Privacy
We process as little personal data as possible. This page explains what we store, when, and why.
Short version
This platform is self-hosted and runs without ad networks or third-party cookies. We only store what is required to operate your account and your learning progress. The one exception is a visitor count that also runs on our own server - it is loaded only if you explicitly agree, and until then it is not part of the page at all.
What data we process
On sign-up: email address, optional display name, password hash (bcrypt). During use: learning progress (read concepts and tutorials, quiz results) and selected topic interests. Server-side, standard logs are collected (IP address, user agent, timestamp) and rotated after 30 days.
Login & sessions
We use Auth.js with JWT sessions. The session cookie is HTTP-only, SameSite=Lax, and expires after 30 days. Passwords are stored only as bcrypt hashes - we cannot read them.
Cookies and local storage
Technically required and therefore set without consent: the sign-in session cookie (authjs.session-token, 30 days), your cookie decision itself (ba_consent, 6 months), the learning journey you last opened (active_journey, 60 days) and - for teachers only - presentation mode (presentation_mode, 60 days). If you arrive through a member's referral link, you also get a purpose-bound referral cookie (ba_ref, HTTP-only, SameSite=Lax, 30 days). It holds nothing but the referral code, is consumed at sign-up and deleted afterwards - no usage profile, no sharing. The parcours exercises create short-lived session cookies that keep one exercise run apart from another; they end with the run. We do not store a language preference - the language is part of the address (/de/… and /en/…). Anything beyond that we ask about first: see the next section.
Free downloads and follow-up mail
Requesting a report on a /gratis page means leaving an email address. We store it to deliver that specific file (Art. 6(1)(b) GDPR) - no account is created, and the address is never passed on. Delivery requires a confirmation by mail; without it, nothing else happens. Only those who additionally consented to updates while requesting (Art. 6(1)(a) GDPR) receive a one-off invitation to create an account, one day after confirming - and occasional updates later on. Every one of those mails carries an unsubscribe link that works without signing in; withdrawal takes effect immediately, going forward. Delivery of the requested download is unaffected.
Visitor counting - only with your consent
We use Rybbit, a web analytics tool we host ourselves on our own infrastructure (rybbit.ynotbetter.com). No data is passed to third parties, there is no cross-device profile and there are no advertising identifiers. Rybbit sets no cookie, but it does place a random identifier in your browser's local storage (rybbit-visitor-id) in order to attribute repeat visits to the same browser. That is a storage of information on your device within the meaning of § 25 (1) TDDG and therefore requires consent - legally it is treated exactly like a cookie. The analytics script is therefore only loaded after you have agreed. Without consent it is not part of the page we serve at all; it isn't merely disabled, it is never transmitted. The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDG). You can withdraw at any time via “Cookie settings” in the footer of every page. On withdrawal we delete the identifier from your browser immediately. Withdrawal takes effect for the future; the lawfulness of processing carried out until then is unaffected. On pages whose address carries a one-time token (password reset, email confirmation) we never load the script - not even if you have consented.
Hosting
The platform runs on our own self-hosted infrastructure behind Cloudflare for edge protection. Cloudflare briefly processes connection metadata as part of its protection features.
Third parties in the playground
Inside the playground you optionally call LLM APIs (Anthropic, OpenAI, or local models). When you use this feature, your input is forwarded to the chosen provider - nothing is sent automatically.
AI-generated content
We say so openly, because it is the very subject this site is about: a large share of the texts, explanations, graphics and videos on this platform was created with generative AI - mostly with Anthropic's Claude models. The application itself, meaning the source code of this site, was built with Claude Code as well. AI does not publish here unsupervised. Every published piece is curated, reviewed and released by humans; editorial responsibility rests with the provider named in the imprint. For editorially controlled content the exemption in Art. 50(4) of Regulation (EU) 2024/1689 (EU AI Act) therefore applies - we disclose it anyway, because we consider transparency the more appropriate stance. The news section is a special case: it is filled by an agent that researches and writes its items autonomously. Treat those posts as AI-generated, even though they are proofread before publication. The machine-readable marking of AI-generated output required by Art. 50(2) EU AI Act is the duty of the providers of the AI systems we use, not of us as the operator of this platform. Wherever you work with AI yourself - in the playground, in the terminal, in the exercises - that is apparent on the spot; which data goes to which provider is covered in the section "Third parties in the playground".
Your rights
You have the right to access, correction, deletion, and portability of your stored data at any time. Reach out informally by email to the address listed in the imprint.