Privacy Policy

1. Summary

• You can practice without an account. In that case we store your progress only in your own browser.
• If you create an account we store your email, an optional display name, a securely hashed password (or your Google account ID) and your practice history.
• We use Google Analytics to understand how the site is used, and Google Sign-In if you choose to log in with Google.
• We do not sell your personal data and we do not use it for advertising.
• You can ask us at any time to export, correct or delete your data.

2. Data we collect

Account data — when you sign up with email:

• Your email address (stored in lowercase) and, if you provide one, a display name of up to 120 characters.
• Your password, which we never store in readable form. It is turned into a one-way hash with the scrypt algorithm and a random salt; nobody at Dictationly can see it.

Account data — when you sign in with Google (button or One Tap):

• Google shares your email address, whether it is verified, your name and a unique Google account ID with us. We do not receive your Google password, contacts or any other Google data.
• We accept only Google accounts with a verified email address. If an account with the same email already exists, your Google login is linked to it.

Practice data — when you are logged in:

• Which exercises you start and finish, your position in each exercise, scores, accuracy, number of checks, hints, reveals and skips, and approximate active time.
• What you typed when you pressed “Check”, and the mistakes found, so we can show your history and “words you often miss”.
• Lessons you create with the Dictation Generator (title, text, voice and level settings).

Technical data:

• A session cookie that keeps you logged in (see section 6).
• Server logs that our hosting provider keeps for security and debugging, which may include your IP address, browser type, the page requested and the time.
• Usage statistics collected by Google Analytics, such as pages viewed, approximate location (country/city), device and browser type, and how you arrived on the site.

We do not intentionally collect sensitive data (such as health, religion or political views). Please do not put such information in your display name or in lessons you create.

3. How we use your data

• To create and secure your account and let you log in.
• To save your progress, let you resume exercises, and show your history, dashboard and statistics.
• To rank learners on the public leaderboard (see section 5).
• To answer your messages and send essential service emails (for example about your account or changes to these policies). We do not send marketing email without your consent.
• To understand which exercises are useful and improve the content and the site, using aggregated statistics.
• To prevent abuse, fraud and attacks, and to comply with legal obligations.

We process your data because it is necessary to provide the service you asked for, because of our legitimate interest in keeping the service secure and improving it, because of your consent (for example for analytics where required), or because the law requires it.

4. Practicing without an account

If you are not logged in, your progress (completed exercises and unfinished sessions) is saved in your browser’s local storage on your own device. It is not sent to our servers. If you later create an account or log in, the site offers to import that progress into your account. Clearing your browser data removes it.

Text you paste into the Dictation Generator without saving it as a lesson is processed in your browser. Your browser may use its built-in or online voices to read it aloud.

5. What other people can see

• Leaderboard: logged-in learners appear with their display name, points, number of completed exercises and practice time. If you have not set a display name, we show only the first two letters of your email followed by dots (for example “tu•••”) — never your full email.
• Lessons you create are private by default. If you make a lesson public, anyone with its link can open and practice it.
• Everything else — your email, history, mistakes and statistics — is visible only to you.

You can change your display name at any time on your Account page.

6. Cookies and local storage

• dl_session (essential): a random token that keeps you logged in. It is HTTP-only (not readable by scripts), sent only over HTTPS, and expires after 30 days or when you log out. We store only a hash of this token on our side.
• Local storage (functional): guest progress and completed exercises, as described in section 4.
• Google Analytics cookies (analytics): names starting with _ga, used to count visits and distinguish visitors. They are set by Google on our behalf.
• Google Sign-In: if you use the Google button or One Tap, Google may set its own cookies according to Google’s privacy policy.

You can block or delete cookies in your browser settings. Blocking the session cookie will prevent you from staying logged in; blocking analytics cookies does not affect practice. You can also install the Google Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout).

7. Who we share data with

We do not sell, rent or trade your personal data. We share it only with service providers that help us run the site, and only as much as they need:

• Hosting and database providers that store the site and its data.
• Google LLC, for Google Sign-In and Google Analytics.
• Our dictionary service, which receives only the word you click on to look up — never your account information.

We may also disclose data if required by law, by a court or a competent authority, or to protect the rights, property or safety of our users or of Dictationly.

Some of these providers may process data outside your country, including outside Vietnam. When this happens we rely on providers that offer appropriate safeguards for personal data.

8. How long we keep data

• Account and practice data: for as long as your account exists. When you delete your account, we delete your profile, sessions, practice history and private lessons within 30 days, except where the law requires us to keep something longer.
• Login sessions: until you log out or 30 days pass. Changing your password signs out all your other devices.
• Server logs: for a short period, normally no longer than 90 days.
• Analytics data: for the retention period configured in Google Analytics, after which Google deletes it.

9. How we protect your data

We use HTTPS for all traffic, hash passwords with scrypt, store only hashes of session tokens, use HTTP-only cookies, check the origin of every request that changes data, and limit access to the database. No system is perfectly secure, so please use a strong, unique password. If we become aware of a breach that affects your data, we will notify you and the relevant authorities as required by law.

10. Your rights

Depending on where you live (for example under Vietnam’s personal data protection law or the EU GDPR), you have the right to:

• be informed about how your data is processed;
• access your data and receive a copy of it;
• correct inaccurate data — you can change your name and password yourself on the Account page;
• delete your data and your account;
• restrict or object to certain processing, and withdraw consent you gave earlier;
• complain to the competent data protection authority.

To use any of these rights, email [email protected] from the address linked to your account. We may ask you to confirm your identity and will reply within 30 days at the latest.

11. Children

Dictationly is open to learners of all ages, but an account may only be created by people aged 13 or older. Learners under 16 (or under the age of digital consent in their country) need the permission of a parent or guardian, who should help them create the account. If you believe a child has given us personal data without the required permission, contact us and we will delete it.

12. Changes to this policy

We may update this policy when the service or the law changes. The date at the top shows the latest version. If a change is significant, we will tell logged-in users on the site or by email before it takes effect.

13. Contact

For any question about privacy or your data, write to [email protected].