Privacy Policy

Who we are and what this covers

Virtuous English Academy ("VEA", "we", "us") runs the free English-learning website at virtuousenglishacademy.com. This policy covers that website and every page on it.

It explains what data we hold, why we hold it, who else can see it, and what you can make us do about it. It is written to meet the UK GDPR, the EU GDPR, the CCPA/CPRA, and the disclosure requirements of the Google AdSense programme.

If anything here is unclear, ask us at virtuousenglish@virtuousenglishacademy.com — we would rather explain it than have you guess.

What we collect

Your data sits in one of two layers, and which one depends entirely on whether you have chosen to create an account.

If you use VEA without an account

Your progress, quiz states, saved preferences and study timers are written to your own browser's localStorage. That data stays on your device. We cannot read it, and it is never transmitted to us. The one exception is the optional Word Trainer reminder, which you switch on yourself and which is described below.

You can erase all of it at any moment by clearing site data in your browser. You do not need to ask us, and nothing is kept on our side to delete.

If you create a free account

Signing in lets your progress follow you between devices, and it is what a certificate is issued against. Creating an account asks for four details on one screen, once. We store, against your account:

• Your email address, handled by Google Firebase Authentication.
• Your given name and family name — the name a certificate would be issued in, which is why we ask for a real one rather than a nickname.
• Your nationality — printed on a certificate, as it is on any language certificate. “Prefer not to say” is on the list and is a complete answer.
• Your year of birth — a year, never a full date. It does two jobs: telling two candidates with the same name apart on an exam record, and letting us apply the under-13 rule below. An exact date of birth is not asked for and the form would not accept one.
• Whether your email is verified, and the date and policy version recorded when you created the account.
• Course progress, streak count, XP, badges and weekly study seconds.
• Flashcards and vocabulary you choose to save, and notes you write in the dashboard.
• Placement-test results and any certificate you generate.
• Whether you ticked the optional marketing-email box when you signed up, and, if you get the Word Trainer’s Monday recap, the day the last one was sent.

We never see your card. Almost everything on VEA is free; the one exception is the Certified English Placement Exam. If you buy it, the payment is taken by Dodo Payments on its own checkout page. Your card number, expiry and security code are entered there, not here, and are never transmitted to us or stored on our servers. What comes back to us is a confirmation that an order was paid, an order reference, and the country the provider used to work out tax.

We do not ask for your address, phone number, exact date of birth or any government identifier. A year of birth is a year: it is not a date, and there is no way to derive one from it.

If you write to us

Messages sent through our contact page reach us by email and include the name, email address and message you typed. We keep them only as long as we need to answer you.

The Word Trainer — your words, your streak and the weekly league

The Word Trainer works without an account, and then everything it knows about you stays in your browser. If you sign in, a copy of your progress is also kept with your account, so it follows you between devices: which words you have met, when each one is due, how many questions you answered on each day, and the points those answers earned.

The weekly league is public, and you are on it when you study signed in

The league is a weekly board of learners and the points they earned in the Word Trainer. Anyone can see it, signed in or not: it is shown on our home page and inside the trainer.

If you use the Word Trainer while signed in and earn points, you are put on that week’s board automatically. A row on the board shows four things and nothing else: a name — your first name, unless you change it — your level, your points for the week and the length of your streak. It never shows your email address, your family name or your account’s identifier.

You are not listed if you use the trainer without an account, or if you have switched leaderboards off in your dashboard settings.

You can change the name the board shows, or hide yourself from it, at any time from the league screen in the trainer. Hiding takes your row down. Deleting your account removes your league rows and your saved words as well.

If you study signed in, each session also saves a record of your answers when it ends. The record holds which word it was, and whether you were right or wrong. It also holds how long since you last saw the word, how long you took and the kind of question. We use it to tune when words come back. It carries a one-way code instead of your account id. It holds no name, no email address and no words you typed. Nobody else can read it, and deleting your account deletes it.

The Word Trainer — the optional reminder

The Word Trainer can send you one reminder a day. It is off until you switch it on, with the button “Remind me on this phone” (or “in this browser”), and your browser asks you first. You do not need an account.

What we keep to send it

When you switch it on, our server keeps four things about your browser and nothing else: its push address — a web address your browser gives us so that a message can reach it — the time you chose, your time zone and the last day you practised. It holds no name, no email address, no account identifier and no word you have learnt. We use the push address only to send this reminder, and we do not write it to our logs.

How a reminder is sent

At the time you chose, on a day you have not practised yet, our server sends an empty message to your browser maker’s push service: Google for Chrome, Mozilla for Firefox, Apple for Safari and Microsoft for Edge. That service sees that a message was sent to your browser, and nothing about your words, because the message has no content. The words you read, such as “12 words are ready.”, are written on your own device.

We send at most one reminder a day. After three reminders in a row that you do not open, we stop until you open the trainer yourself. If the trainer is not opened in that browser for 90 days, we delete what we keep for the reminder.

Your browser keeps two small entries

In your browser the reminder keeps one entry in localStorage, called vea_wt_push, and one small IndexedDB database, called vea-wt. They hold your time, your time zone and the numbers the message is written from. They are listed on the cookie policy.

How to switch it off

Press “Turn off the reminder” on the reminder screen in the trainer. That deletes what we keep. You can also block notifications for this site in your browser’s settings, or clear this site’s data: your browser then drops the push address, and we delete our copy the next time the push service tells us the address is gone.

The Word Trainer — the Monday recap e-mail

Once a week, on Monday, we can send you one short e-mail about your week in the Word Trainer. You get it only if you have an account and agreed to e-mails from us: the optional e-mail box when you signed up, or the same box in your profile. Without that agreement we do not send it.

Who gets it

A member who agreed to e-mails and who practised in the Word Trainer on at least one day in the last 90 days (a day counts once five answers are given or a session is finished). We send at most one recap in any six days.

What it contains

Your first name, if you gave one, and numbers we read from your own trainer records: last week’s answers, days kept and points, your best day, your streak, your known and growing words, and how many words are due today. It holds no advertisement, no offer and no information about anybody else. If you did not practise last week, it shows no figures for last week and only says what is waiting.

How it is sent

On Monday morning (UTC) our server reads your trainer records, builds the message and hands it to Brevo, our e-mail provider, with your address and first name. On your account record we keep one more thing: the day the last recap was sent, so that we do not send two in a week. We do not write your address or your name to our logs.

How to stop it

Every recap has a “Stop these e-mails” link, and your mail app may show its own Unsubscribe button. Opening the link only shows a page; pressing the button on that page stops the e-mails. That switches off the recap and every other optional e-mail from us. E-mails about your account, such as a password reset or an exam result, are not optional and still arrive. You can also write to virtuousenglish@virtuousenglishacademy.com and we will do it by hand.

The certified exam — payment, recordings and AI marking

The details you give before you start

Before the first question the exam asks for five things, and it asks for them because a certificate names a person. You give them once, on a screen where the clock is not yet running, and you can see exactly how your name will be printed before you confirm it.

• Your given name and family name — printed on the certificate, which is the whole reason we ask. They cannot be changed after the exam is scored, so please check them on that screen.
• An email address — where we send your result and your certificate link. It is your choice and does not have to be the address you signed in with.
• Your nationality — printed on the certificate, as it is on any language certificate. “Prefer not to say” is on the list and is a complete answer.
• Your year of birth — a year, never a full date. It does the job a date of birth does on an exam record, which is telling two candidates with the same name apart, without putting an exact date of birth on a page anyone with the link can read. We do not ask for one and the exam would not accept one.

Your name, nationality and year of birth appear on your certificate, and a certificate page is public to anyone who has its link — that is what makes it shareable and verifiable. Nothing else from your account appears there. If you delete your account, your certificates go with it.

What sitting the exam stores

• Your answers to every question, and how long each one took.
• The text of your writing tasks, including the draft as it autosaves.
• Audio recordings of your spoken answers — see below.
• Proctoring events: how many times the exam window lost focus, left full screen, or refused a copy or paste. We record that these happened and when; we do not record what you switched to, and we cannot see your screen, your camera or any other application.
• The result: your band per skill, the marker's written feedback, and the certificate if one is issued.

Your voice recordings

The speaking section asks you to record three short spoken answers — two open questions and one sentence read aloud. Your microphone is active only while you are recording, you can listen back before you submit, and you can skip the section; nothing is marked from it either way.

• Why we hold them: to keep them with your attempt, and as evidence if an attempt is flagged for review. Nothing marks them at present. Nothing else. The legal basis is performance of the contract you entered when you bought the exam.
• Where they live: a private Google Cloud Storage bucket that no browser can read — only our server-side code can reach it.
• How long: 12 months, then deleted. You can ask us to delete them sooner at any time, and we will, unless the attempt is under active review.
• What we never do: publish them, sell them, use them to advertise, use them to identify you biometrically, or use them to train anybody's model.

Writing and speaking responses

Your writing and speaking responses stay with your exam attempt in our Google Cloud services. They are not sent to an external AI marker or speech-recognition provider.

• What is stored: the task prompt, what you wrote or recorded, and a few facts about how you worked, such as timing and revisions.
• What the detailed result uses: grammar, vocabulary, reading and listening answers scored on our servers.
• Training: we do not use your responses to train a model.

The result email

When your exam is scored we email the result to the address you gave on that first screen: your level, your score and its margin, your bands by skill, and a link to your certificate if one was issued. It is sent once, by our transactional email provider, and it is not marketing — there is no list to join and nothing else is sent to that address. If the name on the certificate is wrong, replying to that email is the fastest way to reach us.

Payment data

The sale is handled by Dodo Payments as merchant of record (their privacy policy). That company, not VEA, is the seller on your bank statement and the party that handles your card data, the tax and any dispute. We receive an order reference, the amount, the currency and the country used to work out tax, and we store those against your account so we know the exam is unlocked. We do not receive, and cannot ask for, your card number.

Word Trainer Plus — the subscription

What we store

• Whether your account has Plus, which plan it is (monthly or yearly), its status and the date it renews or ends.
• The subscription and customer references our payment provider gives us, so that a renewal, a cancellation or a refund reaches the right account.
• If you start the free week: the day it started and the day it ends, so that each account has it once.

The subscription is sold by Dodo Payments as merchant of record (their privacy policy). Your card details go to them and never reach us. The legal basis for these records is performance of the contract you entered when you subscribed. We keep them while you have an account, and records of a sale for as long as the law requires.

Advertising — how ads on this site work

Yandex Advertising Network. Eligible lesson, grammar, vocabulary, story and blog pages carry one advertising space inside the lesson and one at its end, and on a wide screen one more on each side of the lesson. Yandex is contacted only for visitors outside the EEA, the UK and Switzerland — and not in Ukraine, where Yandex is blocked — once you scroll, tap or press a key, or a few seconds after the page has loaded. Nobody in the EEA, the UK or Switzerland loads it. Yandex mainly sells advertising for Russia and Central Asia, so elsewhere a space often has nothing to show and closes again. After 3 empty answers in a row the site stops asking until you close the tab; it keeps that count, a number and nothing about you, in your browser's sessionStorage. Our contract for these ads is with Air Smart Advertising Solutions FZ-LLC (Dubai, United Arab Emirates), under the Yandex Advertising Network Terms of Offer.

Where its advertising loads, Yandex may use cookies and similar technology to choose, show, measure and protect ads, including ads based on your visits to other sites. Yandex handles that data under its own privacy policy. We receive only aggregate reports, never who saw or clicked an ad.

Infolinks (publisher ID 3448116) ran on editorial pages from 24 to 28 September 2026 and has been switched off. No Infolinks script is loaded any more.

Affiliate link: Preply. Most lesson, exercise, story and blog pages end with one card that links to online English tutors on Preply. It is an affiliate link through the Impact partner network: if you book a lesson, Preply may pay us a commission. The card is marked as an affiliate link on the page, and it never changes what a lesson teaches. The sign-in page shows it beside the form. Tests, the exam, games, other account screens and policy pages do not carry it.

The card is a plain link. It loads no script and sets no cookie on this site, and we send no personal data with it. When you click it, you go to Preply through Impact’s tracking address (preply.sjv.io); Preply and Impact may set their own cookies there to record that the visit came from us, under their own privacy policies.

Google AdSense is paused. No AdSense advertising script is loaded anywhere on the site. The homepage retains only the non-serving ownership-verification meta for publisher ID ca-pub-6733098045611992.

Advertising is limited to eligible lesson, grammar, vocabulary, story, blog and similar editorial pages. Policy pages, tests, games, account screens, the lesson directory, the homepage and the certified exam stay ad-free.

The advertising disclosures we make

• Third-party vendors — today Yandex, for visitors outside the EEA, the UK and Switzerland — may use cookies or similar technology to select, deliver, measure and protect advertising.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to our site and/or other sites on the internet.
• You can opt out of personalised advertising by visiting Google Ads Settings.
• You can switch off personalised ads from Yandex in the Yandex ad settings.
• You can opt out of a third-party vendor's use of cookies for personalised advertising at the Network Advertising Initiative, aboutads.info/choices, or — in Europe — at youronlinechoices.eu.

What we do not do

We do not build our own advertising profiles, run cross-site behavioural tracking of our own, or sell your personal information to data brokers. Advertising data is processed by the advertising providers under their own policies, not passed to us as a list of people — we receive aggregate reporting, never the identity of who saw or clicked an ad.

If you are in the EEA, the UK or Switzerland

Consent Mode defaults advertising and analytics storage to denied in these regions. No advertising is loaded for visitors in these regions, so our first-party choice covers optional analytics only. You can revisit your choice from the "Privacy settings" link in the site footer.

Everywhere else

Outside these regions optional analytics runs by default, and so does the Yandex advertising described above. To turn either off, choose "Decline" under the "Privacy settings" link in the site footer: the advertising leaves the page you are on, and nothing is loaded from Yandex from the next page on. The site decides which rules apply from your device's time zone, and asks first whenever that time zone could belong to one of these regions or cannot be read.

The same rule covers Grow by Mediavine, described in the next section: it is not loaded in the EEA, the UK or Switzerland, and "Decline" stops it everywhere else.

Grow by Mediavine — saving and sharing pages

Grow by Mediavine. The homepage and eligible lesson, grammar, vocabulary, story and blog pages load Grow, a reader tool made by Mediavine, Inc. (United States). It can show a small button for saving and sharing a page, suggestions for what to read next, and a sign-up box. It also counts visits. Mediavine uses those counts to decide whether this site may join its advertising programme later; no Mediavine advertising runs here today.

Grow is loaded only for visitors outside the EEA, the UK and Switzerland, once you scroll, tap or press a key, or a few seconds after the page has loaded. Nobody in the EEA, the UK or Switzerland loads it. Tests, the certified exam, games, account screens and policy pages do not carry it.

Where it loads, Grow keeps its own entries in your browser: a short-lived cookie (growme_version) and localStorage entries whose names begin with grow, such as growMeSnowplowUserInfo. Mediavine receives your IP address, the page you are on and how you use Grow's tools. If you give Grow an email address, to save pages or to subscribe, Mediavine holds it too and may use it for advertising on the sites it works with. Mediavine handles this data under its own policies, set out in its Legal & Privacy Center. We see totals in the Grow dashboard, and the email address of anyone who subscribes through it.

To switch Grow off, choose "Decline" under the "Privacy settings" link in the site footer. Nothing is loaded from Mediavine from the next page on.

Analytics

We use Google Analytics 4 (measurement ID G-56N53QZVQH) to understand which lessons people actually finish, which pages are broken, and where learners give up. It is the only analytics tool we run ourselves; Grow by Mediavine, described above, keeps its own count of visits.

We record page views plus a small number of named events: completing a placement test, saving a flashcard, and creating an account. These are counted, not tied to a name — we use them to decide what to build next, and for nothing else.

IP addresses are anonymised by Google Analytics 4 by default. We have not enabled Google Signals, advertising features or cross-device tracking in our Analytics property.

Third parties we actually use

This is the complete list. Every one of these is a service the site genuinely loads — if a name is not here, we are not sending your data to it.

Why we are allowed to hold this (legal basis)

• Contract — account data and essential account, security, exam and service-update email exist because you asked us to provide a membership and save your progress.
• Consent — advertising and analytics cookies in the EEA/UK, and marketing email anywhere. You can withdraw consent at any time without losing access to any lesson.
• Legitimate interests — keeping the service secure, preventing abuse, and fixing what is broken.

How long we keep things

• Local, guest-mode data — until you clear your browser. We never see it.
• Account data — for as long as the account exists, then deleted on request.
• Contact messages — deleted once the conversation is finished.
• The Word Trainer reminder — until you switch it off, or the push service tells us your browser’s address has expired. After three reminders in a row that you do not open it pauses, and stays paused until you open the trainer again. If the trainer is not opened in that browser for 90 days, we delete the record.
• The Word Trainer’s record of your answers — kept with your account, and deleted when you delete the account.
• The Word Trainer’s Monday recap — only the day the last one was sent, kept with your account and deleted when you delete the account. We keep no copy of the e-mail. Brevo keeps its own record of delivery, under its policy.
• Analytics — retained on Google's default schedule for a GA4 property.
• Exam voice recordings — 12 months, or sooner if you ask.
• Exam scripts, marks and proctoring events — kept with the attempt record, because a certificate has to remain checkable for as long as it is shown to anyone.
• Order records — kept as long as tax and accounting law requires, which is longer than we would otherwise choose and is not ours to shorten.

Security

Account data lives in Google Firestore behind server-enforced security rules: each account can read and write only its own records, and those rules are enforced by Google's servers rather than by anything running in your browser. The whole site is served over HTTPS with HSTS.

No system is perfect. If you believe you have found a security problem, please write to us before disclosing it publicly and we will fix it as fast as we can.

Children

VEA is a general-audience education site and is not directed at children under 13. We do not knowingly collect personal information from a child under 13.

Since 2026-09-08 that is checked rather than assumed: creating an account asks for a year of birth, and a year that puts you under 13 is refused at that point — before any account exists. Nothing else about the site changes for you, because none of it needs an account.

Teachers using our material with a class should have pupils work in guest mode, which stores nothing off the device and requires no account at all. Every lesson, story, quiz and grammar page works fully without signing in.

If you are a parent or guardian and believe a child has created an account here, write to us at virtuousenglish@virtuousenglishacademy.com and we will delete it.

International transfers

Our hosting, authentication and database are provided by Google and may process data on servers outside your country, including in the United States. Google relies on the European Commission's Standard Contractual Clauses and the EU–US Data Privacy Framework for those transfers.

Your rights

Wherever you live, you can ask us to:

• Show you a copy of the account data we hold about you.
• Correct anything that is wrong.
• Delete your account and everything attached to it.
• Stop marketing email, at any time, with one click.
• Restrict or object to a particular use of your data.

Deletion you do not need to ask for. Delete your account removes your profile, progress, saved words, notes and certificates immediately, from your own browser, with no request to us and no waiting period. That page also lists the two things which cannot vanish in the same instant, and why.

Under the GDPR you also have the right to data portability and the right to complain to your national data-protection authority. Under the CCPA/CPRA you have the right to know, delete, correct, and to opt out of "sale" or "sharing" — we do not sell or share personal information as those laws define it, and you will never be treated differently for exercising any of these rights.

To make a request, email virtuousenglish@virtuousenglishacademy.com from the address on the account. We answer within 30 days.

Changes to this policy

If we change how we handle your data in a way that matters, we will update the date at the top of this page and, for anything significant, say so on the site itself. Continuing to use VEA after a change means you accept the updated policy.