Privacy Policy

Last updated: 28 October 2026

> Courtesy translation. Only the French version is legally binding: Politique de confidentialité. In the event of any discrepancy, the French text prevails.

---

In accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and French Act no. 78-17 of 6 January 1978 as amended (the *Informatique et Libertés* Act), this policy describes how Ismael Dubuc, publisher of the derja.fr website and of the Derja mobile apps (iOS and Android), collects, processes and protects users' personal data.

---

1. Identity of the data controller

Ismael Dubuc

Sole trader, SIREN 939 197 554

30 Allée Sidney Bechet, 93430 Villetaneuse, France

Email: contact@derja.fr

---

2. Data collected and purposes

2.1 Account creation and authentication

Signing in with Google or Apple. If you choose “Continue with Google” or “Continue with Apple”, that service receives your sign-in request, and we receive from it the email address of your account (with Apple, this may be a relay address that hides the real one) and a technical identifier. We never receive your Google or Apple password. Google and Apple process this sign-in under their own privacy policies.

2.2 Learning profile

Leaderboard. Derja offers a seasonal leaderboard between learners. Visible to other users, and nothing else, are: your username, your chosen character, your number of stars for the season and your tier. No other data is exposed: not your email address, not your progress, not your subscription status.

At any time, from the Leaderboard screen, you may choose to stop appearing under your username: you then appear as “Anonymous”, keeping your rank and your stars. A season's stars are reset at the start of the next one; only the best tier reached is kept.

Partner code. Partner content creators promote Derja through a personal link (an address ending in ?p= followed by their code) or a code to enter at sign-up. If you arrive through such a link, its code is kept on your device for 30 days at most (see the cookie policy). If you create an account within that period, the code is recorded once only on your profile, then erased from the device; it cannot be changed afterwards. It is used to work out what we owe the partner for the subscriptions taken out by the accounts they brought in. The partner receives only totals (number of sign-ups and subscriptions), never any data about you.

2.3 Subscriptions and payments

On the derja.fr website, payments are processed by Stripe. Card numbers never pass through our servers. We receive from Stripe the customer and subscription identifiers, the status and dates of the subscription, and the email address entered at payment (used only to link the payment to the right account).

In the iOS and Android apps, purchases are processed by Apple (App Store) or Google (Google Play), under their own terms. We receive no banking data. To know which subscription is active, we use the RevenueCat service, which receives your user identifier (UUID, never your email) and the history of your in-app purchases (product, dates, store country, status).

Access offered by an organisation. If your employer, your school or another organisation offers you Derja+ (the “Derja for teams” offer), it sends us your email address so that we can switch on access for your account. We only confirm to it that access is switched on and until when: we pass it no data about your use of Derja (progress, activity, results). Legal basis: our legitimate interest in switching on the access the organisation has paid for you (art. 6.1.f GDPR).

2.4 Audience measurement

To understand how Derja is used and to improve it (for example: which exercises are abandoned, how many visitors come back after a week, which version of a screen works best), and to detect technical errors in it, we use the PostHog measurement tool, hosted in the European Union (Frankfurt, Germany). It is active on the website and in the mobile apps.

This measurement is limited to Derja's audience and follows the conditions set by the CNIL for audience measurement trackers exempt from consent (deliberation no. 2020-091 of 17 September 2020, article 5). That is why no window asks for your consent:

• it is never linked to your account: PostHog receives neither your user identifier, nor your email address, nor your username, and no personal profile is built there. Your device is represented only by a random identifier of its own;
• it uses no data taken from your account (subscription plan, level, progress, answers to exercises);
• it serves only to produce anonymous statistics, compiled from a random identifier specific to the device, never linked to your account: its data is neither sold, nor used for advertising, nor shared with ad networks, nor cross-referenced with your account data.

What is sent to PostHog:

Your IP address is not stored by PostHog. There is no session recording, no heatmap, no survey and no automatic capture of clicks.

Legal basis: our legitimate interest in measuring Derja's audience and fixing its errors, in order to improve it (art. 6.1.f GDPR).

Durations. The random identifier is kept on your device for 13 months at most from the first measurement, without ever being extended by your visits; it is then erased and replaced by a new one. Events are kept for 12 months by PostHog.

Objecting to this measurement, at any time and without giving a reason:

• with the “Anonymous audience measurement” switch, in My account (“Data & legal” section) or at the bottom of the home page, available without signing in;
• or by turning on your browser's Do Not Track or Global Privacy Control setting: measurement then stays off.

PostHog is then no longer loaded, nothing more is sent to it, and the random identifier is erased from your device. The choice is remembered on the device where you made it. Data sent since 14 October 2026 is linked only to this random identifier, never to an account: we cannot find it for a particular person, and therefore cannot provide it to you or erase it individually. It disappears at the end of its retention period.

Events sent from the website before 14 October 2026, and those sent by versions of the mobile app released before the October 2026 update, were still linked to your account identifier, using a cookie. They remain with PostHog until they expire, 12 months at most. For this data, you can write to us at contact@derja.fr: we delete in PostHog the data linked to your account. Updating the app is enough to switch to the new measurement: the old identifier is erased from the device on first launch.

2.5 Notifications

If you enable reminders:

• in the mobile app, these are local notifications scheduled on your device; no third-party service is involved;
• on the website, your browser sends us a notification subscription address, which we store in your profile. Reminders go through your browser's notification service (Google for Chrome, Apple for Safari, Mozilla for Firefox).

Legal basis: your consent, given by allowing notifications. You can withdraw it at any time in your device or browser settings.

Email reminders. If you ask for them (at the end of a session or in My account), we email you when your streak is at risk and, on Sundays, with your weekly recap. They use your email address, the interface language, your streak and your progress figures (words and phrases learned, reviews). They are sent by Resend (see section 3).

Legal basis: your consent, given by turning these emails on; we keep the date and the place where you gave it. You can withdraw it at any time, in one click, with the "Unsubscribe" link in every email or in My account. As soon as you unsubscribe, this data is no longer used to email you; your choices stay recorded until your account is deleted.

2.6 Contact and support

If you write to us at contact@derja.fr, we process your email address and the content of your message in order to reply (legitimate interest). The mailbox is hosted by Zoho in the European Union.

2.7 Technical data

2.8 Storage on your device (cookies and local storage)

Our domain places no cookies. Derja uses only the local storage of your browser or of the app, for:

• making the service work: the session token (sign-in), your settings (language, sounds, microphone, voice), a copy of your profile and progress waiting to be synchronised when you play offline, the interface state (messages already seen, guided tour) and the website files kept in cache. This data does not leave your device, except progress, which is sent to your account;
• audience measurement: the random PostHog identifier, its creation date and your choice to object, if any (see 2.4);
• the partner code of the link through which you arrived, if any, for 30 days at most (see 2.2).

The details are in our cookie policy.

---

3. Recipients and processors

Your data is accessible only to the publisher and to the providers below, each for its sole role. No personal data is sold to third parties.

Apple and Google also act as independent data controllers for sign-in with their account and for purchases made in their stores. Browsers' notification services (Google, Apple, Mozilla) deliver the website's reminders.

---

4. Retention periods

Account deletion. You can delete your account at any time from My account (see the Account deletion page). Your profile and your sign-in account are then erased immediately from our database. A Derja+ subscription taken out on the website is cancelled at the same time, with no refund for the current period; a subscription taken out on the App Store or Google Play must be cancelled by you in the store. Your data may remain for up to 3 months in the backups, before being overwritten. Audience measurement data is not linked to your account, except data sent before 14 October 2026 or by an old version of the app (see 2.4). Invoices are kept for the period required by law.

---

5. Your rights

Under the GDPR, you have the following rights:

• Right of access (art. 15): obtain a copy of your personal data
• Right to rectification (art. 16): correct inaccurate data
• Right to erasure (art. 17): request deletion of your account and your data
• Right to restriction (art. 18): temporarily suspend a processing
• Right to data portability (art. 20): receive your data in a machine-readable format
• Right to object (art. 21): object to processing based on legitimate interest, in particular audience measurement (switch described in 2.4)
• Withdrawal of consent: at any time, for processing that relies on it (notifications)
• Post-mortem directives: define what happens to your data after your death

To exercise your rights: contact us at contact@derja.fr stating your identity and the nature of your request. We will reply within one month (extendable to 3 months for complex requests).

You also have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés): https://www.cnil.fr, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

---

6. Data security

The security measures in place include in particular:

• Encryption of communications (TLS 1.2 or higher)
• Password hashing (bcrypt, via Supabase Auth)
• Database access restricted by Row-Level Security (RLS): each user can access only their own data
• Compartmentalised API keys (public key on the client side, secret key on the server side only)
• Database hosted by Supabase on AWS (Stockholm), server and backups hosted by Hetzner in Germany, in ISO 27001-certified data centres

---

7. Minors

The Derja service is intended for people aged 13 or over. We do not knowingly collect personal data from minors under 13. In France, a minor under 15 must have a parent's consent for processing based on consent (notifications). If you are a parent or guardian and believe your child has provided us with data without your consent, contact us at contact@derja.fr.

---

8. Changes to this policy

Any substantial change will be announced in the app or by email to users who have an account, and will be visible on this page with a new update date.

---

9. Contact

For any question about this policy or the protection of your personal data:

Email: contact@derja.fr

Mail: Ismael Dubuc, 30 Allée Sidney Bechet, 93430 Villetaneuse, France