Privacy information
This page explains what data English on Shift processes, why it is used, how long it is kept, and which data protection rights you have.
Last updated: 14 August 2026.
1. Controller and contact
Data controller: to be completed in the admin panel. Privacy contact: to be completed.
2. Data, purposes, legal bases, and retention
| Data | Purpose and legal basis | Retention |
|---|---|---|
| Email address and consent time — only when you voluntarily unlock the interactive player. | Providing player access and remembering that access. Legal basis: consent under Article 6(1)(a) GDPR. The address is not used for marketing on this basis. | Until consent is withdrawn, deletion is requested, or the access feature ends, except where limited data must be kept to handle legal claims. |
| Visit date and time, page path, lesson identifier, selected language, player events, country when supplied by the host, device type, browser family, and referring domain. | Measuring site performance and improving lessons. Legal basis: the controller's legitimate interests under Article 6(1)(f) GDPR. No advertising profile is created. | Up to 400 days, with older records removed periodically. |
| A technical hash of the IP address used during an email submission attempt. | Protecting the form against automated abuse. Legal basis: legitimate interests in securing the service under Article 6(1)(f) GDPR. | Used for a 24-hour window and removed during the next cleanup cycle. |
| Technical server logs that may include IP address, request time, URL, and browser information. | Security, error diagnosis, and hosting operations. Legal basis: the legitimate interests of the controller and hosting provider. | According to the host's configuration and policies, no longer than needed for security and diagnosis. |
3. How first-party statistics work
The full IP address and full User-Agent header are not stored in the analytics tables. The server briefly combines them with a secret key and the current date to create a protected identifier. It changes daily, so it is not used to track a person over time.
The site does not use Google Analytics or Google Tag Manager. When the browser sends Do Not Track (DNT) or Global Privacy Control (GPC), the first-party analytics module does not record the visit.
Extended statistics include playback in a visible tab, reaching points in a video, use of sentence bookmarks, article and next-episode clicks, initiated downloads, and source/campaign labels in links. Analytics does not store private saved text or account email addresses. Countries are read from hosting-provided GeoIP information; missing countries are reported separately. Aggregated reports are available to the administrator.
4. Browser storage
Local browser storage remembers player and language settings, saved sentences, progress and — after consent — the email address that unlocks access on that device. The values remain until site data is cleared in the browser. They are not advertising identifiers or analytics cookies.
After an administrator opens the admin panel, the functional eos_stats_exclude cookie remembers whether this browser is excluded from statistics for up to one year. It contains only 1 or 0, without a personal identifier. The setting can be changed in the panel and remains after sign-out.
Optional account and sync
If accounts are enabled by the owner, you can sign in with a single-use email link. Your email address, saved sentences, watched marks and playback positions are then stored on the server for use across your devices. Guest saves remain separate; importing them requires selecting the corresponding option in “My account”.
The account session cookie lasts up to 30 days and is revoked on sign-out. Sign-in links expire after 15 minutes. Your browser also stores a copy of account saves and changes awaiting sync. Signing out removes this local account copy on that device. Deleting account sentences and progress removes them after sync but does not delete your email address or separate guest saves. To request deletion of your account and email address, contact the controller listed above. Account data has no automatic deletion date. Technical change identifiers are retained so retried sync requests do not restore deleted saves.
5. YouTube, thumbnails, and external resources
Videos use YouTube's privacy-enhanced embed mode (youtube-nocookie.com). Video thumbnails and some visual resources may be delivered from Google servers. Connecting to those resources exposes ordinary technical information, including the IP address and browser data, to the provider. Once the player is loaded, YouTube may process additional data under the Google Privacy Policy.
Google services may process data outside the European Economic Area using safeguards described by Google. If you do not want to connect to the player, you can use the lesson text and transcript provided on the site.
6. Recipients
Data may be processed by the hosting provider as an infrastructure service provider and by Google/YouTube as described above. It may also be disclosed to competent authorities where the law requires it. Email addresses are not sold or shared for advertising.
7. Your rights
Depending on the circumstances, you may request access, correction, erasure, restriction, and portability of your data, and object to processing based on legitimate interests. You may withdraw consent at any time; withdrawal does not affect processing that was lawful before it.
Send a request to the controller using the address in section 1. If you believe your data is handled unlawfully, you may lodge a complaint with the President of the Polish Data Protection Office. The site does not make decisions about users based solely on automated processing.
8. Is the email required?
Providing an email address is voluntary. If the site owner enables the gate, it is required only to unlock the interactive player and sentence replay on that device. The public lesson description and any published text remain available without an email address.
9. Additional information from the controller
Uzupełnij dane administratora danych przed włączeniem zapisu e-mail.