Privacy Policy

LinguaLume · Last updated: August 4, 2026

This Privacy Policy explains what information LinguaLume ("we," "us," "our") collects when you use the LinguaLume app and website (the "Service"), how we use it, and the choices and rights you have. The Service is operated by Winden Enterprise LLC, a Florida limited liability company, doing business as LinguaLume, based in the United States.

1. Summary (the short version)

Most of your stories, vocabulary, and reading progress live on your device; an account lets that same data sync across devices via Supabase.
We assign your account an ID (via Supabase Auth) to run the Service and link your subscription — your email address is collected for sign-in codes and (where offered) Google Sign-In.
When you use AI features (story generation, translation, Deep View, listen-along, etc.), the relevant text is sent to our AI providers (DeepSeek and OpenAI) to produce the result.
Subscriptions are sold and billed by Paddle, our merchant of record (or Google Play, where offered) — we never see or store your card number.
We use PostHog for product analytics.
We do not sell your personal information, and we don't run advertising that shares your data with ad networks.

2. Information we collect

Data	Source	Why we collect it
Email address	You, at sign-up (sign-in code or Google Sign-In)	Account access, subscription linkage, transactional email (e.g. trial reminders)
Account ID	Supabase Auth	Authenticating API requests, linking your subscription to your account
Learning activity & progress (stories read, words met, reading time, streaks)	The app, as you use it	Powering your reading stats, the free-window meter, and personalization
Stories and other content you create or import, and the prompts you submit to AI features	You	Generating, translating, and displaying your stories; providing AI features
Content you choose to publish (public manuscript pages, Community posts/comments)	You	Displaying that content per your own sharing choice — see the Terms of Service §4
Purchase/subscription status	Paddle, via RevenueCat (or Google Play, where offered)	Unlocking Premium features; mirrored into our own database as an entitlement record
Device and usage/analytics data (screen views, feature usage, crash/error signals)	The app and website, via PostHog	Understanding onboarding, the paywall, and feature usage; fixing bugs
Local app data (stories, lexicon, settings not yet synced)	Your device	Offline use; this is the source of truth until/unless you have an account with sync enabled

We do not knowingly collect payment card numbers, government ID numbers, or precise geolocation.

3. How we use information

We use the information above to:

Operate and provide the Service (reading, generation, translation, audio, sync, Community, public pages);
Process and manage your subscription;
Detect and prevent abuse of the free window and fair-use limits (Terms §3.7);
Screen content you publish for policy violations (see the Content Moderation Policy);
Understand and improve the product, including through analytics;
Communicate with you about your account, subscription, and (if you don't opt out where an opt-out is offered) product updates.

We do not sell your personal information, and we do not share it with third parties for cross-context behavioral advertising.

4. Who we share information with (our service providers)

We use the following processors, each only as needed to deliver the parts of the Service you use:

Provider	What it does	What it may receive
Supabase	Authentication, account-linked data storage (synced stories/progress/preferences), entitlement records	Account ID, email, synced app data
PostHog	Product analytics (US-hosted)	Device/usage event data
RevenueCat	Subscription/entitlement management	Purchase and subscription status; no card data
Paddle	Merchant of record for web subscriptions — checkout, payment processing, tax/VAT, invoices, and refunds	Payment and billing details you provide at checkout, including the country/address needed to calculate tax; we don't receive or store your card number
Google Play	Billing, where a subscription is offered through Google Play	Purchase status; Google handles payment details directly
OpenAI	Translation, some AI generation, audio (text-to-speech), and content moderation screening	Text you submit for these features
DeepSeek	AI story generation (Write with Spark and related creative features)	The story premise, topic, or prompt text you provide, and the story text being generated
Resend	Transactional email delivery (sign-in codes, account email)	Your email address and the contents of those emails
Zoho Mail	Support mailbox (when you email us)	Whatever you include in your message to us
Vercel	Web app and marketing site hosting	Standard web request data (IP address, request logs)
Render	API server hosting	Standard web request data (IP address, request logs)

Each provider processes data under its own privacy terms and only for the purpose of providing its service to us.

5. What we don't do

We don't sell your personal information.
We don't run third-party advertising on the Service, and we don't share your data with ad networks.
We don't use your stories or private content to train third-party AI models beyond what's necessary to generate the response you asked for (i.e., the normal operation of sending your prompt to our AI providers to get a result back).
We don't require you to share your real name to read or write stories — Community identity uses a pen name and a chosen portrait, not your real name.

6. Data retention

Local device data stays on your device until you delete it, wipe app data, or uninstall the app.
Account-linked data is retained while your account is active, and for a limited period after account deletion as needed for backups, fraud prevention, and legal compliance, after which it's deleted or anonymized.
Published content is retained while published; unsharing or deleting removes it from public view, though we may retain a copy for a limited period for moderation and legal records.
Billing/subscription records are retained as required for accounting, tax, and legal compliance, generally longer than other account data.
Server logs are retained for a limited operational period for security and debugging.

7. Your choices, requests, and rights

7.1 Everyone

Local data: back up or wipe local app data from Settings on your device.
Subscriptions: manage or cancel under Settings → Subscription & billing (see Terms §3.4).
Unshare: take down a public manuscript page or Community post at any time from the app.
Deletion and access requests: email support@lingualume.com to request a copy of, or deletion of, your account-linked personal information. We currently handle these requests manually, by email. We'll confirm your identity (typically via the email address on your account) before acting on a request, and we'll respond within a reasonable time and in any event within any timeframe required by applicable law.

7.2 California residents (CCPA/CPRA)

If you're a California resident, you have the right to:

Know what personal information we've collected, used, and disclosed about you, and why;
Delete personal information we hold about you, subject to certain exceptions;
Correct inaccurate personal information;
Opt out of the sale or sharing of personal information — we don't sell or share personal information as those terms are defined by the CCPA, so there's nothing to opt out of today, but we state the right regardless and extend these practices to you whether or not the CCPA's thresholds technically apply to us at our current size;
Non-discrimination for exercising any of these rights.

To exercise any of these rights, email support@lingualume.com with "CCPA request" in the subject line.

7.3 Other US states

Several other states have similar consumer privacy laws. Residents of those states may use the same contact route above; we apply the practices in this policy to all users regardless of state.

8. Children

The Service is not directed at children under 13, and you must be at least 13 to create an account. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us personal information, contact support@lingualume.com and we'll delete it. Community posting has its own separate 13+ requirement stated in the Community Guidelines.

9. International users

LinguaLume is a US-based company operated primarily for a global English-speaking audience learning German. Your information is processed in the United States and Canada (our primary database is hosted in a Canadian region) and, for some service providers, in other countries where they operate — see §4. By using the Service, you understand your information will be transferred to and processed in these locations, which may have different data protection laws than your country of residence.

10. Cookies and analytics

The marketing site (lingualume.com) asks before storing anything: it uses PostHog (US-hosted) for privacy-respecting analytics, and shows a consent banner — if you decline, no analytics cookie is stored on your device. The web app uses PostHog product analytics (page views, feature usage, and similar events) to understand how LinguaLume is used. We don't use third-party advertising cookies anywhere. The mobile app doesn't use browser cookies; app analytics work via the app's own event instrumentation.

11. Changes to this policy

We may update this Privacy Policy from time to time. We'll update the "Last updated" date when we do, and for material changes we'll make a reasonable effort to notify active users (e.g., in-app notice or email).

12. Contact

Questions or requests about this policy: support@lingualume.com