Privacy Policy

Last updated: 12 July 2026

This Privacy Policy explains what information LearnSpanish500 (“the Service”, “we”, “us”) collects, why we collect it, and the choices you have. The Service is a free tool for learning the 500 most common Spanish words. You can use the entire course without an account and without giving us any personal information.

1. Using the Service without an account

No account is required. When you use the Service without signing in, we do not create any record of you on our servers, we do not set any tracking cookie, and your learning progress is never sent to us. Your progress (which words you have practised and which steps you have unlocked) is saved only in your own browser, using its local storage. It stays on your device and is under your control: clearing your browser's site data for this website erases it.

2. Information we collect when you create an account

Creating an account is optional. It exists so that your progress is saved centrally and follows you from one device to another. If you choose to create one, we collect and store:

• Your username. Chosen by you, and shown to no one but you.
• Your email address. Used to identify your account and to support account-recovery features. We do not send you marketing or promotional email.
• Your password. We never store your password in a readable form. It is kept only as a salted, one-way cryptographic hash (scrypt), which cannot be reversed back into your password.
• Your learning progress. The per-word recall history and the steps you have unlocked, so the course can resume where you left off.
• Account timestamps. When the account was created and roughly when it was last used.

We do not collect your name, date of birth, location, payment details, or any special categories of personal data.

3. Technical data

Like any website, our server receives your device's IP address with each request. We use it only, and only momentarily, to protect the Service, for example to rate-limit sign-in attempts and to prevent automated abuse. Your IP address is held in memory for this purpose and is not written to our database, is not linked to your account, and is not used to profile you. We do not run any analytics or visitor-tracking on the Service.

4. Cookies and local storage

We keep our own use of cookies to the minimum needed to run the Service:

• Session cookie. Set only after you log in, so that you stay signed in as you move between pages. It is removed when you log out.
• Sign-in hint cookie (ls500_signed_in). A small, non-sensitive flag that lets a returning browser know it should ask whether you are logged in. It holds no personal data.
• Local storage. For signed-out learners, progress is stored in your browser under the key ls500-guest, as described in section 1.

These are strictly necessary for the Service to work and do not require consent. Advertising cookies set by Google are covered separately in section 6. We do not use any analytics or tracking cookies of our own.

5. How we use your information, and our legal bases

For visitors in the European Union, the United Kingdom, and other regions with similar laws, we rely on the following legal bases under the GDPR:

• To provide the Service and save the progress of account holders across devices. Legal basis: performance of a contract, or steps taken at your request.
• To keep the Service secure and prevent abuse. Legal basis: our legitimate interest in a safe, working service, and compliance with legal obligations.
• To show advertising that funds the free Service. Legal basis: your consent for personalised advertising where consent is required, and otherwise our legitimate interest in showing non-personalised advertising.

6. Advertising

The Service is supported by advertising and uses Google AdSense, an advertising service provided by Google, to display ads.

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this Service or to other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this Service and/or other sites on the Internet.
• You may opt out of personalised advertising by visiting Google Ads Settings. You can also opt out of a third-party vendor's use of cookies for personalised advertising by visiting www.aboutads.info, or, in Europe, www.youronlinechoices.eu.
• Where the law requires it, including for visitors in the European Economic Area, the United Kingdom, and Switzerland, we ask for your consent through a consent message before personalised ads are shown, and you can change or withdraw that choice at any time.

To learn how Google handles data from sites that use its services, see How Google uses information from sites or apps that use our services and the Google Privacy Policy.

7. Other third-party services

• Google Fonts. Our pages load a typeface from Google's font servers. To deliver the font, your browser's request, including its IP address, is visible to Google as a technical necessity. See the Google Privacy Policy.
• Pronunciation (text to speech). The “listen” feature uses your browser's built-in speech capability (the Web Speech API). Depending on your browser, the text to be spoken may be processed on your device or by your browser vendor. We do not control, receive, or store anything from this feature.

8. Sharing your information and international transfers

We do not sell your personal data, and we do not share it with third parties except the service providers named in this policy (Google, for fonts and advertising) and where we are required to do so by law. Those providers may process data on servers located outside your country, including in the United States. Where that happens, the transfer is covered by the safeguards those providers put in place, such as the European Commission's standard contractual clauses.

9. Data retention and deletion

If you have an account, we keep your account data for as long as the account exists. You are in control of it at any time from the Account page:

• Reset progress erases your recall history and re-locks the course, while keeping your account.
• Delete account permanently removes your login and all of the progress associated with it. This cannot be undone.

If you use the Service without an account, there is nothing for us to retain; you can remove your locally saved progress at any time by clearing your browser's site data.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, export, or restrict the processing of your personal data, and to object to certain processing or withdraw consent. You can exercise the most important of these rights immediately and without asking us:

• Sign in to view and correct the information held in your account.
• Use Delete account on the Account page to erase your data.
• If you are a signed-out learner, clear your browser's site data to remove everything stored on your device.

If you are in the European Union and believe your data has been handled improperly, you also have the right to lodge a complaint with your national data protection authority. In Spain this is the Agencia Española de Protección de Datos (AEPD), www.aepd.es.

11. How we protect your data

• Passwords are stored only as salted scrypt hashes and are never held in readable form.
• When served over HTTPS, connections are encrypted with TLS and protected by HSTS.
• A strict Content Security Policy limits what can run on our pages, and every form submission is protected against cross-site request forgery.
• Each learner's progress is accessible only through their own account.

No method of transmission or storage is ever completely secure, but we take reasonable measures to safeguard your information.

12. Children's privacy

The Service is not directed to children under the age at which they can consent to online services in their country (for example, 14 in Spain, and between 13 and 16 elsewhere in the European Union). We do not knowingly collect personal data from children below that age. If you believe a child has provided us with personal data, please use the deletion controls above, and it will be removed.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page, and for significant changes we will make the update reasonably clear. Continuing to use the Service after a change means you accept the updated policy.

14. Contact

The quickest way to act on the data in your account is directly in the Service: open the Account page to review, reset, or permanently delete it. Signed-out learners can remove all locally stored progress by clearing their browser's site data for this website.

A dedicated contact address for privacy questions will be published in this section as the Service grows.