Privacy Policy
1. Introduction and Scope
Shadowee is owned and operated by Soroush Karami, an individual based in Chicago, Illinois, USA, who is the controller of your personal data ("we," "us," "our"). You can contact us at [email protected].
This Privacy Policy describes how we collect, uses, stores, and discloses information about you ("User," "you") when you use the website shadowee.org, the Shadowee app for Android (distributed through Google Play), and any related services (collectively, the "Service").
By creating an account or using the Service, you acknowledge that you have read and understood the practices described in this Privacy Policy. If you do not agree, please stop using the Service.
This Privacy Policy is incorporated by reference into our Terms and Conditions. Capitalized terms not defined here have the meanings given in the Terms and Conditions.
2. Information We Collect
2.1 Information You Provide
- Account data: your email address, password (stored only as a salted hash, never in plain text), first name, last name, and date of birth. Date of birth is used to confirm you are at least 13; sign-ups from anyone younger are rejected before any data is stored.
- Preferences: your practice level and translation language, if you choose them.
- Your lists: lessons you star, and any custom lesson packages saved to your account (name, description, and the lessons in them).
- Communications: messages you send us, for example by email to support.
Your email address, password, name, and date of birth are required to create an account, because we need them to provide and secure it; without them you cannot create an account, but you can still use Shadowee in guest mode (Section 2.4). Everything else is optional.
2.2 Information Collected When You Use the Service
- Learning activity (when you are signed in): which lessons you have started or completed; your last lesson; recently played lessons; your progress through the learning Path; practice time per day for each practice mode; and XP, level, daily goal, streak, and streak-shield data.
- Sign-in records: each time you sign up or sign in, we record the date and time, your IP address, your browser or device user agent, the page you came from, and whether the website was opened as an installed web app.
- Session data: to keep you signed in, we store a record of each active session with its IP address and user agent. For the mobile app we also store the platform (Android or iOS) and the version of the app you are running, so we can support older versions and tell you when an update is required.
- Website analytics: on the website (not in the app), we use Cloudflare Web Analytics to count page views and measure performance in aggregate. It does not use cookies and does not build a profile of you across websites.
2.3 Microphone and Voice
Some Path exercises let you record yourself and hear the recording back. The microphone is used only while such an exercise is running, only after you grant your browser's or device's microphone permission, and you can turn it off at any time. Your recordings stay in your device's memory, are played back to you once, and are then discarded. They are never uploaded to us or anyone else, and never saved — so we do not receive or process your voice. We do not collect biometric identifiers or voiceprints. In the Android app, the microphone permission is requested for this feature only.
2.4 Using Shadowee Without an Account
You can use many lessons without signing in. In that case your progress and settings are stored only on your device (in your browser or the app), and nothing about your activity is sent to our servers.
2.5 Security and Abuse Prevention
- Website: sign-up, sign-in, and password-reset forms are protected by Cloudflare Turnstile, which examines signals from your browser and your IP address to tell people and bots apart.
- Android app: instead, the app uses Google Play Integrity to confirm that requests come from the genuine Shadowee app on a genuine Android device. We check the result and do not store it.
- Rate limits: we count requests per IP address and per email address to slow down password guessing and abuse.
2.6 Information We Do Not Collect
- Voice recordings, voiceprints, or other biometric identifiers (see Section 2.3).
- Payment card or financial information. The Service is currently free and has no payments.
- Your contacts, location, photos, or advertising identifiers.
- Sensitive information such as government ID numbers, health data, or biometric identifiers.
3. How We Use Your Information
- Operate the Service: create and manage your account, keep you signed in, and sync your progress across your devices.
- Personalize your learning: track completed lessons, calculate XP and streaks, continue your Path, and suggest lessons that match your level.
- Communicate with you: send password-reset codes and answer your messages.
- Improve the Service: understand aggregate usage, fix bugs, and develop new content.
- Keep the Service secure: prevent unauthorized access, bots, and abuse, and enforce our Terms and Conditions.
- Comply with legal obligations: respond to lawful requests or as otherwise required by law.
We will not use your information for purposes materially different from those above without giving you notice first and, where required by law, asking for your consent.
No automated decisions or profiling. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects, and we do not profile you for advertising. The only automatic check is the age check at sign-up (Section 10).
4. Legal Bases for Processing (GDPR / EEA and UK Users)
If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data on these legal bases:
- Performance of a contract: providing the Service you signed up for (account, progress sync, sign-in).
- Legitimate interests: security and abuse prevention (sign-in records, Turnstile, Play Integrity, rate limits) and improving the Service through aggregate analytics, where these interests are not overridden by your rights.
- Legal obligation: processing required to comply with applicable law.
5. How We Share Your Information
We do not sell, rent, or trade your personal information, and we do not share it for advertising.
5.1 Service Providers
We use the following providers to run the Service. They may process your data only on our behalf and only as needed to provide their services:
| Provider | What they do | Data involved |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, content delivery, Turnstile bot protection, Web Analytics | All account and activity data we store; IP address and browser signals |
| Resend | Sending password-reset emails | Your email address and the reset code |
| Google LLC | Google Play Integrity and Google Play in-app updates (Android app only) | App and device integrity signals, processed by Google under its own privacy policy |
5.2 Legal Requirements
We may disclose your information if required by law, or in the good-faith belief that disclosure is necessary to comply with a legal obligation, protect the rights or property of the Operator, prevent fraud or illegal activity, or protect the safety of users or the public.
5.3 Business Transfers
If the Service is involved in a merger, acquisition, asset sale, or bankruptcy, your information may be transferred as part of that transaction. We will notify you by email or with a prominent notice in the Service before your data becomes subject to a materially different privacy policy.
5.4 Aggregated Data
We may share aggregated statistics that cannot reasonably be used to identify you (for example, the number of lessons completed across all users).
6. Cookies and Storage on Your Device
| What | Purpose | How long |
|---|---|---|
shadowee_refresh cookie (website only) | Keeps you signed in. Secure and inaccessible to page scripts (httpOnly). | 45 days, renewed while you use the Service |
| Browser local storage | Your settings (theme, level, language, microphone choice), lesson progress, and — without an account — all your progress | Until you delete your account or clear your browser or app data (signing out removes your progress but keeps your settings) |
| Session storage | Short-lived copies of your account data so pages load faster (each refreshed after 10 minutes); in the app, also the current 15-minute sign-in token | Until you close the tab or app |
| Android Keystore (app only) | Keeps you signed in; the sign-in token is encrypted with a key that never leaves your device | Until you sign out or delete your account |
We do not use advertising or tracking cookies, and our analytics (Cloudflare Web Analytics) is cookieless. Our fonts are hosted on our own servers, so loading a page does not contact Google.
Do Not Track and Global Privacy Control. We do not track you across other websites or apps, and we do not allow third parties to do so through the Service. Because there is no such tracking to switch off, the Service works the same whether or not your browser sends a Do Not Track or Global Privacy Control signal.
7. Data Retention
- Account and learning data (profile, preferences, progress, Path progress, practice time, XP and streaks, starred and recent lessons, lesson packages): kept while your account exists.
- Sign-in records: kept for 12 months, then deleted automatically.
- Sessions: a website session ends after 45 days without use, and an app session after 90 days without use; at most 10 app sessions are kept per account. Ended sessions are deleted automatically within about a week.
- Password-reset codes: valid for 30 minutes (or 5 attempts), deleted once used, and expired codes are deleted automatically within about a week.
- Aggregated statistics: may be kept indefinitely because they cannot be linked to you.
Deleting your account: you can delete your account at any time from the Profile page on the website or in the app (step-by-step instructions: Delete your account). Your account, profile, preferences, progress, Path progress, practice time, XP and streak data, starred and recent lessons, lesson packages, sign-in records, sessions, and any pending password-reset code are permanently and immediately deleted from our database, and Shadowee's data is cleared from the device you delete from. Deletion cannot be undone. Our providers' own operational logs and backups are removed on their standard schedules.
8. Data Security
- Passwords are stored only as salted hashes, never in plain text.
- All data is encrypted in transit with HTTPS.
- Sign-in tokens are short-lived, rotated regularly, and stored securely (an httpOnly cookie on the website, the Android Keystore in the app). A stolen, already-used app token is detected and ends that session.
- Bot protection (Turnstile, Play Integrity) and rate limits guard sign-in and password reset.
- Access to personal data is limited to what is needed to run the Service.
No method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we will notify affected users and the relevant authorities of a data breach as required by applicable law.
9. International Data Transfers
The Service is operated from the United States and runs on Cloudflare's global network, so your information may be processed in countries other than your own, which may have different data protection laws. For users in the EEA/UK, where data is transferred to countries without an adequacy decision, we rely on appropriate safeguards such as Standard Contractual Clauses offered by our providers.
10. Children's Privacy
The Service is not directed to children under 13. We check the date of birth at sign-up and reject anyone under 13 before storing any of their data. If you believe a child under 13 has given us personal data, please contact us (Section 14) and we will delete it promptly.
11. Your Rights and Choices
| Right | How |
|---|---|
| Access | Most of your data is visible in the app (Profile, Path, progress). For a full copy, email us. |
| Correction | Edit your name and date of birth on the Profile page, or email us. |
| Deletion | Delete your account yourself on the Profile page (website or app) — see Section 7 — or email us. |
| Portability | Email us and we will send your data in a structured, machine-readable format. |
| Restriction / Objection | Email us to restrict or object to processing based on legitimate interests. |
| Microphone | Turn off the microphone in the Path, or revoke the permission in your browser or device settings, at any time. |
We respond to requests within 30 days (or sooner where the law requires) and may ask you to verify your identity first.
California residents (CCPA/CPRA): you have the right to know what personal information we collect and disclose, to delete it, and to correct it. In the past 12 months we have collected the categories described in Section 2 — identifiers (email, name, IP address), personal characteristics (date of birth), and internet or app activity (learning activity, sign-in and session records) — directly from you and from your device, for the purposes in Section 3, and disclosed them only to the service providers in Section 5. We do not collect sensitive personal information as defined by the CCPA, and we do not sell or share personal information for cross-context behavioral advertising. We will not discriminate against you for exercising these rights.
EEA/UK residents: you also have the right to lodge a complaint with your local data protection authority.
12. Emails
We currently send only transactional emails: password-reset codes you request. We do not send marketing emails or newsletters. If we ever offer them, we will ask for your consent first, and every such email will include an unsubscribe link.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time and will revise the "Last Updated" date at the top. For material changes, we will give more prominent notice — such as an in-app notice or an email to your registered address — at least 14 days before the change takes effect. Continuing to use the Service after the effective date means you accept the updated policy.
14. Contact Us
For questions, concerns, or requests about this Privacy Policy or your personal data, contact the controller:
Soroush Karami, Chicago, Illinois, USA
Email: [email protected]
Website: shadowee.org
We aim to respond to all inquiries within 30 days.