1. Operator and contact
Krista Salazar, a sole proprietor in Randall County, Texas, United States, operates Spanish, Personally. Mail: 4616 Hawk LN, Amarillo, TX 79118, United States. Contact support@spanishpersonally.com about your information, a privacy request or this notice. This notice describes the current web service, its support process and the providers used to operate it.
2. Information and purposes
We use account email addresses, sign-in challenges, local sessions and account references to provide and protect access. A guest browser reference lets guest practice continue in that browser and helps limit misuse. Practice records can include your topics, preferences, sentences, drafts, exercises, feedback, attempts, word lookups, reviews, progress and settings. We use these to deliver requested practice, save your work and personalize later exercises.
Reports can contain text and screenshots you choose to submit. Support email contains what you send and your sender address. Necessary service and security records include delivery status, abuse limits and diagnostic information. For signed-in practice, the app records the result and time of a self-reported eligibility check and the version and time of required Terms acceptance. It does not retain the birth date entered for that check. Teen setup also records U.S. eligibility and a minimal permission record linking the teen account to the granting adult account, its version, grant time and current status. Pending permission codes are stored as hashes, expire after 24 hours and are cleared when used or withdrawn. We use these records to enforce and document permission; they are not a verified family relationship. We use those records to decide whether signed-in practice is available and to document the choice. The guest preview does not request an age check or Terms acceptance; a guest cookie and saved practice can still be created when you choose Try. A restricted case record may be used to review an age correction, child-data concern or other privacy request; opening a case does not itself erase provider or backup copies. Automatic retention warnings and cleanup remain off unless separately announced. Please avoid unnecessary sensitive information, passwords, sign-in codes, payment details and private information about others in submissions.
3. AI tutoring and separate evaluation
Requested exercises and feedback send relevant practice context to OpenAI. The app sets store:false on its Responses requests so a reusable response is not requested. This does not mean OpenAI keeps no other service, abuse-monitoring or legal records. The app uses an operator-controlled OpenAI API project. No special zero-data-retention arrangement has been verified. Turning off optional learning evaluation does not stop the AI processing needed to answer a tutoring request. For teen accounts, relevant input and generated output also go to OpenAI for moderation and a teen-specific content check. The app does not separately log raw safety-check content or category scores. Ordinary saved practice and reports remain subject to the retention and request handling described below. Safety checks are automated and fallible; this is not continuous human monitoring or an emergency service.
Optional learning-effectiveness evaluation is currently off. If we offer it later, we will ask separately before collecting its limited linked events. The prepared design records assessed outcomes, grammar-pattern references, hint and answer-reveal use, timing and relevant version labels without copying sentence or custom-topic text into those events. An internal account link still makes them personal information, not anonymous data. Declining will leave ordinary saved practice, personal statistics and personalized reviews available. If activated, withdrawal will stop new event collection and remove active optional event copies, while narrow choice records can remain for accountability. A later choice will cover future activity, not backfill earlier practice.
4. Hosting, other providers and locations
Cloudflare Workers hosts this website and Cloudflare D1 stores its active app database in the operator's Cloudflare account. OpenAI provides AI-generated exercises and feedback through its API. The previous OpenAI Sites hosting copy and operator-held migration exports remain temporarily for migration verification and recovery; they are not a second active practice service after cutover. Their removal and any provider-held backup copies require separate handling. Cloudflare processes necessary network, operational and security data. Worker observability is disabled in our deployment configuration; this does not disable all provider operational records. We have not enabled Cloudflare Web Analytics in the app.
Supabase provides email authentication and a separate private recovery-record store. Resend delivers account and chosen recap messages. Porkbun forwards support mail to the operator's Gmail inbox. Browser notification services receive a subscription if you choose reminders. These providers and operator-held inbox or export copies have their own records. Provider processing may occur outside your country. We do not promise that all website, database, email or AI processing remains in your country. We do not sell or rent personal information or learning-activity data. We may disclose information when required by law or when narrowly needed to protect the service and rights.
5. Browser data and optional controls
The app uses a short sign-in challenge cookie, a signed-in session cookie and a guest-access cookie. Their configured maximum lifetimes are about 10 minutes, 30 days and 400 days respectively; those browser lifetimes are not a promise about server-side practice retention. Cloudflare may set a bot-protection cookie. Browser storage remembers display, sound, input and recommendation preferences. Clearing browser data can remove access to guest history without deleting its server copy.
Recap emails, push reminders and library contribution have separate choices. Necessary sign-in or account notices are separate from recap permission. Reminders require your notification permission and carry generic text rather than private answers. A labeled affiliate recommendation may take you to Lingopie with referral information, without your app account reference or practice writing in that link. The partner's terms apply after you follow it. Declining optional learning evaluation does not stop necessary hosting, security or provider operational processing.
6. Access, practice deletion and broader requests
Privacy choices lets you download saved practice and settings or delete saved practice. That download is not a complete copy of support, provider or account records. Practice deletion removes active app practice, drafts, settings, reviews, contribution copies and optional evaluation copies, but does not by itself close the identity, remove a separately submitted report, retract an already approved generic library prompt, recall delivered mail or instantly erase backups.
Email support@spanishpersonally.com for broader access, correction, child-data review or full account closure. We will check the requester's authority proportionately, identify the applicable records and any specific reason to retain a narrow record, and explain what we did and any provider or backup limits. Sending a request starts review; it does not instantly erase information. You do not need to accept a new Terms version or join optional evaluation to make a request. Applicable rights and response deadlines depend on the law relevant to the request.
7. Retention, holds and recovery
Saved account practice remains while it is needed for an active account or until you delete it or a specific applicable rule requires earlier action. Automatic 24-month inactive-account warnings and deletion, 90-day guest expiry, and new resolved-report, screenshot, receipt and routine-log cleanup are not active yet. Those periods were approved as implementation plans and will be introduced, if activated, with prospective notice and the safeguards described in a separate retention update. We will not infer an old activity or notice date to shorten an existing person's period.
Some short-lived access and queue records already expire under their own security or delivery rules. Other records, including reports, support-mailbox copies, provider logs and backups, require category-specific handling. Deleting practice removes the active app copy, but an older backup may still contain it. Cloudflare database recovery, retained migration exports and the previous hosting provider can contain older copies. A successful isolated database-copy rehearsal does not establish removal from every provider backup. We do not promise a fixed date when every backup copy disappears. We will describe the active copies removed, known remaining copies and any justified exception when answering a privacy request. A specific legal obligation, active request, security matter or claim can justify a narrow hold with a reason and review date. Recovery records needed to identify later deletion or withdrawal actions are handled separately.
8. Children, teens and notice changes
Signed-in practice serves adults 18 or older and U.S. learners aged 13–17 whose parent or legal guardian grants permission from a separate adult account. Younger children and teens outside the U.S. are not eligible. Age and residence are self-reported; we do not routinely collect identity documents or verify legal guardianship. When the teen age screen explicitly indicates under 13, practice is blocked and a child-data review is opened. Contact support@spanishpersonally.com about suspected child use or incorrect information. Review does not mean every app, provider or backup copy has already been removed.
Teen practice uses the information needed for requested language practice, personalization, safety, security, account access and support. Optional evaluation, library contributions, sharing controls, affiliate recommendations in practice, recap emails and push reminders are unavailable in the initial teen program. Necessary account messages remain separate. These app-level restrictions do not stop necessary hosting, security or provider operational processing. We do not use teen practice writing for targeted advertising or sell it.
The linked adult can see and withdraw their permission but does not receive the teen's private writing through the parent page. A teen can also withdraw permission. Broader access or deletion requests are reviewed proportionately for authority and scope, including the teen's applicable rights. Withdrawal pauses new practice, leaves saved work accessible through privacy controls and creates a recovery record so restoring an older copy does not silently re-enable access. Minimal permission records are retained for accountability and handled with account-closure receipts; the planned four-year receipt cleanup is not active yet. We do not promise immediate deletion from provider backups.
The separate 20-sentence guest preview does not ask for age or Terms agreement. Its answers and feedback can be saved and processed to provide that preview. Teens must use teen setup rather than the guest preview to obtain the program's permission and safety controls. AI assessment is practice feedback, not a credential or a school or employment decision.
We will display the version and effective date of each published notice. We will explain material changes and seek a new choice when required. Updating this notice will not silently turn on optional learning evaluation.