Your data, in plain English

Chuleta is run by Chuleta Labs Ltd, a company registered in England and Wales (company number 17209179). Our registration with the Information Commissioner’s Office (ICO) is being completed this week; the number will appear here.

Questions or requests: hello@chuleta.co.uk

• If you don’t have an account: nothing that identifies you. Your progress is stored only in your phone’s browser. We count anonymous totals (for example, how many words were practised today, and how long answers take) with no ID attached.
• If you save with a nickname: the nickname Chuleta picked for you (never one you type), a scrambled copy of your secret number made with a one-way code, the same word results an account keeps, the words from your sheets, your test dates, and any class you join. One small cookie keeps that phone signed in for up to 400 days. Nothing goes to Clerk. If you type the wrong number 10 times, the nickname locks for an hour.
• If you create an account: your email address, so you can sign in, and the date you confirmed you’re 16 or older. If you sign in with Google, Google passes your name and photo to Clerk, our sign-in company; Chuleta doesn’t use or show them. Your exam year, if you give it. For each word you practise: whether you got it right, nearly, or not yet, when, how long it took, whether you typed or (when voice answers are on) spoke, whether you tapped Show me, and if you pressed “I had it right”. When you sign up, the words you practised as a guest on that phone are copied into your account.
• To pick your next words, your phone sends the state of each word you’ve practised (new, almost, learnt, ready for a check). Chuleta picks your next words automatically from your answers. That’s all it decides.
• Voice answers (switched off for now): when they’re on, a short clip (a few seconds) is sent to OpenAI to turn it into text. We use the text once to mark your answer, then discard it. We don’t store the clip or the text.
• Typed answers: checked on the spot, then discarded. Only the result is kept.
• Photos of your vocab sheet: your phone makes the photo smaller and sends it to our server once. Our server passes it to Anthropic, which reads the Spanish words and their English and sends them back. We never keep the photo and never write it to our logs. Your sheet might show your name, class or school: we ask Anthropic for the words only, and nothing else comes back to us. The same check makes sure the photo is suitable for a school app: if it isn’t, no words come back, and we only count that it happened, with nothing that identifies you. A PDF of the sheet goes to Anthropic the same way. For a Word file, our server takes the text out and sends only the text. Neither is kept or logged.
• Your test date and what it asks for: if you tell Chuleta when your vocab test is, and what it asks (which ways, and whether accents count), that’s kept with the sheet’s words: on your phone, and in your account if you have one, so Home can count down to it.
• The words from your sheet stay on your phone. With a nickname or an account, they’re saved with it, so they’re on any phone you open it on, and deleted when you delete it.
• New words: if your sheet has a word Chuleta doesn’t have yet, ElevenLabs records it so you can hear it. ElevenLabs only gets the Spanish word, nothing about you. We keep the recording with the word, and we may add good words to Chuleta for everyone.
• Your connection’s address: our host Vercel and our sign-in company Clerk see it, as every website does. To stop Chuleta being overused (for example, reading sheets), we keep a scrambled version of it, changed every day, for one day.
• Parents and teachers who write to us: if you send a message through the parents or teachers form, we keep your name, your email (and your school, for teachers) and your message, only to reply to you. The parents form is for adults: students, ask a parent or your teacher to get in touch. Teachers who asked for early access before: we keep your school email, school name and rough number of students, only to tell you about Chuleta for schools.
• Class sheets: a teacher can share a vocab sheet with their class through a short link. Anyone with the link sees the class name, the name the teacher chose to show, the words and the test. If you open it after saving, with a nickname or an account (or save afterwards), you join the class: we record that your nickname or account is in it. Your teacher then sees how many joined, how many practised this week, and, for each word, how many in the class have it learnt, almost or still learning, and how many missed it, with the usual reason (for example, mostly Show me). These totals only appear once at least 5 students have practised the sheet, so no one student’s answers can be picked out. Teachers never see names, emails, what anyone typed, or anything about students who haven’t saved. You can leave a class in Profile; your words stay yours.
• Teachers: we keep your sign-in email (with Clerk), your class names, the name you chose to show students, and the sheets you add. Deleting your account deletes your classes and their sheets.
• Visits: Vercel Web Analytics counts page visits without cookies and without identifying you.

• To provide the service you asked for: your nickname or account, your progress, marking your answers, and reading the vocab sheets you snap.
• Legitimate interests: anonymous counts and security, to keep Chuleta working and improve it. These never identify you.
• Parents and teachers: legitimate interests, to reply to your message. You can ask us to delete it at any time.
• Class totals: legitimate interests, so a teacher can see how their class is doing: totals only, never names or answers, and nothing under 5 students. You choose to join by using your teacher’s link after saving, with a nickname or an account, and you can leave at any time.

These companies process data for us under data processing agreements. They can only use it to provide their service to us.

• Vercel (hosting the website). United States and EU.
• Neon (our database). Stored in London.
• Clerk (sign-in and sign-in emails). United States.
• OpenAI (turning voice answers into text, switched off for now). United States. May keep clips for up to 30 days for abuse monitoring, then deletes them. They don’t use them to train their models.
• Anthropic (reading photos of vocab sheets). United States. Deletes them within 30 days, or keeps them for up to 2 years only if its safety checks flag misuse. They don’t use them to train their models.
• ElevenLabs (recording new Spanish words). Gets the word only, never anything about you.
• Google, only if you choose to sign in with it, handles that sign-in under its own privacy policy.

Where data goes to the United States, it’s protected by the UK’s International Data Transfer Addendum to the EU Standard Contractual Clauses.

• Your account and progress: until you delete your account. Accounts nobody signs in to for 12 months will be deleted, after an email warning.
• A nickname and its progress: until you delete it in Profile. Nicknames nobody uses for 12 months will be deleted (we have no email to warn you, so open Chuleta once a year to keep yours).
• When you delete your account: deleting your account in Profile removes it at once; backup copies are gone within 7 days.
• Voice clips and answer text (voice answers are switched off for now): not kept by us at all. OpenAI’s safety copy: up to 30 days.
• Photos of your vocab sheet: not kept by us at all. Anthropic deletes them within 30 days (up to 2 years only if flagged as misuse).
• Words from your sheets: on your phone until you clear it, or with your account until you delete it.
• Messages from parents and teachers, and teacher early-access details: until you ask us to delete them, or 12 months at most.
• Anonymous counts: kept, as they don’t identify anyone.

We don’t use advertising or tracking cookies. If you sign in, Clerk sets the cookies needed to keep you signed in. If you save with a nickname, Chuleta sets one cookie (chuleta-code) that keeps that phone signed in for up to 400 days; signing out removes it. Without an account, your progress and whether you ticked “I’m 16 or older” are saved in your browser’s local storage on your phone. To pick your next words, your phone sends which words you’ve practised and how they went, with no name attached; nothing is stored with us without a save code or an account.

Chuleta is built for GCSE students. You need to be 16 or older to create an account with an email. Anyone can save with a nickname instead: it holds no name and no email, and nothing about it goes to Clerk. UK law lets you agree to this yourself from 13, but our sign-in company, Clerk, asks for 16. Under 16s can practise and snap a sheet without an account: their progress stays on their phone, and nothing that identifies them is collected.

You can ask for a copy of your data, ask us to correct it, or delete it. You can also object to or pause our use of your data, and get it in a file you can take elsewhere. Deleting your account in Profile removes it at once; backup copies are gone within 7 days. For anything else, email hello@chuleta.co.uk.

Unhappy with how we handle your data? Email us. We’ll confirm we’ve received it within 30 days and tell you what we did. You can also complain to the ICO at ico.org.uk.