Privacy Policy

1. What data we collect

We collect only what the app cannot work without:

• Account: your email address and a hashed password. Plain passwords are never stored and cannot be recovered.
• Profile: your name and profile picture, if you provided them or they came from Google.
• Learning data: completed lessons, exercise scores, spaced-repetition state, interface settings.
• Technical data: IP address, browser type, request timestamps and session tokens. Needed for sign-in, rate limiting and abuse protection.
• Subscription data: the subscription id and status returned by the payment provider.

2. Signing in with Google

If you sign in with Google, we receive only the basic profile data you approve on the Google consent screen: your email address, whether it is verified, your name and your profile picture.

We do not request and cannot access the contents of your Gmail, Google Drive files, calendar or contacts. Our use of data received through Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements: this data is used only to create your account and sign you in, is never sold or shared with third parties, and is never used for advertising.

You can disconnect the Google account at any time by revoking access in your Google account settings or by deleting your lingflex account.

3. Microphone and voice

Pronunciation exercises (shadowing, dialogues) ask for microphone permission. Speech recognition is performed by your browser itself: only the recognised text is sent to our servers, and only to score the exercise.

It matters how this works technically: most browsers (Chrome, Edge and Safari among them) do not recognise speech on the device but on their vendor's servers. That means your voice during an exercise may be sent to the company that makes your browser and processed under its own privacy policy. We have no control over that and no access to that audio. If you would rather avoid it, do not grant microphone permission — the rest of the exercises work without it.

On our side, we do not record, store or share audio of your voice — it never reaches our servers at all. You can revoke microphone permission in your browser at any time — the rest of the exercises will keep working.

4. Why we use it

• To provide the service: create your account, store progress, choose the next lessons and reviews.
• To send service email: address confirmation, password reset, important service changes.
• To keep things secure: detect abuse, limit request rates, investigate incidents.
• To process subscription payments.
• To improve the product: we look at aggregated, de-identified lesson statistics, not at individual people.

Legal bases: performance of our contract with you (providing the service), our legitimate interest (security and product development), and your consent where it is required separately.

5. Who we share data with

We do not sell personal data and never share it for advertising. Data is processed only by providers the service depends on:

• Google — sign-in with a Google account.
• Resend — delivery of service email (your address is passed on).
• Monobank — payment processing. Card details are entered on the bank's side and never reach us.
• Cloudflare R2 — storage of lesson audio files.
• OpenAI — generation of learning content and speech synthesis. No user personal data is sent there.
• Our server and database hosting provider.

We may also disclose data where required by law or a court order.

6. Cookies and local storage

We use cookies and browser local storage only to run the service: to keep you signed in (session tokens) and to remember interface settings.

There are no third-party advertising or tracking cookies. If we add website analytics, we will update this section before it goes live.

7. How long we keep data

Account data and progress are kept for as long as the account exists. Deletion is available in the profile after a recurring subscription has been stopped. It removes your email, profile, settings, sessions, Google link, all lesson and exercise progress, local subscription data and payment history from Lingflex's live database. They cannot be restored.

Application log files are deleted automatically after 14 days. Infrastructure logs are kept only for a limited operational period needed for security and diagnostics.

Deleting the account does not delete records held independently by Monobank as the payment provider. Primary accounting or tax documents may be kept separately from the account for the minimum period required by law; they are not used for learning, marketing or account restoration.

De-identified aggregate statistics that cannot identify an individual may remain.

8. Your rights

• Get a copy of your data.
• Correct inaccurate data — some of it can be changed right in your profile.
• Delete your account together with your data directly in your profile.
• Withdraw consent where processing is based on it.
• Object to processing or ask us to restrict it.
• Lodge a complaint with a data protection authority.

To exercise any of these rights, write to our contact address — we will respond within 30 days of receiving your request. If a request is complex and we need longer, we will tell you before that period ends.

9. Children

The service is not intended for children under 13. If we learn that an account was created by a younger child, we will delete it.

10. Where data is processed

Servers and service providers may be located outside Ukraine, including in the European Union and the United States. We choose providers that maintain an adequate level of data protection.

11. Changes to this policy

We may update this document. The date of the latest update is shown at the top. We will announce material changes on the website or by email.

12. How to reach us

For any question about this data, write to the contact address listed in the details above.