Who is responsible
This policy covers Gulp, including its public pages, reading exercises, account service and subscriptions. The operator identified below is the controller responsible for your personal data.
A private contact email has not yet been published. Please check this page again before creating an account or buying a plan.
Information we handle
- Early access list. If you join the list, we keep your email address, which part of the site you joined from and when. Your browser also remembers the address it added, so the site can show that you’re on the list. Nothing else about you is attached to it.
- Account details. Your username, email address, chosen name or nickname, account identifier and creation date. For password accounts, we store a salted password hash rather than a readable password. Your browser keeps a cached profile and sync status for offline use.
- Google login. If you choose Google, we receive an account identifier, verified email address and basic profile information. We do not request access to your Gmail, Drive files or contacts. Our account link stores the Google identifier and email; provider tokens are used to complete login rather than saved as part of your reading progress.
- Practice and preferences. Reading and drill results, answers, timings, recall responses, practice lab notes, progress, medals, goals, reminder time, display preferences and the dates you practise. A free test can save results on this device before you join.
- Your texts. Text you paste or import, its title, reading position and related practice. Import is processed in your browser. When you use an account, the saved text is included in the progress snapshot uploaded to the account service. Your texts are not a public library. Avoid uploading confidential material or sensitive personal data about yourself or others.
- Billing. Stripe processes payment details. We send it your account email and identifier and retain customer, subscription, checkout and price identifiers, subscription status, billing dates and trial history. We do not receive or store full payment card numbers or card security codes.
- Requests and support. Servers and service providers process IP addresses, browser and request information to deliver and protect the service. If you contact us, we handle your message, contact details and the information needed to resolve it.
Providing account details is necessary to create and use an account; payment information is necessary to buy a paid plan. A name or nickname and imported texts are your choice. You can read the public pages and take the free speed test without an account.
Why we use it
- To provide the service you request. We use account, progress and billing information to authenticate you, sync your practice, build your plan, calculate results and manage subscriptions. Where the GDPR applies, the legal basis is performance of our contract with you or steps you ask us to take before entering it.
- To operate and protect the service. We use limited technical information to prevent abuse, enforce account security, diagnose faults and handle support. Where the GDPR applies, we rely on our legitimate interests in a secure, reliable service, balanced against your rights.
- To meet legal duties. Where required, we retain transaction and related records for accounting, tax, fraud prevention or legal claims. The basis is the relevant legal obligation, or legitimate interests for defending claims.
- To send your invitation. When you join the early access list, we use your email address to send your invitation and occasional updates about the launch. Where the GDPR applies, the legal basis is your consent, given when you submit the form. You can withdraw it at any time with the link in any email or by contacting us, and we remove your address.
- For an optional use that needs consent. We will ask separately before introducing such a use, and you can withdraw that consent without affecting earlier lawful processing. Creating an account does not subscribe you to marketing.
Your plan and skill profile are calculated from your practice. They are educational suggestions, not decisions with legal or similarly significant effects. You can change your goals and choose different exercises.
Who receives information
Information is available to the operator and authorised people who need it for support, security or operation, and to the providers that deliver the features you use:
- Fly.io and database infrastructure: website delivery, the account API and stored progress. The repository configures the website and API in Amsterdam; this does not mean every infrastructure or support operation stays in that region. See Fly.io’s privacy statement.
- Google: optional Google login. The site also requests its typefaces from Google Fonts, which exposes your IP address and browser request information to Google even if you do not use Google login. See Google’s privacy policy.
- Stripe: hosted checkout, payment processing, fraud prevention and the subscription portal when you open billing. Stripe also processes information for its own payment and legal responsibilities. See Stripe’s privacy policy.
We do not sell personal data or run advertising trackers or optional analytics in this version of the site. We may disclose limited information if the law requires it or to establish, exercise or defend legal claims. External links lead to sites with their own privacy practices.
Providers may process information outside your country, including outside the EEA or UK. Where applicable law requires it, transfers must use an adequacy decision or appropriate safeguards such as standard contractual clauses. Contact us for information about the safeguards relevant to your data. The operator must confirm the deployed providers and transfer arrangements before this draft becomes final.
How long we keep information
- On your device: progress, preferences, imported texts and cached account details can remain until you remove them, clear the site’s storage or your browser removes them. Logging out ends the browser login but can leave saved practice on the device.
- Early access list: your address stays on the list until you leave it, until you are invited and make an account, or until the list is no longer needed for the launch, whichever comes first. The operator must confirm a fixed maximum period before publishing a final policy.
- In your account: account details and your current progress are retained while the account is open. There is no automatic deletion just because you stop visiting.
- Progress recovery: the server keeps the latest 20 progress revisions and the last revision of each of the previous 30 days, pruning older copies when new progress is saved. A latest revision can therefore remain longer than 30 days if you stop practising. Resetting practice does not immediately erase all recovery revisions.
- Login: browser login cookies expire after 180 days and may renew as you use the service. A Google login protection cookie lasts up to 10 minutes.
- Billing, support and security records: retention depends on the purpose, applicable accounting and tax obligations, dispute periods and the provider’s documented retention arrangements. The operator must confirm the applicable periods, including infrastructure backups and logs, before publishing a final policy.
Exporting and deleting data
Settings, Your data lets you download a JSON backup of your practice and saved texts. This is a practice export, not a complete export of all account or billing records. Contact us for access to other personal data.
Delete everything clears practice, saved texts and preferences from this device and, when connected to your account, replaces its current progress on the next successful sync. It does not close your account, remove all server recovery copies, cancel a subscription or delete Stripe’s records. A reset made while offline needs to sync before it reaches the account.
To request account closure or erasure, contact the operator using the details above. We may need to verify that the account is yours. We will explain any information that must remain for legal reasons and its retention period. Cancel a paid subscription through Manage subscription as well. Other devices, downloaded backups and your calendar are under your control; remove copies there separately.
On a shared device, log out and clear the site’s saved data when you finish. Clearing only local storage does not cancel an account or subscription.
Your privacy rights
Depending on the law that applies, you can request access, correction, erasure, restriction, a portable copy of your data, or object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it. Some rights have legal exceptions.
Contact us to exercise a right. Where the GDPR applies, we normally respond within one month; if a lawful extension is necessary, we will tell you within that month and explain why. You can also complain to a data protection authority, including the authority where you live, work or believe an infringement occurred. The EDPB lists EEA authorities; UK residents can contact the ICO.
Security, age and changes
We use measures including HTTPS, hashed passwords and protected browser login cookies. No storage or transmission system is completely secure. Keep your password and backup files private.
Gulp is intended for adults aged 18 or over. If you believe a child has provided account information, contact us so we can investigate and handle it appropriately.
We will update this page when our practices change, show the revision date and bring material changes to your attention before they take effect where required. Read the Cookies and storage policy for the technologies used on your device.