Privacy policy

1. Using the service without an account

You can read the study library and practise without creating an account. Guest answers and state choices exist only in the current page memory and are not saved as a learning profile. Hosting providers still process connection data needed to deliver the website, and the backend maintains limited abuse-prevention counters.

2. Account and learning data

If you choose to register, we process your email address, internal account/session identifiers, selected federal state, study preferences, attempts, answers, grading, mistake review and achievements. We use these data to send login codes, save and synchronise your progress, award badges and manage your account. We do not publish your learning profile, send marketing emails or sell these data. Providing an email address is necessary for an account, but not for guest practice.

3. Purposes and legal bases

Processing needed to provide the account and learning functions you request is based on Article 6(1)(b) GDPR. Technical security, abuse prevention, delivery of the website and the limited deletion audit record are based on Article 6(1)(f) GDPR: our interests are a reliable service, protection against attacks and verification of deletion. These interests must be balanced against your rights; you may object where applicable.

4. Necessary cookies and browser storage

The HttpOnly cookies ib-access and ib-refresh maintain login sessions and are set for up to 30 days, renewed when the session refreshes and removed on logout. The immigration-berlin-language cookie remembers your interface language for the browser session. No learning progress or achievements are stored in localStorage or sessionStorage. This application does not load advertising or audience analytics. Security challenges may be loaded when login protection is enabled.

5. Service providers

Vercel hosts the website and backend; requests may pass through its international delivery network. Supabase supplies authentication and the application database, configured in the EU. Supabase sends login emails through Resend, which receives the recipient address and the message, including the one-time code. When enabled, hCaptcha (Intuition Machines, Inc.) processes browser and connection signals to detect automated access. The providers act according to their applicable service and data-processing agreements; their own operational logs are also relevant.

6. International processing

An EU database region does not mean that all infrastructure, email delivery or support is restricted to the EU. International processing by these providers may occur. The operator must maintain the applicable processing agreements and transfer safeguards, such as an applicable adequacy decision or standard contractual clauses. Provider policies are linked below; they do not replace this notice.

7. Retention and deletion

Active account data are retained until you delete the account. Resetting study progress deletes saved attempts, answers, mistake review and achievements, while keeping the account and preferences. Account deletion removes the Auth identity and application profile; if a provider operation fails, access is revoked and deletion is queued for retry by daily maintenance. Abuse counters expire after their time window and are removed by maintenance, within a maximum of 32 days. Temporary email-reservation receipts expire after 15 minutes and are cleaned daily. A limited deletion record containing an internal identifier and timestamps is retained for 30 days after completion, plus the next daily cleanup. Provider logs and any backups follow the applicable contractual retention and rotation cycles; deleting active data does not necessarily erase a backup immediately.

8. Your rights

Subject to the applicable conditions, you can request access, a copy, correction, erasure, restriction, portability or object to processing based on legitimate interests. Contact the operator using the details above; we may request only the verification reasonably necessary to protect your account. You can also delete your account in My account. You may complain to a competent data-protection supervisory authority, including in your place of residence, work or the alleged infringement. A directory is linked below.

9. Automated feedback and AI-assisted content

Answer grading uses the published answer key; badges follow fixed study rules. These practice functions do not constitute official examination results or decisions about employment, residence or citizenship. Some educational translations are AI-assisted and may contain errors. The application does not send your personal learning history to an AI service to generate those texts.

10. Contact and changes

The contact details above identify the person responsible for this website. Use that contact for privacy questions or rights requests. This notice is updated when the service or its data practices change; the date at the top identifies the current text.

Provider policies and supervisory authorities

• Vercel
• Supabase
• Resend
• hCaptcha (Intuition Machines, Inc.)
• European Data Protection Board