Privacy Policy

Lingrow is operated by David Felix, based in Portugal, who acts as the data controller for the personal data described here. You can reach us through the contact page.

• Account data: email address, display name, username, and an optional gender used to personalise your character.
• Learning data: the languages, words, translations, and images you add, and your practice results such as streaks and review history.
• Connection data: the teachers, students, or friends you connect with, and the languages you grant them access to.
• Payment data: if you subscribe, our merchant of record Paddle collects your payment details. We never see your card number. We store only your plan, subscription status, and a Paddle customer reference.
• Usage data: standard technical information such as approximate location, device and browser type, and anonymous usage statistics.

We use your data only to run Lingrow: to authenticate you, store and schedule your vocabulary, show your progress to teachers you have connected with, process your subscription, respond to your messages, and understand how the app is used so we can improve it. The legal bases are the performance of our contract with you, our legitimate interest in improving and securing the service, and your consent where required. We do not sell your data and we do not use it for third party advertising.

When you use AI features, the words you ask to illustrate or describe are sent to Google's AI services to generate the content, and the result is stored with your vocabulary. We do not use your data to train AI models.

Lingrow's spaced repetition algorithm automatically schedules when each word comes back for review based on your answers. This is the core of the service and has no legal or similarly significant effect on you. We do not use your personal data for automated decision making that produces such effects.

• Google Firebase (Google Cloud) hosts our database, file storage, and authentication, in the europe-west1 region (Belgium).
• Paddle acts as merchant of record for payments and processes billing data under its own privacy policy.
• Google Analytics for Firebase provides anonymous usage statistics.

Where any processing happens outside the European Economic Area, it is covered by the European Commission's standard contractual clauses or an adequacy decision.

We protect your data with appropriate technical and organisational measures, including:

• TLS encryption for all data transmitted between your device and our servers.
• Password hashing via Firebase Authentication, passwords are never stored in plain text.
• Access rules so teachers can only see the data a student has explicitly granted.
• Secure file storage with per user access rules.
• Regular monitoring of security vulnerabilities and dependency updates.

No system is completely immune to breaches. If a personal data breach is likely to put your rights and freedoms at risk, we will notify the Portuguese supervisory authority (CNPD) within 72 hours of becoming aware of it, and inform affected users without undue delay, as required by Articles 33 and 34 of the GDPR. If you believe your account has been compromised, contact us immediately.

• Account and learning data: until you delete your account or role profile, then removed right away.
• Billing records: held by Paddle for up to 10 years, as required by tax and accounting law.
• Analytics data: up to 14 months, aggregated and anonymised.
• Support messages: up to 3 years after the conversation is closed.

Lingrow is used by students, including minors, often in a school or tutoring context. Users under 16 need the consent of a parent, guardian, or school. Teachers only see the learning data a student explicitly grants: vocabulary, practice progress, and streaks, never the student's private account details, except that if a granted language becomes unavailable due to your plan, the teacher may see a message explaining that so they understand why.

We use the local storage and cookies needed to keep you signed in and remember preferences such as your active role, plus Firebase Analytics cookies for anonymous usage statistics. We do not use advertising or cross site tracking cookies.

Under the GDPR you can ask for access to your data, correction, deletion, portability, or restriction of processing, and you can object to processing based on legitimate interest. Most of this you can do yourself in the app: edit your profile in Settings, or delete your account entirely. For anything else, contact us and we will respond within one month. You also have the right to complain to a supervisory authority; in Portugal that is the CNPD (Comissão Nacional de Proteção de Dados).

If we change this policy in a meaningful way, we will notify you by email or in the app before the change takes effect.