Privacy
Short version: you can use bSmart without an account and without giving us anything. If you create an account we store your email and your learning progress, nothing more.
Without an account
Your progress (score, streak, badges) lives only in your browser (localStorage). Questions are invented by an AI model running on your own device. The model files are downloaded from Hugging Face and jsDelivr, which see your IP address like any website you visit. We do not set tracking cookies and use no analytics.
The shared question bank stores questions (topic, niche, age group, language) without any link to you. For abuse protection your IP address is kept only as a salted hash for rate limiting and deleted after two days.
With an account
- Email address: to sign you in (a one-time link and a 6-digit code, valid 15 minutes, stored only as hashes).
- Session cookie: strictly necessary, keeps you signed in for 60 days.
- Players and progress: names, avatars and ages you enter for players, answers, XP, badges and goals.
- Questions from the server-side AI (Plus and trial): your topic and niche text is sent to our AI provider (OpenAI) to write questions. Do not enter personal data there. Your email is not sent.
- Learning cards: what you write on a card (ABC list, KaWa, questions) is only sent to our AI provider when you ask for feedback (Plus or trial) and is not stored by us. We only record that a card was played.
- Payments: handled by Stripe. We never see your card details; we store Stripe’s customer and subscription IDs and the subscription status.
Legal basis: performing the contract you enter by creating an account (Art. 6(1)(b) GDPR) and our legitimate interest in running and securing the service (Art. 6(1)(f)).
Where it runs
The site runs on a server of netcup (netcup GmbH, Germany) in the EU, behind Cloudflare (which sees traffic metadata). Emails are sent through our mail provider. Backups of the database are kept for 14 days.
Your rights
You can delete your account and all data in the app (Account → Delete my account). For access, correction or any question write to the address in the imprint. You may also complain to your data protection authority.