Privacy Policy

1. Data Controller

Operated by: LingoWave

Based in Poland

Contact email: contact@lingowave.io

2. What Data We Collect

2.1 Account Information

When you create an account, we collect:

• Email address (required for account creation and login)
• Username (chosen by you)
• Password (hashed and stored securely by AWS Cognito — we never have access to your plaintext password)
• Language preferences (your native language, studied language, and UI language)
• Proficiency level (A1–C1, selected by you)

If you sign in with Google OAuth, we also receive your Google email address and display name from Google. We do not receive or store your Google password.

2.2 Learning & Progress Data

As you use LingoWave, we collect data about your learning activity:

• Exercise results — answers, accuracy, duration, type
• Word progress — words practiced, success rate, mastery level
• Assignment history — topics, templates, exercises completed
• Collections — word lists you create
• Achievements — milestones unlocked
• Daily statistics — words and exercises per day, streaks
• Learning goals — your daily targets

2.3 Voice & Audio Data

LingoWave offers optional voice features for conversation practice and exercise input. When you use these features, your voice is processed by a third-party AI service (OpenAI) and converted to text. We do not store raw audio recordings — only the transcribed text is retained. Pronunciation audio (text-to-speech) is generated by Google Cloud and does not involve any personal data.

2.4 User-Submitted Content

When you paste text, provide a URL, or upload a PDF for context-based exercises, this content is sent to our AI providers (OpenAI and Google Gemini) for content extraction and exercise generation. Uploaded files are processed and then deleted. The extracted vocabulary and generated exercises are stored.

2.5 Analytics Data (with your consent)

If you accept analytics cookies, Google Tag Manager, Google Analytics 4, and Mixpanel collect usage data including pages visited, features used, device type, interaction patterns, and traffic source (e.g. which campaign or link brought you to the site). We do not track analytics unless you explicitly consent via the cookie banner. No names or email addresses are sent to Google Analytics or Mixpanel. Mixpanel data is processed in its EU infrastructure.

2.6 Contact Form Data

If you submit the contact form, we collect your name, email address, and message. This data is transmitted via Resend (email delivery service) to our support inbox. We do not use contact form data for marketing.

2.7 Technical Data

IP addresses are transmitted to our servers and third-party services as part of standard HTTPS requests. We do not explicitly log or store IP addresses in our application database. Device and browser information is collected by Google Analytics if you consent to analytics cookies.

3. How We Use Your Data

We use your data to:

• Provide and operate the LingoWave service, including generating exercises and tracking your progress
• Process voice input when you choose to use voice features
• Analyze how the platform is used and improve it (only with your consent, via the cookie banner)
• Respond to your support inquiries
• Send account-related emails (verification, password reset)
• Ensure security and prevent abuse

Our legal bases under GDPR include: performance of the contract with you (providing the service you signed up for), your consent (analytics, voice features), and our legitimate interest (security, responding to inquiries).

We do not sell your personal data. We do not use your data for advertising. We do not share your data with third parties for their own marketing purposes.

4. Third-Party Data Processing

LingoWave relies on the following third-party services to operate:

OpenAI — Powers AI features including exercise generation, dialogue, and voice input transcription. Some of your learning data, submitted content, and voice input may be transmitted to OpenAI for processing. Per OpenAI's policy, API data is retained for up to 30 days for abuse monitoring and is not used to train their models.

Google Gemini — Powers additional AI generation features including exercise and content generation alongside OpenAI. Your submitted content and learning data may be transmitted to Google's Gemini API for processing. Per Google's API terms, paid API data is not used to train their models.

Google Cloud — Provides text-to-speech pronunciation and translation. Only the text being processed is sent — no personal identifiers are included.

Mixpanel — Product analytics. If you consent to analytics cookies, usage events (pages visited, features used, traffic source) and an anonymous identifier are sent to Mixpanel so we can understand how the product is used. No names or email addresses are sent. Data is processed in Mixpanel's EU infrastructure.

AWS — Handles user authentication (hosted in EU, Frankfurt) and file storage.

Resend — Delivers contact form emails from the landing page.

5. Cookies & Tracking

Essential Cookies (Always Active)

Analytics Cookies (Require Consent)

You can change your cookie preferences at any time via the "Cookie Settings" link in the footer (landing page) or in Profile → Cookie Settings (app).

6. Data Storage & Security

• Database: MongoDB hosted in the EU
• Authentication: AWS Cognito in eu-central-1 (Frankfurt)
• File storage: AWS S3

Some data is processed outside the EU (OpenAI and Google Cloud, in the United States). Appropriate safeguards are in place, including Standard Contractual Clauses (SCCs).

We implement reasonable security measures: HTTPS encryption, hashed passwords, JWT authentication, server-side API key storage, and signed URLs with short expiration for uploads.

7. Data Retention

You may request deletion of your data at any time by contacting us at contact@lingowave.io.

8. Your Rights (GDPR)

If you are located in the EU/EEA, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion ("right to be forgotten")
• Restrict processing
• Data portability
• Withdraw consent at any time
• Object to processing based on legitimate interest
• Lodge a complaint with your data protection authority. In Poland: the President of UODO at uodo.gov.pl

To exercise your rights, contact us at contact@lingowave.io. We will respond within 30 days.

9. Children's Privacy

LingoWave is intended for users aged 16 years and older (in the EU) or 13 years and older (outside the EU). We do not knowingly collect data from children below these thresholds. If you believe a child has provided data to LingoWave, contact us at contact@lingowave.io.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. For significant changes, we will notify you via the app.