Privacy Policy

Lingoo — AI Language Tutor
Last updated: 29 April 2026
Effective: 1 May 2026

This Privacy Policy describes how Lingoo ("we", "our", or "us") collects, uses, and shares your personal information when you use the Lingoo mobile application (the "App") and related services.

1. Who we are

Lingoo is operated by Błażej Sułtanowski (Sole Trader / Solo Developer), based in Poland. Contact: blazej.sultanowski@gmail.com.

2. What we collect

2.1 Information you provide

Account data — email address, password (hashed), and Google account ID if you sign in with Google.
Profile data — your native language, target language, learning level, daily goal, and tutor preference.
Voice input — audio recordings made during conversations with AI tutors. Audio is sent to our speech-to-text provider (OpenAI Whisper) and is not retained by Lingoo or OpenAI after transcription.
Conversation content — text of your messages and the tutor's responses, used to track your progress and quest completions.
Payment data — handled by Stripe. We never see or store your full card number; we only receive a customer ID and subscription status.

2.2 Information we collect automatically

Device ID — a random identifier we generate and store locally to enforce daily usage limits on the free plan. Not linked to advertising IDs.
Usage data — number of conversations, minutes practiced, XP earned, badges, streak — used to power the in-app progress system.
Crash reports — via Sentry. Includes device model, OS version, app version, and stack traces. Does not include conversation content.

2.3 What we do NOT collect

We do not collect precise location.
We do not use third-party advertising SDKs or trackers.
We do not sell, rent, or trade your personal information.
We do not retain audio recordings after transcription.

3. How we use your information

To provide AI tutoring conversations (text + speech).
To track your learning progress, streak, XP, and badges.
To enforce free-plan daily usage limits.
To process subscription payments (via Stripe).
To diagnose crashes and improve app stability (via Sentry).
To respond to your support requests.

4. Third-party services we use

Service	Purpose	Data shared
OpenAI	AI conversation, speech-to-text, text-to-speech	Message text, audio (transcribed then deleted)
Supabase	Authentication, cloud sync of progress	Email, hashed password, learning progress
Stripe	Subscription billing	Customer ID, email, payment metadata
Cloudflare	API proxy and rate limiting	Device ID, request metadata
Sentry	Crash reporting	Device metadata, stack traces, anonymized user ID
Google	Sign-in with Google (optional)	Email, Google account ID

5. Data retention

Account data — kept while your account is active. Deleted within 30 days of account deletion request.
Voice recordings — never retained after transcription (typically <5 seconds in transit).
Conversation history — kept locally on your device (AsyncStorage). Optional cloud sync to Supabase. Deleted on request.
Payment records — retained by Stripe for 7 years per US tax law.
Crash reports — retained by Sentry for 90 days.

6. Your rights

Depending on where you live, you may have the following rights:

Access — request a copy of your data.
Correction — fix inaccurate data.
Deletion — delete your account and all associated data.
Portability — receive your data in a machine-readable format.
Opt-out — withdraw consent (where applicable).

6.1 California (CCPA/CPRA)

California residents have the right to know what personal information we collect, the right to delete it, the right to correct it, and the right to opt out of sale or sharing. Lingoo does not sell or share personal information for cross-context behavioral advertising. To exercise your rights, email blazej.sultanowski@gmail.com.

6.2 Europe (GDPR)

If you are in the EU, EEA, or UK, the legal basis for processing your data is (a) performance of a contract (providing the App), (b) your consent (for crash reporting and Google Sign-In), and (c) our legitimate interest in operating and improving the App. You have the right to lodge a complaint with your local data protection authority.

6.3 To exercise any right

Email us at blazej.sultanowski@gmail.com with the subject "Data request". We respond within 30 days.

7. Children's privacy

Lingoo is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it. (COPPA, USA)

8. International data transfers

Your data may be processed in the United States (OpenAI, Stripe, Sentry, Cloudflare) and in the European Union (Supabase EU region). All transfers rely on Standard Contractual Clauses (SCCs) or equivalent safeguards.

9. Security

We use HTTPS for all network traffic, store API keys server-side only (never in the app binary), use Supabase Row Level Security to isolate user data, and never log raw audio. Despite our best efforts, no method of transmission over the internet is 100% secure.

10. Changes to this policy

We may update this policy from time to time. Material changes will be communicated through the App or by email. The "Last updated" date at the top reflects the most recent revision.

11. Contact

Questions about this policy or your data? Email blazej.sultanowski@gmail.com.