Draft: this document is awaiting legal review and still contains placeholder company and contact details. Do not rely on it yet.
Privacy Policy
Last updated: 17-08-2026
This policy explains what personal data the app collects, why, how long it is kept, and what you can do about it. It covers the app and the website at PLACEHOLDER: example.com. The Cookie Policy explains browser storage in detail, and the EU Privacy Rights page explains how to exercise your rights.
1. Who is responsible
The controller of your personal data is PLACEHOLDER: operating entity legal name, PLACEHOLDER: registered address (company number PLACEHOLDER: company registration number).
For anything about your data, write to PLACEHOLDER: privacy@example.com. Our data protection officer can be reached at PLACEHOLDER: dpo@example.com.
2. What we collect
Account details, when you register:
- your name, if you give one
- your email address, which is also how you sign in
- a hashed form of your password (we never store the password itself), or, if you sign in with Google, the identifier Google gives us
- whether your email address has been verified
- your chosen app language
Learning data, as you use the app:
- your learner profile: your level, your goal and the pace you chose
- which lessons you have finished and how far into a lesson you are
- your review schedule: which words and grammar points are due, and how well you recalled them
- the words you save to My Words
- your settings: speech rate, colour theme, palette, helper language
Purchase details, if you buy a course:
- your billing name, phone number, address, city and country
- which courses you have access to and until when
- payment records: amount, currency, status and the reference our payment provider gives us
- refund records, where one applies
We do not receive or store your card number, expiry date or security code. Those go directly to our payment provider.
Messages you send us through the Feedback or support form: your name, your email address and what you wrote.
Technical data our hosting and security layer records in the ordinary course of serving a page, such as your IP address and your browser's user agent. We do not build a profile of you from this.
We do not ask for and do not want special category data: nothing about your health, beliefs, politics, ethnicity or sexual life belongs in this app. Please do not put it in a feedback message either.
3. What we deliberately do not collect
If you use the AI conversation partner, you supply your own API key. That key is stored only in your own browser, in its local database. It is never written to your learner profile, to our server logs, or to our database. When you send a message, the app passes the key and the message straight through to the provider you chose and keeps neither.
Recordings of your own speech, made when you practise speaking, stay in your device's memory for playback and are cleared when you move on. They are not uploaded.
4. Why we use it, and on what basis
| Purpose | Data used | Lawful basis |
|---|---|---|
| Give you an account and keep you signed in | Account details | Performance of our contract with you |
| Teach you: pick your next lesson, schedule your reviews, remember your progress | Learning data | Performance of our contract with you |
| Sell and deliver a course, and keep the financial record | Purchase details | Contract, and our legal obligation to keep accounting records |
| Answer your message | What you sent us | Performance of our contract, or our legitimate interest in replying to you |
| Keep the app secure and prevent abuse | Technical data | Our legitimate interest in a service that is not abused |
| Measure how the app is used, so we can improve it | Analytics storage | Your consent, which you can withdraw at any time |
| Show advertising, including advertising chosen for your interests | Advertising storage and identifiers | Your consent. PENDING LEGAL REVIEW: confirm the basis and the disclosure required for ad personalisation in each market |
Consent is genuinely optional
The last two rows are the only purposes that depend on consent, and refusing them does not reduce your access to any lesson or feature. You can change your mind at any time on the Manage Privacy Preferences page.
5. Automated decisions
The app schedules your reviews automatically from how well you recalled each item, and picks which lesson to offer next. That is teaching, not a decision with legal or similarly significant effects on you, and you can override it by choosing a different lesson.
We do not make decisions about you by automated means alone that produce legal or similarly significant effects. Where a person's access, refund or account status is in question, a human makes and records the decision.
7. Where your data goes
PLACEHOLDER FOR LEGAL AND THE DPO: name the countries data is processed in and the transfer mechanism relied on for each provider above, in particular Google's advertising infrastructure, the hosting provider, and PayHere in Sri Lanka.
8. How long we keep it
PLACEHOLDER FOR LEGAL AND THE DPO: every period below needs setting and justifying. The structural facts are already fixed by the app's design and are stated accurately here.
| Record | Kept for |
|---|---|
| Your account | While your account exists |
| Your learning data (profile, progress, reviews, saved words, settings) | While your account exists; deleted with it |
| Your billing details | PENDING: to be set by Legal |
| Payment and refund records | PENDING: to be set by Legal, but note these are kept after account deletion because they are accounting and dispute records |
| Subscription requests approved by an administrator | PENDING: also kept after account deletion, as the record of why access was granted |
| Corrections you suggested to lesson content | Kept after account deletion, because the correction becomes part of the content's editorial history |
| Messages you sent us | PENDING: to be set by Legal |
| Your cookie choice | In your own browser only, until you change or clear it |
What deletion does not remove
Deleting your account removes your profile, progress, reviews, saved words and settings. It does not remove the payment, refund, access-grant and content-correction records listed above, which are kept without your account attached to them.
9. Your rights
You can ask for a copy of your data, ask us to correct or delete it, ask us to restrict how we use it, object to our using it, ask for it in a portable format, and withdraw any consent you gave. The EU Privacy Rights page explains each right and how to use it.
Write to PLACEHOLDER: privacy@example.com, or use the Feedback page and choose the privacy topic.
10. How we protect it
Passwords are stored only as a salted hash. Traffic to the app is encrypted in transit and the app refuses to be embedded in another site. Locked course content is removed on the server before a page is sent, so a lesson you have not bought never reaches your browser at all. Access to production data is limited to the people who need it.
No system is perfectly secure. If a breach affects your data and is likely to put you at risk, we will tell you and the relevant authority as the law requires.
11. Children
Our own accounts are for people aged 13 and over. Children below that age use the app through a children's profile set up by a parent or guardian.
A children's profile has no AI conversation, no advertising and no storage beyond what is strictly necessary, so no consent question is put to a child.
PENDING LEGAL AND DPO REVIEW: the lawful basis for a children's profile, the guardian consent mechanism, and the collection and retention of a guardian's email address.
12. Changes to this policy
We will update this policy when what we do changes. Where a change matters to you we will tell you in the app or by email. If the change affects what you consented to, we will ask again rather than assume.
13. If you are unhappy
Please tell us first at PLACEHOLDER: privacy@example.com; we would rather fix it. You also have the right to complain to a data protection authority, including PLACEHOLDER: lead supervisory authority or the authority where you live.