Who is responsible
Off the Cuff Challenge is a personal EXLA experiment operated by Alex Gers, an individual based in the Netherlands. Alex is the controller of the personal data described here. Contact: hello@exla.dev. This notice covers this application, not every linked EXLA project.
Speaking practice and local browser storage
Topics and the speaking timer run in your browser. Off the Cuff Challenge does not request microphone access, record speech or send your spoken practice to a server. Chosen topic IDs, the category preference and the challenge-level preference are stored locally under cuff.practice.v1. They remain until you replay a topic selection or clear this site’s browser data. This storage provides the no-repeat practice and preferences you use; it is not an analytics identifier.
History is specific to this browser. On a shared device, clear site data after use. When browser storage is unavailable, practice continues with temporary history for the current visit. Topic IDs, challenge choices and timer activity are not sent as analytics events.
Optional background music and action sounds are generated locally in the browser. Sound is off on every visit and reload. Audio starts only when you select Sound on, and this choice is not saved. No music service receives your listening activity.
Hosting and service providers
Vercel hosts the application and processes technical requests, which may include IP address, browser information, URL, time and response status, to deliver and secure the service. Cloudflare provides authoritative DNS, not a proxy for page traffic. Hosting and security rely on my legitimate interest in a functioning, secure site (Article 6(1)(f) GDPR). Operational records follow Vercel’s applicable log-retention windows; incident records are kept only while necessary. See https://vercel.com/docs/logs/runtime .
Limited visit statistics
Vercel Web Analytics measures visits to the application: page, referring website, approximate country, browser, operating system and device type. I use these limited statistics to understand and improve this project, based on legitimate interest where personal data is involved (Article 6(1)(f) GDPR). There are no advertising profiles or analytics identity/custom-event features.
Page-view URLs are restricted to published pages, with query strings and fragments removed. Form values, recordings, game saves and computed results are not sent as analytics events. Events are skipped if the browser signals Do Not Track or Global Privacy Control. Legal pages themselves load no analytics script. Vercel’s default request-derived visitor hash expires after 24 hours; aggregate reports have the reporting window of the plan. See https://vercel.com/docs/analytics/privacy-policy and https://vercel.com/docs/analytics/limits-and-pricing .
Fonts
The application’s interface can download fonts from Google Fonts and Fontshare (Indian Type Foundry). Those providers receive the technical request, including your IP address and browser information, to deliver the font. Legal pages use a system font. Font delivery supports my legitimate interest in a readable interface. See https://developers.google.com/fonts/faq/privacy and https://www.fontshare.com/privacy .
Contact by email
If you email hello@exla.dev, Zoho Mail processes your address, name if supplied, message and attachments so I can respond. Please send only what is needed. The basis is my legitimate interest in answering requests (Article 6(1)(f) GDPR). Ordinary correspondence is deleted when no longer needed, at the latest three years after the matter closes. Records required by law or needed for a particular legal claim may be retained separately for the applicable period.
Processing outside the EEA
Providers can process data outside the European Economic Area, including in the United States. An overseas server does not change who operates this project. Transfers must use an applicable adequacy decision or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses. You can contact hello@exla.dev for information about the safeguards applicable to your data. Provider processing and security are described at https://vercel.com/legal/privacy-policy , https://www.cloudflare.com/privacypolicy/ and https://www.zoho.com/privacy.html .
Your rights and choices
Subject to the GDPR’s conditions, you can ask for access, correction, erasure, restriction or portability of personal data, and object to processing based on legitimate interest. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. There are no automated decisions with legal or similarly significant effects.
Write to hello@exla.dev. I normally respond within one month and may need proportionate information to verify a request; I do not ask for identity documents by default. Browser-only data can be removed through this site’s browser-storage settings. You may complain to the Dutch Autoriteit Persoonsgegevens (https://www.autoriteitpersoonsgegevens.nl/) or your local supervisory authority. Providing an email or application input is optional; requested functions may not work without the information they need.
Changes
Last updated: 9 October 2026. I will update this notice when the application or its data practices change. New tracking that requires consent will ask before it starts.