Privacy notice
Last updated: 27 September 2026
Who is responsible
TereTere is responsible for the personal data used to provide this service. Use the support options in the app for privacy requests.
Account and billing data
We store your name, email address, email-verification status, sign-in sessions, and subscription status on the server. Email accounts use a salted password hash, not a readable password. If you choose Google sign-in, we receive your Google account identifier, name, and email to authenticate you.
Stripe receives checkout and payment details. TereTere sends your email and account reference to connect a subscription to your account, and stores Stripe customer and subscription identifiers and payment-related status. Card numbers and security codes are entered on Stripe’s pages, not stored by the TereTere app.
Your learning stays on your device
Lesson progress, saved words, preferences, writing drafts, transcripts, and practice results are saved in this browser’s local storage. They are not currently synchronised to your TereTere account on the server. Export them in Settings before changing devices or clearing browser data. Anyone using the same browser profile may be able to see locally saved learning data.
Speaking recordings are held temporarily in the page for playback. TereTere does not upload these recordings to its own server. Optional browser speech recognition may send audio to your browser provider for transcription. You can practise without recording and type a transcript instead.
TereTere Chrome extension
When you turn on translation in the TereTere Chrome extension, it sends only the readable public text you choose to translate to TereTere's translation service. It does not send the page URL, browsing history, form entries, passwords, cookies, private messages, or payment information. The extension ignores editable fields, dialogs, hidden content, and browser internal pages.
TereTere forwards that text to DeepL to produce an Estonian translation. The text is used to return the requested translation and is not used for advertising or to build a profile of you. DeepL may process technical request information under its own privacy terms. The extension stores its display preferences and unsynchronised saved words in Chrome on your device. If you choose to connect a signed-in TereTere account, words you explicitly save are synchronised to your TereTere vocabulary.
When you request neural lesson audio, TereTere sends only published TereTere course text—not your drafts, saved personal phrases, transcripts, or recordings—to Microsoft Azure AI Speech to generate the audio. Microsoft may process technical request information such as an IP address. Generated course audio may be cached so that the same published text does not need to be generated again.
Vocabulary photos from Unsplash
When you view a vocabulary photo credited to Unsplash, your browser loads it directly from Unsplash’s image service. Unsplash may receive technical request information, such as your IP address and browser details, and may record photo views. TereTere does not include your account email, learning answers, drafts, or recordings in the image URL. Other lesson images are served by TereTere.
See Unsplash’s privacy policy for details about its processing.
Why we use data
- Providing accounts, authentication, subscription access, and requested support: performance of our contract with you.
- Protecting accounts, investigating errors, and preventing misuse: our legitimate interest in operating a secure, reliable service.
- Keeping records required for accounting or responding to legal obligations: compliance with applicable law.
Account information is needed for sign-in and paid access. Learning scores provide practice feedback; they are not used to make decisions with legal or similarly significant effects.
Cookies and service providers
The essential teretere_session cookie keeps you signed in for up to 30 days. Browser storage retains learning data and a cached account summary. These are used for app functionality. The app does not include advertising trackers.
Hosting and database services process server records; the configured email delivery service processes verification emails; Stripe handles payments; Google processes sign-in when selected. These services may also process technical information such as IP addresses. Microsoft Azure AI Speech generates optional neural lesson audio, and browser speech services have their own processing practices.
Read Microsoft’s privacy statement, Stripe’s privacy notice and Google’s privacy policy for their processing, locations, and transfer safeguards. Contact us for information about the providers and safeguards applicable to your account.
How long data is kept
Local learning data remains until you clear it from the browser. Signing out does not erase it. The sign-in cookie expires after 30 days; verification codes expire after 15 minutes. Expiry does not mean every related server record is immediately erased.
Account records are retained while needed to provide your account. After a deletion request, records may still be retained where necessary for accounting obligations, security investigations, or legal claims. Retention depends on the purpose and applicable legal requirements; contact support for the records and periods relevant to your request.
Your choices and rights
You may request access, correction, deletion, portability, or restriction of your personal data, and object to processing based on legitimate interests where applicable. Contact support using your account email. We may need to verify your identity and normally respond within one month, subject to lawful extensions.
Use Settings to export your local learning data, and your browser’s site-data controls to remove it. Removing local data does not delete the server account or cancel a subscription. Tell support if you want account deletion and cancellation as well.
You can complain to the Estonian Data Protection Inspectorate or your local data-protection authority.