, when it started, renewed and ends, whether it is in its free trial, whether it will renew or was refunded, Apple's transaction numbers, the price and currency, the country of your App Store account, and whether Apple marked it a test purchase. We keep it because it is needed to give you the subscription you paid for: that is the lawful basis, performance of a contract. Subscriptions exist only in the iPhone and iPad app today, so on Android and the web nothing about purchases is collected.
• Whether your account has access, and why. One of three reasons: a subscription, free access we have given you, or free use because your account started on Android or the web. Each change is logged with the date and the reason.
• Reminders, if you turn them on. The time you chose, and the address your device's notification service gives us to reach it: a push address from your browser, or a device token from Apple on iPhone and iPad. Turning reminders off deletes it.
• Errors. If the app breaks, the last few error messages and your browser version, so it can be fixed.
• Anything you report. When you use the report button, what you write plus the sentence on screen, the app version and your recent activity.

There is no advertising, no tracking across other sites, and no analytics service. Nothing here is sold or shared for marketing, ever.

Nothing listens to you. You say each chunk aloud, and the app never uses your microphone, and it has no way to. The speech you hear is generated from the written sentence, not recorded from anybody.

Who else sees it

• Cloudflare hosts the app and stores your practice record and reports. Like any web host, it processes your IP address to serve requests.
• Supabase holds your email address and sign-in history.
• Resend delivers your sign-in code, so it handles your email address.
• Google signs you in, only if you choose “Continue with Google”. It sees that you are signing in to Chunkible and the Google account you choose, and never anything you have practised. Supabase, above, then holds your email address and Google's account id so that you can sign in again, and an emailed code sent to the same address reaches the same account.
• Cloudflare Turnstile checks that the person starting a no-account demo is not a bot. It runs only when you ask for the demo, sees your IP address and browser, and never sees anything you have practised. Cloudflare's Turnstile Privacy Addendum covers that check.
• Microsoft Azure generates the spoken audio. It receives the sentence text, never anything about you. Audio is cached, so most sentences are never sent again.
• RevenueCat keeps the record of iPhone and iPad subscriptions for us, as our subscription processor. It receives your account's id (a random code, not your email) and Apple's signed record of each purchase, and never your email address or your name. It hears from our server, never from your device, so it does not receive your IP address. From those it keeps your purchases, their prices and the country of your App Store account. Its servers are in the USA, so this record leaves the UK and the EU under the Standard Contractual Clauses, with the UK's International Data Transfer Addendum for users in the UK. RevenueCat's privacy policy says how it handles it.
• Apple sells the subscription. The payment is between you and Apple, under Apple's privacy policy, and we never see your card or your payment details.
• Your device's notification service delivers reminders, only if you turn them on: Apple on iPhone and iPad, and in a browser the one it uses (Google for Chrome and Android, Mozilla for Firefox, Microsoft for Edge, Apple for Safari). A browser's service receives only a signal to wake the app, never the reminder's text; Apple's service on iPhone and iPad carries the reminder's title and text. None of them receives anything you have practised.

What you can do

• Clear your progress yourself at any time: Settings → “reset data for this language”. That erases your practice record for that language, in this browser and on the server, including the session history and review log described above; backup copies of it expire within 30 days, as described under How long it is kept. Four things deliberately survive it: any problem you reported using the report button, because it is a message to us about a sentence rather than a record of you; the bare record that you opened the app and which modules you opened, which is how we tell whether people who sign up ever get as far as practising; your purchase records and your access, which are not about practice; and your account itself. Ask at the address below to have any of them removed.
• Have everything deleted. In the app, Settings → “Request account deletion”, or email privacy@chunkible.com. Your account and all associated data will be removed within 7 days, and you are emailed when it is done. No reason needed. Backup copies (below) expire within 30 days of that.
• Ask what is held about you, at the same address.

How long it is kept

For as long as you have an account. If you ask for deletion it goes; if Chunkible shuts down, the data is deleted with it. Cached speech (generated from the sentence text, never recorded from anyone) is stored by sentence, not by person, and contains nothing about you.

Backups. Your practice record is copied to a nightly backup so it survives a mistake at our end: losing your progress is the one thing here that cannot be undone. Backups are held by Cloudflare with everything else, are never used for anything but restoring lost data, and are kept for up to 30 days and then deleted automatically. So a reset takes effect immediately in the app, a deletion within the 7 days above, and either completes fully within 30 days, once the last backup holding it has expired.

Cookies and local storage

ck_sess keeps you signed in. ck_demo is set only if you try the demo without an account, lasts thirty minutes, and says which language you chose, and nothing else. Neither can be read by scripts and neither is used for tracking. Cloudflare's Turnstile may set a cookie of its own while it runs its check; their Turnstile Privacy Addendum covers it. Your progress and settings are also kept in your browser's local storage so the app works between visits.

Contact

Questions, corrections or complaints: privacy@chunkible.com.

Credits

The celebration animations are Noto Emoji by Google, used under CC BY 4.0.

Last updated 2 October 2026. This is a plain-English summary of a small project, not a lawyer's document. If something here is unclear or looks wrong, please ask.