Privacy Policy
Last updated 2026-10-06
Who we are
Open Lingo (“we”, “us”) operates the Open Lingo website, the Open Lingo iPhone and iPad app, and related services. This policy describes how we handle information when you use our site and apps.
We are an independent learning project. If you have questions, use the contact method listed at the bottom of this page.
We do not sell your data
We do not sell, rent, or trade your personal information to data brokers or advertisers for their own marketing lists.
Our business model is not based on monetizing your identity. Any advertising (see below) is served by Google under its own policies: on the website only if you consent to advertising cookies, and in the app only when you choose to watch a rewarded video.
What we collect and why
We collect and process only what is needed to provide the service:
- Account identity — When you sign in, our authentication provider (Auth0) gives us a stable account identifier and basic profile fields you choose to share (such as email and display name). We use this to recognize you across devices.
- Learning data — Lesson progress, XP, streaks, flashcard review history (SRS), deck subscriptions, and settings and preferences you save in the app. This is stored on our servers so your study can sync and continue on other devices.
- Profile and social data — Your username, display name, profile picture (an image link you provide) and bio, and your friends, friend requests, blocks and leaderboard standings (see “Profiles, friends and safety” below).
- Content you create — If you publish community decks or stories, that content is stored and shown according to the visibility you choose.
- Diagnostics — Error reports from the app and any problem reports you send us (see “Diagnostics and problem reports” below).
- Technical data — Standard server and security logs (IP address, user agent, timestamps) may be kept briefly to operate and protect the service.
- Local device storage — The app stores settings, offline review queues, and similar data on your device (browser storage on the web, app storage on iPhone and iPad) until you clear it, sign out, or delete your account.
Authentication (Auth0)
Sign-in is handled by Auth0. Their privacy policy applies to how they process credentials and session data: https://auth0.com/privacy
We receive only the profile and identifier needed to link your Auth0 account to your Open Lingo user record.
Microphone and speech recognition
Speaking exercises use your microphone, and only after you allow it. The microphone is used only while a speaking exercise is listening to you; you can skip speaking exercises or turn off microphone access at any time in your device settings.
In the iPhone and iPad app, your speech is turned into text by Apple’s Speech framework: on your device when Apple’s offline model for that language is available, and through Apple’s speech service otherwise. Apple’s privacy policy applies to that processing: https://www.apple.com/legal/privacy/
On the website, speaking exercises use your browser’s built-in speech recognition, which may send your audio to the browser maker (for example Google for Chrome or Apple for Safari) under that company’s policy.
We never receive or store your voice recordings. The app compares the recognized text with the expected answer on your device. The recognized text from recent speaking attempts can be included in an error report or a problem report (see “Diagnostics and problem reports” below), together with the expected answer, so we can see why an answer was or wasn’t accepted.
Ads in the app (Google AdMob)
The iPhone and iPad app can show a rewarded video ad from Google AdMob, and only when you choose to watch one in exchange for an in-app reward. The app does not show banner or other ads you didn’t ask for.
We request non-personalized ads: we ask Google not to personalize the ads you see based on your activity. The app does not ask for permission to track you (App Tracking Transparency) and does not use your data to track you across other companies’ apps and websites. Where the law requires it (for example in the EEA and UK), Google’s consent form is shown before any ad is requested.
When an ad loads, Google may collect device identifiers, approximate location derived from your IP address, and ad interaction and performance data, to serve the ad, measure it, and prevent fraud. We also pass Google our internal account identifier for your account so that Google can confirm to our server that you finished the video and we can credit the reward. Google’s policies and your choices are described at https://policies.google.com/privacy and https://policies.google.com/technologies/partner-sites
Advertising on the website (Google AdSense)
We may show ads on the website through Google AdSense or similar programs to help fund free access. Ad networks may use cookies and similar technologies to show and measure ads.
We only enable advertising-related storage after you choose “Accept” on our cookie banner (or equivalent control in settings). You can withdraw consent at any time via cookie settings.
Google’s policies and your choices are described at https://policies.google.com/privacy and https://adssettings.google.com
If you subscribe to a paid tier in the future that removes ads, we will not show personalized ads to that account while the subscription is active.
Diagnostics and problem reports
When something goes wrong, the app sends an error report to our servers so we can fix it. A report contains the error message and technical details, the screen you were on, the app version and build, your platform and operating-system version, and a short list of your most recent in-app actions (for example which lesson step you were on and whether an answer was accepted). If you are signed in, it is tied to a one-way hash of your account identifier rather than your name or email. Email addresses, sign-in tokens and similar secrets are removed from reports before they are stored.
If you send us a problem report (“Report a problem”) or report another user, we store what you write together with your account, the screen and lesson step you were on, the app version and platform, recent errors, and a snapshot of the exercise on screen. A report notifies us by email and by a push notification to our own devices.
Error reports are kept in our server logs for 30 days. Problem reports are kept while your account exists and are deleted when you delete your account.
Service providers (subprocessors)
We use trusted providers to run the product. They process data only on our instructions, or under their own policies where noted:
- Amazon Web Services (United States, us-west-1) — hosting, database, server logs, email delivery for problem reports, and delivery of lesson audio and content
- Auth0 — sign-in
- Google — AdMob rewarded video ads in the app, and AdSense ads on the website if you consent to ad cookies (under Google’s own policies)
- Apple — speech recognition in the iPhone and iPad app, and App Store distribution (under Apple’s own policies)
- ntfy — push notifications to our own devices when a problem report arrives (a short preview of the report and your username)
- Ko-fi — only if you choose to support us on the website; Ko-fi shares the payment amount and your name and email with us so we can add your Supporter badge
How long we keep data
We keep account and learning data while your account is active. Some server logs are retained for a limited period (30 days for our application logs) for security and troubleshooting.
Community content you published may remain if licensed under open terms, but will no longer be attributed to your account after deletion.
Your rights and choices
Depending on where you live, you may have rights to access, correct, export, or delete personal data we hold about you.
You can delete your Open Lingo account in the app or on the website from Settings (signed in) with “Delete account”. This deletes your user record, settings, learning progress, flashcard history, quests, friends, friend requests, blocks, messages, leaderboard entries, unpublished decks and stories, and problem reports. Published decks and stories and community forum posts stay, but are no longer linked to you; records of Ko-fi support payments keep the amount and date but lose your name and email. We also ask Auth0 to delete your sign-in identity; if any part of the deletion can’t finish right away, it continues automatically in the background.
To request help with privacy questions or to exercise these rights, contact support@linguiversal.com.
Children
Open Lingo is not directed at children under 13 (or the minimum age in your country). We do not knowingly collect personal information from children. Contact us if you believe a child has provided data and we will delete it.
Changes to this policy
We may update this policy as the product changes. We will post the new date at the top of this page. Continued use after changes means you accept the updated policy.
Contact
For questions about this policy, support@linguiversal.com.
Profiles, friends and safety
Your username, display name, profile picture, bio, learning language, join date, streak and XP are shown on your public profile and on leaderboards to other learners. Your friends can also see which lessons you finished each day (not your scores), and you can exchange messages with friends where messaging is available.
You can block another learner: blocking removes them from your friends and cancels any friend requests between you. You can also report a learner. Reports go to our moderation queue, and we may remove content or suspend or ban accounts that abuse other learners or break our Terms.