Privacy Policy

Last updated 11 September 2026

Who we are

Víkingur is an AI-powered Icelandic learning app. It's run by Kajan Bulić, an individual sole trader based in Iceland — not a company. If anything in this policy is unclear, or you want to exercise any of the rights below, just email hello@vikingur.app and I'll deal with it personally. Postal address: Víkingur · Kajan Bulić · Hraunholar 8Astc210bær · Iceland.

Where things stand right now

Víkingur hasn't opened to the public yet. Right now this site collects three things, all optional: your email address if you join the waitlist (we send one email on the day the app opens, and nothing before it); your email address if you subscribe to the Journal (one email per new piece, with a one-click unsubscribe in every one); and anonymous product analytics on the pages themselves — which sections get read, which buttons get pressed — with no cookie and no identifier that survives the visit, so a return visit looks like a new one to us. The rest of this policy describes what happens once the full app opens, so you know what you're signing up for in advance. We'll update this page the moment that changes.

What we collect, and why

We only collect what the app actually needs to work. Here's the full list, and the reason for each:

WhatWhy
Your email addressTo create your account and send you important account emails. Before launch, a waitlist address is used for exactly one email, on the day the app opens; a Journal address is used for one email per new piece.
Your passwordTo log you in. We never see it in plain text — it's hashed by our authentication provider, Supabase, before it ever reaches our database.
Your onboarding answers (native language, job/occupation, interests, why you're learning, your self-assessed level, and your learning goals)This is the core of the product — Víkingur builds every lesson around who you are, so this is the information that makes that possible.
Your learning progress (lessons completed, words you've learned, quiz results, streaks, badges earned)To track how you're doing, decide what to teach you next, and show you your own progress.
Payment detailsHandled entirely by Paddle, our payment provider — we never see or store your card details ourselves. See "Who we share it with" below.

We don't collect anything beyond this. We don't run ads, we don't sell your data to anyone, and we don't buy or sell data lists.

Our legal basis for using your data

Under GDPR, we need a valid reason to process your data. Here's ours for each category above:

  • Account details, onboarding answers, and learning progress — processed under contract: we need this information to actually provide the service you signed up for. Without it, the app can't personalize anything.
  • Waitlist email, marketing emails, and anything optional — processed under consent. You can withdraw this at any time (see "Your rights" below).
  • Basic security and abuse prevention (like blocking obviously fake signups) — processed under our legitimate interest in keeping the service usable and not overrun by spam accounts.

Who we share it with

We use a small number of outside services to run Víkingur. We don't sell your data to any of them — they process it strictly on our behalf, to provide the specific function listed below.

ProviderWhat they doRegion
SupabaseOur database and login system — stores your account, profile, and progress data.EU
VercelHosts the app itself.Global CDN
Anthropic (Claude)Generates your personalized lessons. Your profile and learning data are included in the prompts we send it, so it can tailor content to you.United States
ResendSends account and notification emails.EU
PaddleHandles all payments and billing. Paddle is the Merchant of Record — legally, they are the seller for every transaction, not us. They handle your payment details directly; we never see your full card number.Global
Microsoft AzureConverts lesson text into spoken Icelandic audio (text-to-speech).EU
OpenAI (Whisper)Converts your spoken voice into text, for voice-based exercises and conversation practice.United States
DeepLTranslates the text you type into the Translate tool. Only that text is sent, nothing about your account.EU
Unsplash, Pexels and PixabaySupply the photographs on vocabulary cards and Journal covers. We send them a search phrase describing the picture we need, never anything about you — but the photo itself loads from their servers, so like any image on the web they see your IP address when it loads.United States (Unsplash), EU (Pexels, Pixabay)
PostHogProduct analytics — helps us understand which features are actually used, so we can improve the app. Cookieless, no advertising or data-selling use.EU

That's the complete list. We don't use any other third-party analytics, advertising, or tracking tools. The news stories in the app are written from the headlines and summaries in the public RSS feeds of RÚV and Vísir, which we fetch ourselves; nothing about you goes to them.

Data leaving the EEA

A few of the providers above — Anthropic, OpenAI and Unsplash — are based in the United States. Whenever we transfer personal data outside the EEA, we rely on recognized legal safeguards (such as Standard Contractual Clauses or an equivalent adequacy mechanism) that require the receiving provider to protect your data to a standard equivalent to EU law, regardless of where it's processed.

How long we keep your data

We keep your account and learning data for as long as your account is active. If you delete your account (Settings → Delete account, or by emailing us), we delete your personal data within 30 days, except where we're legally required to keep certain records for longer — for example, transaction records Paddle keeps for tax purposes. A waitlist address, if you never create an account, is kept until we have sent the one opening email or until you ask us to remove it, whichever comes first. A Journal address is kept until you unsubscribe.

Your rights

Under GDPR (and equivalent laws elsewhere), you have the right to:

  • Access the personal data we hold about you. You can export it yourself anytime from Settings → Export my data.
  • Correct anything that's inaccurate — most of it you can edit directly in the app.
  • Delete your data. Settings → Delete account removes everything, permanently.
  • Take your data elsewhere (data portability) — the export above is a plain, structured file you can use with another service.
  • Object to how we process your data, or ask us to restrict it, in cases where that applies.
  • Withdraw consent at any time, for anything we process on that basis. Every Journal email has a one-click unsubscribe link, account email preferences live in Settings, and for the waitlist just email us and the address is removed.

To exercise any of these, email hello@vikingur.app. You also have the right to lodge a complaint with your local data protection authority if you think we've gotten something wrong.

Cookies

We use strictly necessary cookies to keep you logged in and to remember basic preferences. We don't use advertising or cross-site tracking cookies. The landing page also remembers, in your own browser's storage, that you have already joined the waitlist, so it doesn't ask again; that never leaves your device. Our analytics set no cookie at all.

Children

Víkingur isn't intended for children under 16, and we don't knowingly collect data from them.

Changes to this policy

If we make a meaningful change to this policy, we'll update the date at the top and, for significant changes, email you directly.

Contact

Questions, requests, or complaints: hello@vikingur.app.

Víkingur© 2026 Víkingur. Made for people with a real reason to learn Icelandic.PricingJournalHelpPrivacy PolicyTermsRefund Policy