Privacy information

AI, retention and cookies

Ollama cloud and, if selected in the service settings, Anthropic receive question text, answer options and any question images for explanations and checks, including answer keys and AI-written explanations. No personal data from publicly registered accounts is sent: no names, email addresses, students' own answers, error profiles or comments. AI does not grade your answers. The owner's private household accounts retain AI analysis of study answers and error patterns.

Study and account data is kept while the account exists and deleted on request or when the account is deleted, except records we must retain by law. Study data is kept while you use the account. After 12 months of inactivity, the account and your study data are deleted. After 11 months, we email you a deletion date at least 30 days later. Logging in is enough to keep the account. Logins, study answers, started or completed study plans, vocabulary practice and payments count as activity. Linked parents and children count as one household. Activity by any member keeps all their accounts. Accounts with an unexpired pass or a subscription that is active or past due are not automatically deleted. A signup whose email address is never confirmed is deleted after seven days, together with a child account created at the same time that nobody else has taken over. Accounting records are kept for 7 years.

Publicly registered accounts and their guardians receive no email tracking pixels. The owner's private household accounts retain email open tracking. Clicks on login links are recorded. We use only necessary cookies for login and security, including protection of the withdrawal form.

On sofiaprov.se we count visits with PostHog, whose servers are in the EU. Events pass through our own server, so PostHog does not receive your IP address. Analytics stores no cookies or persistent identifiers on your device. During a visit, the pages you open share a temporary random ID. It travels in the links between pages on sofiaprov.se so we can see the path a visit takes, but it is immediately removed from the address bar, never stored on your device, and never sent to the sign-up form or the service. A new ID is created when you start a new visit or open a shared link. When you create an account, we store the channel and campaign specified by the signup link, if present. This helps us see which links lead to registrations. We do not link the temporary analytics ID or your answer to the example task to your account. We also count how often the sign-up form is opened and sent, per day and channel; these are only totals, with nothing that points to you. We see the page viewed, where the visit came from (for example a Facebook link or a utm-tagged link) and clicks on the sign-up and login links. When you try the example task on the home page, we also count whether the answer was correct or incorrect and whether you chose Säker (sure), Tvekade (hesitated) or Gissade (guessed). This helps us understand how the example is used. These properties are sent with the same page and source information as the visit measurement. The legal basis is our legitimate interest in knowing whether the site reaches people (GDPR Article 6(1)(f)). A browser with Global Privacy Control or Do Not Track switched on sends no browser analytics events. The service itself, after login, has no such measurement.

Stripe handles payments; card details go straight to Stripe and we never see your full card number. Emails and email events are kept while the account exists and removed when it is deleted, with no separate automatic purge.

You must be at least 13 to register yourself. Younger children need a parent to register them.

A parent can register a child under 18 without an email address of the child's own. The child then gets no letters from Sofia. The parent opens the training for the child with a login link sent to the parent's email, and handles the child's questions and requests about the data, such as erasure. Once the child is 18, the child can write to hej@sofiaprov.se from their own email. We then move the account there with its history, the parent can no longer open it, and nothing is shared without the child's consent.

We collect no date of birth. Once you turn 18, declare this under Progress (/progress), where you can also withdraw consent to parental sharing.

The contact form

If you write to us through the contact form, we store your email address, your message, the topic you chose, the language and, if you give it, your name. We use these details only to reply to you. The basis is our legitimate interest in answering questions (GDPR Article 6(1)(f)). The message is also e-mailed to us through Resend. We do not store an IP address with the message. To prevent abuse, we count how many messages come from the same connection for at most one hour, using a transformed code rather than the address itself. The message is automatically deleted from our database one year after it arrives, or earlier if you ask. We then also delete the copy in our inbox.

The waiting list

The home page now leads to the free trial. The older waiting-list signup function remains available. It stores your name, email address, role (parent, student or teacher), exam, exam sitting and optional message, as well as language and consent time. The basis is your consent (GDPR Article 6(1)(a)), so we can contact you about Sofia. Entries are deleted after two years at the latest or earlier on request. This is a commitment we fulfil, not an automatic purge.

Withdraw your consent and remove your entry by entering your email address. The answer is the same whether the address was listed or not. This form works without JavaScript.

If it does not work, write to hej@sofiaprov.se and we will do it by hand.