Legal

Privacy Policy

This policy explains what EpiLingo processes, why we process it, who helps us provide the service, and the choices you have over your information.

Effective October 5, 2026

1. Scope and data controller

This Privacy Policy applies to the EpiLingo mobile application, website, and related services (the "Services"). EpiLingo ("EpiLingo," "we," "us," or "our") is the controller of personal data covered by this policy unless another notice says otherwise.

This policy should be read with our Terms of Use and Community Guidelines.

2. Data we process

Account and identity data

We process a user identifier and account status. If you sign in with Apple or Google, we receive information the provider makes available according to your settings, such as a provider identifier, name, or email address. Guest accounts use an app-generated identity. We do not receive your identity provider password.

Profile and learning data

We process onboarding answers and learning preferences such as language level, native or explanation language, goals, preferred topics, target accent, practice settings, completed missions, progress, streaks, weaknesses, corrections, pronunciation results, and review history.

Voice and conversation data

We process microphone audio during speaking sessions, along with prompts, transcripts, conversation turns, session metadata, generated responses, and feedback. Voice and conversation data is used to provide live dialogue, transcription, pronunciation analysis, corrections, and personalized reviews.

Audio may be streamed to our servers and AI service providers while a session is active. We may retain related transcripts, session records, learning results, and feedback. Do not include sensitive or confidential information in conversations unless it is necessary and you are comfortable with this processing.

Purchase and subscription data

When you purchase through the Apple App Store, we process product, entitlement, subscription status, transaction identifiers, price/currency metadata, renewal, expiration, refund, and revocation events. Apple processes your payment method; EpiLingo does not receive full card details.

Device, log, and usage data

We may process IP address, device and operating-system information, app version, timestamps, network and error data, authentication events, feature interactions, session duration, and product analytics. We use a EpiLingo user identifier to connect relevant product events to an account. Our iOS app does not request permission for cross-app advertising tracking.

Support communications

If you contact us, we process your contact details, account identifier, message, attachments, and any follow-up information needed to respond.

3. How we use data

We use personal data to:

  • create, authenticate, secure, and manage accounts;
  • provide live AI conversations, transcription, pronunciation analysis, and learning feedback;
  • personalize missions, recommendations, onboarding, difficulty, and progress;
  • process subscriptions, verify entitlements, and maintain purchase records;
  • operate, debug, measure, protect, and improve the Services;
  • prevent abuse, fraud, security incidents, and violations of our rules;
  • answer support requests and send service-related communications;
  • comply with law and establish, exercise, or defend legal claims.

We do not sell personal data. We do not share personal data for cross-context behavioral advertising. We do not use your voice or conversation content to train generalized AI models unless we obtain any consent or other permission required by applicable law.

5. How we share data

We disclose data only as needed for the purposes described above, including to:

  • Google Gemini for live AI conversation and certain audio or pronunciation analysis;
  • OpenAI-compatible providers, which may include OpenAI or OpenRouter depending on service configuration, for objectives, reviews, summaries, and other learning content;
  • Jev (typesafe.ai) for fast classification of conversation transcripts, such as whether a practice goal was reached;
  • PostHog for product analytics and service improvement;
  • Apple for sign-in, StoreKit purchases, subscription administration, notifications, and app distribution;
  • Google when you choose Google sign-in;
  • hosting, database, network, security, monitoring, and support providers that process data on our behalf;
  • professional advisers, authorities, or other parties when required by law or reasonably necessary to protect rights, safety, and the integrity of the Services;
  • a buyer, investor, successor, or adviser in connection with a merger, financing, reorganization, or sale, subject to appropriate safeguards.

Providers may receive account identifiers, input, audio, transcripts, language settings, and technical metadata only to the extent needed for their role. Their own privacy terms may also apply when you interact with them directly.

6. Data retention

We retain personal data for as long as needed to provide the Services, maintain your account and learning history, comply with law, resolve disputes, prevent fraud, and enforce agreements. Retention depends on the type of data, the feature, sensitivity, legal requirements, and operational need.

When you delete your account, we delete or de-identify account data that we no longer need, subject to reasonable backup cycles and records we must keep for legal, security, fraud-prevention, accounting, or transaction purposes. De-identified information that can no longer reasonably identify you may be retained for analytics and service improvement.

7. Security

We use administrative, technical, and organizational safeguards designed to protect personal data, including access controls, encrypted network transport, credential protection, and service monitoring. No internet transmission or storage system is completely secure, so we cannot guarantee absolute security.

Protect your device and sign-in credentials, install security updates, and contact us promptly if you suspect unauthorized account access.

8. International data transfers

EpiLingo and its providers may process data in countries other than the one where you live. Those countries may have different privacy laws. Where required, we use recognized transfer mechanisms and contractual safeguards, such as adequacy decisions or standard contractual clauses.

9. Your privacy rights

Depending on where you live, you may have the right to access, correct, obtain a copy of, or delete your account and personal data; restrict or object to processing; withdraw consent; and appeal a decision. You may also have the right to complain to your local data-protection authority.

You can update available preferences in the app, manage microphone and notification permissions in device settings, and use the in-app account-deletion control where available. You may also send a request to [email protected]. We may need to verify your identity before fulfilling a request. Authorized agents must provide proof of authority where required.

We do not discriminate against you for exercising privacy rights. Some data may be exempt from a request, and deleting information needed to provide the Services may require closing your account.

10. Children

The Services are not intended for people under 18. We do not knowingly collect personal data from a person under 18. If you believe a minor has provided personal data, contact us so we can investigate and take appropriate action.

11. Changes to this policy

We may update this Privacy Policy as the Services or law changes. We will post the updated policy and effective date here. If a change materially affects your rights, we will provide additional notice or obtain consent where required.

12. Contact us

For privacy questions or requests, email [email protected]. Please include enough information for us to identify your account and understand the request, but do not send passwords or unnecessary sensitive data.