Skip to content

Privacy Policy

Last updated: October 2026

Who we are

Klink Languages is a language-learning application operated by Jasper Bloem, trading as Klink Languages (KVK: 88019608), the Netherlands. If you have questions about this policy, contact us at [email protected].

What data we collect

We collect and store the following personal data:

  • Account data — your name, email address, and hashed password.
  • Emails we send you — we email you to confirm your address and to reset your password. Daily practice reminders (the number of words that need review, your progress numbers and a few of your words) are on by default; you can turn them off at any time in Settings.
  • Language preferences — your native language, target language, and daily learning goal.
  • Learning data — your vocabulary decks, individual words, practice sessions, answers, streak count, XP, and mastery scores.
  • Usage data — the number of scans you have performed in a given month.
  • Scan content — when you scan a note or document, the image or extracted text is sent to Anthropic's API for AI processing. This content is not stored on our servers beyond the duration of the request.
  • Security and fraud-prevention data — your IP address and browser/device info at registration, your IP address on every login, and your IP address during active app use (tracked as "last seen"). We use this solely to detect fake accounts and abuse.
  • Signup attribution — the page you signed up from (referrer and landing page) and any UTM marketing parameters, used to understand which channels people sign up through.
  • Analytics data — if you consent via the cookie banner, we use Google Analytics and Microsoft Clarity to understand how visitors use our website and app, including pages viewed, session recordings, and general usage patterns. Nothing is collected before you give consent.

Legal basis

We process your personal data on the basis of performance of contract (Article 6(1)(b) GDPR) for Klink Languages's core functionality, and on the basis of legitimate interest (Article 6(1)(f) GDPR) for the security/fraud-prevention data and signup attribution described above — detecting fake accounts and abuse, and understanding our signup channels, is necessary to keep the service reliable. Daily reminder emails are also sent on the basis of legitimate interest, with an easy opt-out in Settings.

Sub-processors

We share your data with the following third parties acting as processors:

  • Hetzner Online GmbH (Germany, EU) — server hosting and infrastructure. Hetzner privacy policy →
  • Anthropic PBC (United States) — AI processing of scan images and vocabulary generation. Data is transferred on the basis of Standard Contractual Clauses. Anthropic privacy policy →
  • Resend, Inc. (United States; data is stored in Ireland, EU) — sending verification, password reset and reminder emails. Your email address, your name and the content of the email are shared for this purpose. Because Resend is a US company, any transfer outside the EU is based on Standard Contractual Clauses. Resend privacy policy →
  • Email hosting provider — hosts our mailboxes (such as the privacy and feedback addresses). When you email us, your message and email address are stored there.
  • Google LLC (United States) — website and app analytics via Google Analytics, only after you consent via the cookie banner. Data is transferred on the basis of Standard Contractual Clauses. Google privacy policy →
  • Microsoft Corporation (United States) — session analytics via Microsoft Clarity, only after you consent via the cookie banner. Data is transferred on the basis of Standard Contractual Clauses. Microsoft privacy statement →

How long we keep your data

Your personal data is retained for as long as your account exists. You can delete your account at any time via your profile settings, which permanently removes all your data from our systems. Accounts that have been inactive for more than 2 years may be deleted automatically.

Your rights

Under the GDPR you have the right to:

  • Access the personal data we hold about you.
  • Have inaccurate data corrected.
  • Have your data erased ("right to be forgotten").
  • Restrict or object to the processing of your data.
  • Receive your data in a portable format.

To exercise any of these rights, email [email protected]. We will respond within 30 days.

Supervisory authority

If you believe your rights have not been respected, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): autoriteitpersoonsgegevens.nl.

Changes to this policy

We may update this policy from time to time. The date at the top of this page always reflects the latest version.