What we collect

We collect only what's needed to run your account, teach the language, and keep the service secure.

• Account and authentication: email, account identifiers, password hash (if set), verification status, session, onboarding, and one-time code or password-reset token records.
• Learning and progress: active track, level, goals, study preferences, lessons started and completed, cards, review history, word mastery, topic and grammar signals, and statistics.
• Billing and premium access: subscription status, plan type, access dates, promo redemptions, and Stripe customer, subscription, and price identifiers.
• Support and feedback: the message, category, page context, and account email needed to respond.
• Security and technical data: request metadata such as IP-derived rate-limit keys, timestamps, session identifiers, and logs.

How we use it

• Create, authenticate, secure, and maintain your account.
• Deliver lessons, review, spaced repetition, practice, statistics, and grammar and topic tracking.
• Personalize your track, language, onboarding, review queue, and daily limits.
• Process premium, trials, promo codes, subscription status, the billing portal, and cancellations.
• Send transactional emails such as verification codes, password resets, and support notices.
• Protect LingoVault from spam, fraud, abuse, and unauthorized access.

Analytics & attribution

We record first-party product events such as signup, onboarding completion, lesson starts, review milestones, paywall views, checkout starts, and PWA installs. These help us understand what works and what to improve.

If you accept optional cookies, we may also store first-touch attribution: UTM parameters, landing path, referrer origin, and first-seen time. If you choose essential only, that cookie isn't created and existing ones are cleared.

Who we share with

We use a small set of trusted providers to operate LingoVault. Each one gets only what it needs to do its job — nothing more.

Cookies

Essential cookies and storage keep you signed in, protect authentication, remember the app language, and make review work. They can't be turned off without affecting how the app works.

Optional attribution cookies are only set after you accept them. We don't use third-party advertising cookies or sell cookie data. You can manage or delete cookies in your browser.

Your rights

• Manage optional cookie consent from the banner and clear cookies in your browser.
• Update account and learning preferences in Settings.
• Export your data or delete your account from Settings — deletion attempts to cancel any active Stripe subscription first.
• Use the Stripe billing portal to manage paid plan details.
• Request access, correction, deletion, or portability where applicable privacy laws give you those rights.

Retention

We keep information only as long as reasonably needed. Account, learning, and subscription data are kept while your account stays active. Login and reset tokens expire quickly. Billing, tax, security, and fraud-prevention records may be kept longer when required by law.

Security

We use reasonable administrative, technical, and organizational safeguards: authentication protections, hashed codes and tokens, rate limiting, provider-level payments through Stripe, and account-deletion controls. No system is fully secure, so use a strong password and protect access to your email.

Children

LingoVault is not directed to children under 13. If you believe a child provided personal information to us, contact us so we can review and delete it where appropriate.

Changes

We may update this policy as LingoVault changes. For material changes, we'll update the date above and may provide notice in the app or by email. Continued use after an update means the updated policy applies.

Questions

For privacy, cookie, data-access, or deletion questions, write to support@lingovault.app or open the support page.