Privacy Policy

1. Scope, and who is responsible

This policy covers the Langulect mobile application for Android (com.langulectapp, the “app”) and the website at langulect.com (the “site”). Together we call these the “Service”.

Langulect is an independent project. For the purposes of the UK and EU General Data Protection Regulation, the developer of Langulect is the data controller for the information described here, and can be reached at langulect@gmail.com.

This policy does not cover services operated by others, even where Langulect relies on them. Google Sign-In, Google Play, and the speech recognition and text-to-speech built into your Android device are Google’s services, governed by Google’s Privacy Policy. Section 8 sets out exactly where the boundary falls.

2. Terms used in this policy

Four words carry specific meanings, and using them loosely is how privacy policies become unreadable:

• Personal information means information that identifies you or could reasonably be linked to you, such as your email address or your account identifier.
• Account means the Langulect account created when you sign in with Google. It is separate from your Google account, which we do not control.
• On your device means processed on your phone, with no copy sent to us. Where we say this, we mean it literally.
• Friend means another learner you have deliberately connected with by exchanging friend codes. It never happens automatically.

3. Information we collect

We collect three kinds of information: what you give us when you sign in, what your learning generates, and the minimum technical information needed to answer a network request.

3.1 Account information you provide through Google

Langulect uses Google Sign-In so that you do not have to create and remember another password. When you sign in, Google provides us with a limited profile:

• your Google account identifier, the stable key your progress is stored under;
• your email address, used to identify your account and to answer you if you contact us;
• your display name, shown to friends you add;
• a link to your Google profile picture, shown alongside your name.

We never receive your Google password, and we have no access to your Gmail, contacts, files, or anything else in your Google account. If you change your name or picture in Google, what Langulect shows changes with it, because we store the link rather than a copy of the image.

Langulect can also be used without any account. In that case no personal information is collected at all: everything stays in the app’s private storage on your phone, nothing is transmitted, and if you uninstall the app it is gone.

The app additionally supports email-and-password accounts. Where that option is offered and you use it, we store the email address you supply and a salted cryptographic hash of your password — never the password itself. We therefore cannot tell you your password, and neither could anyone who obtained our files.

3.2 Information generated by your learning

This is the substance of the Service, and the reason an account is worth having. We store, associated with your account:

• the language course you chose;
• which lessons and units you have completed;
• your HO total, your daily streak, and the date you were last active;
• your preferences, such as whether AI assist and learning tips are switched on;
• the date the app was first installed, used to keep your streak honest across devices;
• timestamps recording that you accepted this policy, our Terms, and Google’s Gemma model licence.

We do not store the individual answers you give during a lesson on our servers. Which words you find difficult is worked out on your device to decide what to review next, and stays there.

3.3 Friends and group sessions

Every account has a short friend code derived from your account identifier. Sharing it, or scanning another learner’s QR code, connects the two accounts.

Once connected, a friend can see:

• your display name;
• your profile picture;
• your HO total, so the leaderboard can rank you.

They cannot see your email address, your lesson history, your streak details, your other friends, or anything else. You can remove a friend at any time, which stops the exchange immediately. Group session codes are short-lived and exist only to place two people in the same practice run; they carry no personal information beyond what is described here.

3.4 Device and technical information

When the app communicates with our server, the server necessarily observes the request in order to answer it, including your IP address and the time of the request. This is used to operate the Service, to keep it secure, and to diagnose faults. It is not used to build a profile of you, and it is not combined with your learning data for any analytical purpose.

Langulect also uses the Google Play Integrity API to confirm that the copy of the app on your device is genuine and was installed from Google Play. This protects you from repackaged builds carrying malware. The result is a verdict about the app and the device — not about you — and we do not store it.

3.5 Your microphone

Speaking exercises need the microphone, and Android asks your permission before the first recording. Two distinct things happen to that audio, and the distinction matters:

• Pronunciation and melody scoring happens on your device. The audio is measured as it is captured — loudness, pitch movement, timing — and discarded immediately afterwards. No file is written and nothing is uploaded.
• Speech recognition is performed by your device’s own speech service, not by Langulect. On most Android phones that service is provided by Google, and depending on your device and settings it may process the audio on Google’s servers under Google’s Privacy Policy. We neither control nor receive that processing; the app only receives the text that comes back.

Langulect never listens in the background, never records outside an exercise you started, and never sends audio to our servers. If you decline microphone permission, speaking prompts fall back to self-assessment and lessons still complete normally.

3.6 Your camera

Adding a friend in person can be done by scanning their QR code. That scan takes place entirely inside Google Play Services, which is why Langulect requests no camera permission at all and never receives an image. We receive only the decoded friend code.

3.7 Cookies and the website

This site sets no cookies, runs no analytics, and embeds no tracking pixels or social widgets. It loads a web font from Google Fonts, which means Google receives the request for the font file. Everything else is served from langulect.com.

4. Information we deliberately do not collect

Stating this plainly is more useful than leaving it to be inferred. Langulect does not collect, and has never collected:

• your precise or approximate location;
• your contacts, call logs or messages;
• a list of the other apps on your device;
• any advertising identifier, and we do not use one to profile you;
• payment information — Langulect is free and we operate no payment system;
• biometric data. Your voice is measured for pronunciation and discarded; no voiceprint is created, stored or used to identify you;
• any special category data such as health, religion, ethnicity or political opinions.

5. How we use information

We use the information described in section 3 to:

• provide the Service — save your progress, restore it on a new device, and keep your streak accurate;
• run features you asked for — friends, leaderboards and group sessions;
• adapt the teaching — decide which words to review based on the mistakes you make;
• keep accounts secure — authenticate you, detect abuse, and verify the app has not been tampered with;
• fix and improve the app — diagnose faults reported to us;
• communicate with you — reply when you write to us;
• comply with the law — where we are legally required to act.

We do not use your data to train artificial intelligence models, ours or anyone else’s. The AI tutor is a pre-trained model supplied by Google that runs on your device; it does not learn from you and it does not report back.

We do not use your information for automated decision-making that has a legal or similarly significant effect on you. Choosing which vocabulary to revise is the extent of it.

6. Our legal bases (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under Article 6 of the GDPR:

• Performance of a contract — for account information and learning progress. Without these we cannot provide the Service you asked for.
• Consent — for microphone access, and for downloading the on-device AI model. Both are optional, both are asked for explicitly, and you can withdraw either at any time in Settings or in your Android permission settings.
• Legitimate interests — for security, abuse prevention and fault diagnosis. We have considered your interests and limited this to what is needed to keep the Service working safely.
• Legal obligation — where the law requires us to retain or disclose information.

7. On-device AI

Langulect’s AI tutor is Google’s Gemma model, and it runs entirely on your phone. This is an architectural decision with a direct privacy consequence: the sentences you attempt, the text you write and the audio you record are processed locally and are never transmitted to us or to anyone else for AI processing. There is no server doing the thinking, so there is no server-side record of what you asked.

Because the model is several gigabytes it is not included in the app. When you switch AI assist on, and after you have accepted Google’s Gemma Terms of Use, the app downloads it once from our server over Wi-Fi. From our side that is an ordinary static file request: nothing identifying you is attached to it, and we do not log which account downloaded the model.

You can delete the model from Settings at any time, which frees the storage. The app then falls back to its built-in offline tutor, and every feature continues to work.

8. How we share information

We do not sell your personal information, and we do not share it for advertising or cross-context behavioural advertising. The complete list of parties involved in running Langulect is short, and each has a specific and limited role.

8.1 Service providers and infrastructure

• Our hosting provider. Your progress is stored on a server we rent from an infrastructure provider. They supply the machine and the network; they do not access your data for any purpose of their own and act only on our instructions.
• Google. For sign-in, distribution through Google Play, Play Integrity verification, QR scanning through Play Services, and — on most devices — speech recognition and text-to-speech. Google’s handling of that data is governed by its own policy, not this one.

8.2 Other learners

Only the friends you have deliberately added, and only the limited profile set out in section 3.3.

8.3 Legal and safety

We may disclose information where we are legally required to do so, or where it is necessary to investigate a violation of our Terms, to prevent fraud or abuse, or to protect the rights, safety or property of our users, the public, or us. We will resist requests that appear overbroad or improperly made.

8.4 Business transfers

If Langulect is ever sold, merged or otherwise transferred, your information may transfer as part of that transaction. This policy would continue to apply to the transferred information until you were given notice of a replacement.

9. Where your information is held

Our servers are located in Europe. If you use Langulect from elsewhere, your information is transferred to and stored there, and may be accessed by us from other countries in order to operate and support the Service.

Where we transfer personal data out of the EEA or the UK, we rely on appropriate safeguards, including the European Commission’s standard contractual clauses and the UK international data transfer addendum, as applicable.

10. How long we keep information

• Account and learning data: kept for as long as your account exists. That is the purpose of having one.
• After you delete your account: the account record, your progress document and your entry in our friend-code index are removed from our active systems immediately.
• Backups: the server is backed up daily and backups are retained for up to 30 days before expiring. A deleted account may therefore persist in a backup for that window. We do not restore individual accounts from backups, and backups are not used to re-create deleted data.
• Correspondence: if you email us, we keep the exchange for as long as needed to resolve the matter and to have a record of it.
• Server logs: operational logs rotate on a short cycle and are not retained for analysis.

A friend’s device may hold a stale copy of your friend code until their app next refreshes, at which point the code no longer resolves to anything.

11. Deleting your account and data

You can delete everything yourself, from inside the app:

1. Open Langulect and go to the Settings tab.
2. Under Account, tap Delete account.
3. Confirm twice. The second prompt is the point of no return.

This permanently and immediately removes:

• your account record, and the link between Langulect and your Google account;
• your email address, display name and profile picture link as held by us;
• all of your learning data: completed lessons, HOs, streak and chosen course;
• your friends list and your friend code, so friends stop resolving it;
• the copy of your progress stored on the device you are using.

It cannot be undone, and we cannot recover it for you afterwards. Signing in again later creates a new and empty account.

If you cannot reach the app — a lost or broken phone, for example — email langulect@gmail.com from the address attached to your account and ask us to delete it. We will verify that the request comes from the account holder, complete it within 30 days, and confirm when it is done.

Deleting your Langulect account does not delete your Google account, and does not by itself withdraw Langulect’s access to Google Sign-In. You can review and remove that at myaccount.google.com/connections.

12. Your rights and choices

12.1 Everyone

Much of this needs no request. Your learning data is visible in the app; your name and picture come from your Google account and change when you change them there; microphone access is revocable in Android settings; the AI model can be deleted in Settings; and account deletion is a button, not a form.

12.2 European Economic Area and United Kingdom

Under the GDPR you have the right to:

• access the personal data we hold about you, and receive a copy;
• rectify data that is inaccurate or incomplete;
• erase your data (“the right to be forgotten”);
• restrict or object to our processing;
• data portability — receive your data in a structured, machine-readable format;
• withdraw consent at any time, where we rely on it;
• lodge a complaint with your national supervisory authority.

We would rather you raised it with us first, because most issues are quicker to fix than to adjudicate.

12.3 California

Under the CCPA as amended by the CPRA you have the right to know what personal information we collect and how we use it, to request access to it or its deletion, to correct inaccuracies, and to not be discriminated against for exercising those rights.

We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing for a “Do Not Sell or Share My Personal Information” link to switch off. We do not offer financial incentives in exchange for personal information, and we do not use or disclose sensitive personal information for purposes requiring a right to limit.

12.4 Other jurisdictions

Residents of other US states with comprehensive privacy laws, and of other countries with equivalent regimes, have comparable rights. We apply the same process to every request regardless of where you live: it is simpler, and it is fairer.

12.5 How to make a request

Email langulect@gmail.com from the address attached to your account, and tell us what you want. We will respond within 30 days, or tell you if we need longer and why. There is no charge. If we cannot verify that a request comes from the account holder we will decline it, which protects you from someone else deleting or exporting your data.

13. How we protect information

• All traffic between the app and our servers is encrypted with HTTPS, and release builds of the app refuse unencrypted connections outright.
• Passwords, where they exist, are stored only as salted hashes, never in a form that can be reversed.
• Session credentials are held in the Android keystore, not in ordinary app storage.
• Each account’s data is stored in a separate record, and the Service runs as an unprivileged user confined to its own files, so a fault in one part of the system cannot read another’s data.
• The data directory is not readable by other applications on the server, and backups are kept outside the web root.

No system is perfectly secure and we will not claim otherwise. If you believe you have found a vulnerability, please report it to langulect@gmail.com before disclosing it publicly, and allow us a reasonable opportunity to fix it. We will not pursue good-faith security research.

14. Children and teenagers

Langulect is not directed at children. You must be at least 13 years old to use it, at least 16 if you are in the European Economic Area or the United Kingdom, or older where your country sets a higher age for consenting to online services.

We do not knowingly collect personal information from anyone below those ages, and we do not knowingly serve them. If you are a parent or guardian who believes a child has created an account, email langulect@gmail.com and we will delete the account and its data.

15. Changes to this policy

We will update this page as the app changes, and the date at the top will change with it. Older versions are superseded on the effective date shown.

If a change materially affects how we handle your information, we will not rely on you noticing a new date on a web page: the app will ask you to review and accept the updated policy before you continue. Where the law requires your consent for a change, we will ask for it.

16. How to contact us

One address handles everything — support, privacy questions, data access and deletion requests, and security reports: langulect@gmail.com.

It is a real inbox that a person reads. To help us find your account, please write from the email address your Langulect account uses, and say what you would like us to do.

See also our Terms of Service, which govern your use of the Service.