Privacy policy
Hookabet is a website (hookabet.com) and a learning app (app.hookabet.com) for learning to read new alphabets. This policy explains what we store, why and for how long, and how you can see or delete it. In short: you can learn without telling us who you are. We collect only what the app needs to remember your progress, and you can delete all of it at any time.
Who is responsible: Hookabet (“we”). Contact: hello@hookabet.com.
The website (hookabet.com)
- No cookies and no tracking. We count visits with Cloudflare Web Analytics, which uses no cookies and stores nothing in your browser. It records the page you open, the site you came from, and your approximate country, browser and type of device, and doesn’t follow you across other websites or build a profile of you.
- Likes on memory hooks. When you tap “This helps me remember”, we store which hook you liked and when, together with a random identifier that your browser generates and keeps in its local storage, so that you can take the like back and you don’t count twice. That identifier is not connected to your app account or to anything else about you.
- Abuse protection for likes. To cap how many likes can come from one network per day, we store a one-way hash of your IP address, mixed with a random value that changes every day and is deleted the next day. We never store the IP address itself. After two days the hash is erased as well, and from then on the like can’t be linked to an address.
- Hosting. The site is served by Cloudflare, which processes your IP address and request details to deliver pages and to protect against attacks.
The app (app.hookabet.com)
Your account
When you start learning, the app creates an anonymous account: a random user ID plus the time it was created and last used. We don’t ask for your name or email address.
If you choose “Continue with Google” to save your progress, Google tells us your email address, your name, your profile picture and your Google account ID. We use these only to sign you in on other devices and to show you which account your progress is saved to.
Your learning progress
- the languages you chose (the language you learn in, any other languages you know, the alphabet you are learning);
- for each letter: when you first saw it, how many answers you gave, your current run of correct answers, and when you learned it;
- for each word: its review schedule (calculated by the open-source FSRS algorithm) and each answer you gave: your rating, the direction of the question, and how long you took;
- your totals (XP, letters and words learned).
We use this to run the course: to decide which letter or word comes next and when to review it. In anonymised form, we also use it to find out which memory hooks work best.
Protection against automated sign-ups
The first time you start, Cloudflare Turnstile checks that you are a person and not a bot. Turnstile processes information about your browser and device for this check. See Cloudflare’s privacy policy.
Usage statistics
The app sends usage events (for example “letter learned”, “alphabet completed”, “word session started”) to PostHog, together with your random user ID. These events contain no name or email address. The app doesn’t set analytics cookies or store analytics data in your browser. PostHog receives your IP address with each event and may use it to estimate your country.
On your device
The app keeps your sign-in session and your interface preferences (theme, sound, views) in your browser’s local storage. This is necessary for the app to work. It is not used for tracking.
Who processes data for us
| Service | What for | Data |
|---|---|---|
| Supabase | database and sign-in | account, progress, likes |
| Cloudflare | hosting, website visit counts, CAPTCHA (Turnstile), email routing | IP address, request data, emails you send us |
| “Continue with Google”, only if you choose it | email, name, profile picture | |
| PostHog | usage statistics in the app | user ID, events, IP address |
| GitHub | encrypted daily database backups | everything in the database, encrypted |
Some of these companies process data outside your country, including in the United States. Where the law requires it, the transfer is covered by the European Commission’s Standard Contractual Clauses or an equivalent safeguard.
How long we keep it
- Account and progress: until you delete your account. Anonymous accounts in which no answer was ever given are deleted automatically after 30 days.
- Backups: encrypted backups are kept for 30 days, so data you delete disappears from the backups within 30 days as well.
- Hashed IP addresses for likes: two days. Likes: until the hook is removed.
- Usage statistics: up to one year. Website visit counts are kept by Cloudflare in aggregate.
- Emails you send us: as long as needed to answer you.
Why we are allowed to (legal bases under the GDPR)
- Running the course and your account: performance of a contract, i.e. providing the service you asked for (Art. 6(1)(b)).
- Bot protection, security, abuse limits, usage statistics and website visit counts: our legitimate interest in keeping the service working, safe and improving (Art. 6(1)(f)). You can object at any time.
- Linking Google: your choice to use it.
We don’t sell your data, and we don’t use it for advertising.
Your rights
You can ask us for a copy of your data, ask us to correct it or delete it, ask us to limit how we use it, and object to how we use it. You can also complain to your data protection authority. Deleting your account is built into the app: see Delete your account. For everything else, write to hello@hookabet.com; we reply within 30 days.
Children
Hookabet is not directed at children under 13. If you are under 16, please use it with the permission of a parent or guardian.
Changes
If this policy changes, we update this page and the date at the bottom.