LingoVault is a language-learning application. References to LingoVault, we, us, and our mean the LingoVault team responsible for operating the application. For privacy questions or requests, contact support@lingovault.app.

• Account and authentication data. We collect your email address, account identifiers, password hash if you set a password, email verification status, session data, security setup choices, onboarding status, and one-time code or password reset token records needed to authenticate your account.
• Learning and progress data. We store your active learning track, learner level, learning goals, daily study preferences, lessons or modules started and completed, seeded cards, flashcard content, review history, answers or rating metadata, word mastery state, topic and grammar signals, statistics snapshots, practice-session state, and app-tour progress.
• Billing and premium access data. If you start a trial, redeem a promo code, buy premium access, or manage billing, we store subscription status, plan type, access dates, promo redemption records, Stripe customer identifiers, Stripe subscription identifiers, Stripe price identifiers, cancellation status, and related billing events.
• Payment data handled by Stripe. Payment card numbers, bank details, and other sensitive payment credentials are collected and processed by Stripe, not stored directly by LingoVault. Stripe may provide us with payment, subscription, invoice, and customer status information needed to operate premium access.
• Support and feedback data. If you contact support or send feedback, we collect the message, category, page context, account email, learning track, and related metadata needed to respond and improve the app.
• Product analytics and attribution. We record first-party product events such as signup, onboarding completion, lesson starts, review milestones, practice and stats views, premium gates, checkout starts, billing portal opens, feedback submissions, and PWA install actions. If you accept optional cookies, we may also store first-touch attribution details such as UTM parameters, landing path, referrer origin and path, and first-seen time.
• Security and technical data. We process request metadata such as IP-derived rate-limit keys, timestamps, session identifiers, and logs to secure the service, prevent abuse, troubleshoot errors, and maintain reliability.

• Create, authenticate, secure, and maintain your account.
• Deliver lessons, reviews, spaced repetition, practice modes, progress statistics, grammar tracking, and topic tracking.
• Personalize your learning track, language, onboarding, review queue, and daily learning limits.
• Process premium access, trials, promo codes, subscription status, billing portal access, cancellations, and account deletion billing cleanup.
• Send transactional emails such as one-time verification codes, password reset messages, account notices, and support notifications.
• Respond to support requests, debug issues, measure product quality, and decide what to improve.
• Protect LingoVault from spam, fraud, abuse, unauthorized access, and service misuse.
• Comply with legal, tax, accounting, security, and payment obligations.

LingoVault uses a consent banner for optional cookies and local storage. Essential cookies and storage are required for core functionality and cannot be disabled inside the app without affecting how LingoVault works. You can still manage or delete cookies and local storage through your browser settings.

LingoVault does not use third-party advertising cookies or sell cookie data to advertising networks. If you choose Essential only, optional attribution cookies are not created and existing LingoVault attribution cookies are cleared by the app.

LingoVault uses Stripe for paid plans, checkout, subscription management, and billing portal access. Stripe processes payment credentials under its own terms and privacy policy. LingoVault stores only the billing identifiers and subscription state needed to grant premium access, reconcile webhooks, provide billing support, and handle account deletion billing cleanup.

You can review Stripe privacy information at stripe.com/privacy.

We use service providers to operate LingoVault, including hosting and infrastructure, database services, email delivery, payment processing, analytics infrastructure, logging, and course-audio generation or delivery. These providers may process information only as needed to provide services to LingoVault, protect the service, comply with law, or support their own security and operational obligations.

• With service providers that help us operate, secure, bill, support, analyze, and improve LingoVault.
• With Stripe when needed for checkout, subscription management, billing support, fraud prevention, refunds, disputes, taxes, or compliance.
• With email providers when sending authentication, account, support, or other transactional messages.
• If required by law, subpoena, court order, regulatory request, or to protect the rights, safety, and security of LingoVault, users, or the public.
• In connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to reasonable protections for user information.

We do not sell personal information. We also do not share personal information for cross-context behavioral advertising as that term is used in California privacy law.

Where GDPR-style privacy laws apply, our legal bases may include performance of a contract to provide the learning service, legitimate interests in securing and improving LingoVault, consent for optional attribution cookies and certain preferences, compliance with legal obligations, and your direction when you submit support requests or configure account settings.

We keep information only as long as reasonably needed for the purposes described in this policy. Account, learning, subscription, and statistics data are generally kept while your account remains active. One-time login and password reset tokens expire quickly and are invalid after use or expiration. Feedback, support, analytics, rate-limit, billing, tax, accounting, and security records may be retained for longer when needed for legitimate business, legal, fraud-prevention, dispute-resolution, or compliance reasons.

• You can manage optional cookie consent from the banner and clear cookies or local storage in your browser.
• You can update account and learning preferences in LingoVault settings where those controls are available.
• You can delete your LingoVault account from settings. Account deletion removes your LingoVault account data and attempts to cancel any active Stripe subscription before deletion.
• You can use the Stripe billing portal, when available, to manage paid subscription details.
• You can contact us to request access, correction, deletion, portability, restriction, or objection where applicable privacy laws give you those rights.
• You can unsubscribe from marketing emails if LingoVault sends them in the future. Transactional emails, such as verification codes and account notices, may still be sent when needed to operate the service.

We may need to verify your identity before fulfilling privacy requests. Some information may be retained where required or permitted by law, including billing, tax, security, fraud-prevention, or dispute records.

If California privacy law applies to LingoVault and to your personal information, the categories of personal information we collect may include identifiers, account information, commercial information, internet or electronic network activity, geolocation-derived signals such as country-level request headers, inferences related to learning progress or product usage, and information you submit through support or feedback. We use and disclose these categories for the purposes described in this policy.

LingoVault does not sell personal information and does not share personal information for cross-context behavioral advertising. We do not knowingly sell or share the personal information of users under 16.

LingoVault is not directed to children under 13 and is not intended for use by anyone who is not old enough to create an online account under the laws that apply to them. If you believe a child provided personal information to LingoVault, contact us so we can review and delete it where appropriate.

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. These include authentication protections, hashed one-time codes and password reset tokens, rate limiting, provider-level payment handling through Stripe, and account deletion controls. No internet or storage system can be guaranteed to be completely secure, so you should use a strong password, protect access to your email account, and contact us if you believe your account has been compromised.

LingoVault is operated from the United States. If you use LingoVault from another country, your information may be processed in the United States or other locations where our service providers operate. Those locations may have privacy laws that differ from the laws in your country.

We may update this Privacy Policy as LingoVault changes. If we make material changes, we will update the date above and may provide additional notice in the app or by email when appropriate. Your continued use of LingoVault after an update means the updated policy applies going forward.

For privacy, cookie, data access, deletion, billing-data, or support questions, contact support@lingovault.app or open the support page.