Who is responsible
See the Operator block for the party responsible for QuickSwedish. The company details are still marked for completion.
For privacy questions or requests, contact hello@quickswedish.com. Do not send a password or identity documents in your first message.
Account, learning and security data
- Account: email address, user ID, language, plan status, creation and activity timestamps; a name and profile image where supplied. Password accounts store a password hash, not the plain password. Google sign-in supplies profile and verified email information.
- Authentication: sessions with creation and expiry times; hashed short-lived email codes and attempt counts. Abuse prevention records hashed email/IP identifiers and timestamps.
- Learning: question IDs, correctness, modes and times, practice attempts and results, review scheduling, saved writing or speaking text and self-scores.
- Preferences: selected language, optional learning profile, level, study time, goal and test-date preference; daily plans and completed items.
- Administration: account restrictions, support notes and records of administrative actions where used.
Guest practice and pending answers can also be stored in your browser. Signed-in learning activity is sent to the service for saving. The account flow can automatically import locally saved guest progress after sign-in. See cookies and local storage.
Newsletter and Fika waitlist
The signup endpoint stores an email address, selected language, signup time and a source field. Fika submissions are marked “fika”; general newsletter submissions can have no source value. A later newsletter signup preserves an existing Fika marker.
Joining the list does not buy a plan or give access to Fika. To withdraw your signup or request removal, email us from the address you used. For now, removal requests are handled by email.
First-party traffic recording
The server records page path, language, section, response status, time, country, device category, referring website hostname and a bot flag. For signed-in visits it also stores the account user ID.
It derives a daily visitor hash from the IP address, browser user-agent, day and a secret. Raw IP addresses and full user-agent strings are not stored in the pageviews table, but are processed to create that hash. A hash and account-linked traffic should not be described as anonymous data.
There is no third-party analytics script in the reviewed application. Hosting providers still process requests. Traffic recording runs on the server and does not depend on an analytics cookie.
Purposes and legal bases
Account, session and learning data are used to provide the service you request (performance of the service agreement). Optional newsletter and waitlist signups are used for the updates you request (consent, which you can withdraw).
Security and first-party service measurement serve the operator’s legitimate interests in preventing abuse and understanding service use, subject to your rights and a balancing assessment. A purpose stated here does not make every processing activity necessary. You can object to processing based on legitimate interests.
Service providers and speech features
Cloudflare hosts the application and D1 database. The email-code implementation uses Resend when configured. If you choose Google sign-in, Google processes that sign-in and supplies account information. Paid checkout is not open yet.
Speech recognition depends on your browser and its provider. The browser may send audio to its own recognition service; we cannot promise that audio stays on your device. Text you submit in a signed-in speaking or writing exercise can be saved by QuickSwedish. Fika’s waitlist does not itself record conversations.
This page does not claim EU-only processing or a verified transfer arrangement. Contact the operator for provider and international-transfer details. Those arrangements must be confirmed for the actual production configuration.
Retention and browser copies
Sign-in sessions expire after 30 days and email codes after 10 minutes. Expiry is not the same as deletion of every database record. Logout removes the current server session.
Traffic maintenance removes raw pageview rows older than 120 days when the maintenance routine runs on an admin visit; this is not a guaranteed daily cleanup. Aggregate daily statistics are retained separately.
The implementation has no general automatic deletion schedule for accounts, learning history or newsletter entries. A verified account can be deleted in account settings by confirming its email. That removes the account and related learning records, clears login codes and removes the user ID from pageviews. Newsletter entries and administrative records are separate; contact us about those. Browser storage may remain after logout and can be cleared separately through browser settings.
Your choices and rights
Contact hello@quickswedish.com to request access, correction, deletion, restriction or portability where applicable, or to object to processing. You can withdraw signup consent. We may need to verify that a request relates to your account.
These rights have conditions and exceptions. Read IMY’s explanation of your rights. You can also complain to IMY, Sweden’s data protection authority.