Privacy Policy

The data controller for personal information processed in connection with Sagmal is Dong Yang. Contact: support@getsagmal.com.

Postal address and further operator details are set out in our Imprint.

We collect personal information that you provide and that is generated when you use the service:

• Account information: email address, password (stored hashed) when you register with email, profile details from Google if you sign in with OAuth, email verification status, and account timestamps such as creation and last sign-in.
• Rehearsal attempts: when you finish a scene we store the scene identifier, the choice identifiers you selected for each turn, and a timestamp, linked to your account. Closing feedback is optional: if you choose to answer, we may also store yes/no answers about rehearsing and the textbook-versus-street comparison, a 1–5 practicality rating for the dialogue, and an optional private note. These answers are not published.
• Website and service logs: IP address, user-agent, and similar technical data for security and reliability of the website and API.
• Website analytics (optional): if you consent via the cookie banner, Google Analytics may collect page views, approximate location, device/browser type, and similar usage metrics on the website.

Where available, German rehearsal audio (clerk and learner lines) is pre-generated with an AI voice provider and loaded from object storage hosted by DigitalOcean in Frankfurt. When pre-generated audio is not available for a line, your browser’s built-in speech synthesis (speechSynthesis) API is used as a fallback. Loading audio from object storage is a normal static-file request (your IP is visible to DigitalOcean as with any CDN or file host). If you choose Speak in Settings, the optional speak-mode recall uses your browser’s speech recognition (SpeechRecognition / webkitSpeechRecognition) so you can say the natural line instead of typing it. Sagmal does not receive or store microphone audio on its servers. When Speak is on, your browser or its vendor may process speech to produce text; you can switch back to Type at any time in Settings.

We use personal information to provide and operate Sagmal, authenticate users, send verification and password-reset emails, store rehearsal attempts, provide support, improve reliability and security, prevent abuse, and comply with legal obligations. We do not sell your personal information.

Where the EU General Data Protection Regulation (GDPR) applies, we process personal information on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — to create your account, verify your email, sign you in, and provide rehearsals.
• Legitimate interests (Art. 6(1)(f)) — security, fraud prevention, abuse prevention (including signup protection), and service integrity, balanced against your rights.
• Consent (Art. 6(1)(a)) — where you choose OAuth sign-in, analytics cookies (Google Analytics), or other optional processing; you may withdraw consent at any time via Cookie settings on the website.
• Legal obligation (Art. 6(1)(c)) — where we must retain or disclose information to comply with law.

We share personal information with processors and providers only as needed to run the service:

• Resend — transactional email for address verification and password reset (see Resend’s privacy notice).
• Cloudflare Turnstile — on email signup only, to prevent bots and abuse (see Cloudflare’s privacy notice).
• Google — if you use Google sign-in.
• Google Analytics — if you consent to analytics cookies on the website (see Google’s privacy notice).
• Hosting and infrastructure providers — to operate the website, API, and database, including capacity in the European Union where practicable.

We use essential browser storage required for Sagmal to function. Sign-in tokens are kept in your browser’s sessionStorage (keys such as sagmal_access_token and sagmal_refresh_token) until you close the tab or sign out. Essential storage cannot be disabled through the cookie banner.

We store your cookie consent preference in a first-party cookie (sagmal_cookie_consent) and a localStorage mirror (sagmal-cookie-consent) so we can remember your choice across visits. Consent preferences are kept for up to one year or until you change them.

We also store practice preferences in localStorage (sagmal-recall-mode for whether the natural line is hidden or visible, sagmal-recall-input for type versus speak, and sagmal-typing-help for optional typing aids such as word highlighting). These settings stay in this browser only and are not synced to your account.

Optional analytics cookies are off by default and are only used if you opt in via the cookie banner or Cookie settings. If you opt in, we load Google Analytics 4 (GA4) to measure how visitors use the website. Analytics scripts are not loaded until you accept analytics (or save preferences that include analytics). You can change or withdraw this consent at any time using “Cookie settings” in the website footer.

Service infrastructure and processors may process data in the European Economic Area and outside the EEA. Where personal data is transferred outside the EEA, we use appropriate safeguards such as Standard Contractual Clauses where required. Analytics data processed by Google may also be processed outside the EEA subject to Google’s safeguards.

We retain account and rehearsal-attempt data for as long as your account is active and as needed to provide the service and support. Technical logs are kept as needed for security and reliability. Cookie consent preferences are stored for up to one year or until you change them. There is no paid billing product at launch, so we do not retain payment records.

Under GDPR (where applicable), you may have the right to access, rectify, erase, restrict, or port your personal data, to object to certain processing, and to withdraw consent. You also have the right to lodge a complaint with a supervisory authority in Germany (for example, the data protection authority of the federal state where you live or where we are established).

To exercise these rights, contact us at support@getsagmal.com.

We implement technical and organizational measures designed to protect personal information, including encryption in transit and access controls. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

Sagmal is intended for users aged 18 and over. We do not knowingly collect personal information from children under 18. If you believe we have collected such information, please contact us so we can delete it.

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Material changes may be communicated via the website or email where appropriate.

Privacy questions: support@getsagmal.com.