Privacy policy

This is a translation. If it differs from the Datenschutzerklärung in German, the German version applies.

Pauk stores as little as it can: what parents need to sign in, the names they give their children, and what the children have practised. No ads, no tracking, no selling of data. The only thing measured is how fast Pauk responds and where errors happen – without names, email or IP addresses (section 5).

1. Controller

Dennis Lutter, Tarpenbekstr. 84, 20251 Hamburg, Germany
Email: info@pauk.fun

2. Who uses Pauk

Only parents have an account. Children don't sign in: they play through a secret link that their parents create and pass on. Anyone who knows the link can play – the link gives no other access. Parents can replace it with a new one at any time; the old one then stops working.

3. What is stored

Parent account with a passkey. Pauk stores the email address the parent enters and, for each passkey, its public key, its ID, a counter, what kind of device or password manager holds it, and whether it is backed up there. The private key stays on the device or in the password manager; Pauk never receives it. Fingerprint or face are checked by the device alone – none of it reaches Pauk.

Parent account with Google. Pauk receives the parent's name, email address, profile picture URL and Google account ID from Google. Pauk does not store the access tokens Google issues and requests nothing else from Google.

Parents who join together as a family see each other's email addresses and manage the same children.

Links by email. For a sign-in link, Pauk stores the address and a one-time code until the link is used or expires after 15 minutes.

Staying signed in. A cookie keeps the parent signed in. For each sign-in, Pauk stores the IP address and the browser identifier (user agent) to detect misuse. A sign-in expires after seven days without use. Choosing a language at the bottom of the page sets a second cookie that remembers the choice for one year. Pauk sets no other cookies.

Emails. Pauk emails parents: to welcome them or confirm their address, with sign-in links, when someone joins their family, and when a child has mastered a topic. That last email names the child and the topics.

Children. The name parents enter – a nickname is enough. It is personal data, because together with the parent's account and the practice results it points to one particular child. It only appears on the parent pages and in emails to the parents, never on the play link. Pauk does not ask for age, birthday, school, photo or anything similar.

Apps. Title, chosen topics and settings of the learning apps parents create.

Practice results. For each round played: start and end, the topic, how many tasks were right at the first try, every task with the right answer and the wrong tries before it, the time until the right answer, how often and how long the page was in the background (another app, another tab, screen off) and the prize won. From this, Pauk shows parents what has been mastered and what still needs practice, and picks the next topics. Nothing else is done with this data.

In the child's browser. A round in progress is kept in the browser's storage (localStorage), so it carries on after a reload. It leaves the device only when the round is finished, and is then deleted there.

Server logs. Whenever a page is opened, the hosting provider processes technically necessary data such as the IP address, the time and the address requested.

4. Legal basis

• Account, passkeys, emails, children, apps and practice results: Art. 6(1)(b) GDPR – they are the service parents use. Parents enter their children's data as their legal guardians.
• The sign-in log with IP address and browser identifier, and server logs: Art. 6(1)(f) GDPR – the legitimate interest in running Pauk securely.
• The cookies are strictly necessary for the service (Section 25(2) No. 2 TDDDG): one for signing in, the other for the language the user chose.

5. Service providers

Pauk uses these providers. They process data only to provide their part of the service:

• Vercel Inc. (USA) – runs the website and processes every request to it.
• Neon Inc. (USA) – runs the database; the data is stored in the region AWS Europe Central 1 (Frankfurt).
• Plus Five Five, Inc. (Resend, USA) – sends the emails to parents.
• Better Stack, Inc. (USA) – measures how fast Pauk responds and where errors happen. Only page addresses without links or tokens, timings and status codes go to Better Stack – no names, email addresses or IP addresses.
• Google Ireland Ltd. – sign-in for parents who choose Google. What Google processes is governed by Google's privacy policy.

Where data goes to the USA, the transfer is based on the adequacy decision for the EU-US Data Privacy Framework or on the provider's EU Standard Contractual Clauses. Pauk passes no data to anyone else.

6. How long

• Everything is kept until parents delete it.
• Deleting a child deletes their name, their link and all their practice results.
• Deleting your own account deletes the account, its passkeys and sign-ins. If you are on your own, this also deletes all children, apps and practice results. If you are in a family, the children, apps and results stay with the other parents in the family.

7. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), also for your children's data. An email to info@pauk.fun is enough. You can also lodge a complaint with a data protection supervisory authority, for example the one in your federal state.

Last updated: October 2026