Privacy notice

We process account and secure-session data, learning activity and progress, feedback, payment/subscription administration and technical security logs. PAY.nl, not us, handles card and bank details on its secure page.

We use data to perform the account and contract, provide access, save progress, administer payments and legal records, prevent abuse and improve the service. Bases are contract, legal obligation and legitimate interest; consent is used only where genuinely required.

Providers are Neon (database), Vercel (hosting/logs), Cloudflare R2 (lesson audio), PAY.nl (payments) and Mailgun (transactional email). Appropriate processor terms and transfer safeguards are used. We do not sell data.

Account, settings and progress: while the account exists. The raw answer log: 365 days; the delivery records for practice batches: 37 days — both are deleted automatically after that, while your progress stays. Sessions expire within 30 days; security and rate-limit logs within a day. Financial records: seven years, as Dutch tax law requires.

We use access controls, encrypted connections and password hashing. Passwords and session tokens never leave our systems — not even in a data export.

Access and portability: download your complete data as a JSON file yourself, from "Your data" in your profile — no request needed. You can change your display name in the profile directly.

Erasure, restriction or objection: write to info@codifire.com. On erasure we scrub your account beyond recognition and delete your learning data; an account with no payments is removed entirely. What stays is the financial record, including the email address on the invoice — we are required to keep it for seven years (GDPR Art. 17(3)(b)).

Note that some of your progress is also stored in your own browser. Clear the site data in your browser to remove that copy.

We may verify your identity and will respond within the legal period. You may also complain to the Dutch Data Protection Authority.