Linga Privacy Policy
Linga is a vocabulary learning app. This page explains what data is processed, why, on what legal basis, how long it is kept and how to delete it.
In short. Without an account the app sends nothing about you except the text and photos you explicitly ask it to process. An account exists only so your words follow you between devices. There is no advertising, no analytics and no tracking of any kind.
Who processes the data
The controller is Angelina Kharitonova, the developer of the app, acting as an individual. You can reach her at haritonovaangelina671@gmail.com, which is also the address for any data protection request.
What is processed and on what basis
| Data | Purpose | Legal basis | Where and how long |
|---|---|---|---|
| Your words, translations, examples and progress | The learning itself | Performance of a contract — you asked the app to work | On your device permanently. It reaches the cloud only if you create an account, and stays there until the account is deleted |
| Email address | Signing in and moving data between devices | Performance of a contract | On the server, until the account is deleted |
| Password | Protecting your account | Performance of a contract | The password itself is stored nowhere. The server holds a random salt and an irreversible hash (PBKDF2-SHA256) from which the password cannot be recovered |
| Sign-in token | So you need not type the password on every launch | Performance of a contract | On the server for 90 days, then deleted automatically |
| Failed sign-in counter | Protection against password guessing | Legitimate interest — account security | On the server, tied to the email address, 15 minutes |
| Daily counters of AI requests | Keeping the cost of the model affordable | Legitimate interest — keeping the service running | On the server, 48 hours. These are numbers only — how many requests were made, never their content |
| Text you send to the AI | Parsing a list, checking a sentence, holding a dialogue | Your consent — you press the button yourself | Not retained by us. Passed to the model provider (see below) |
| Photo of a word list | Reading the words off the page | Your consent | Not retained by us and never written to your photo library. Passed to the model provider for recognition and not used after the reply |
| Reminder subscription in the browser version | Sending a reminder when words are due | Your consent — the notification permission | On the server until you unsubscribe. Contents described below |
| IP address | Damping a flood of requests from one address | Legitimate interest — protection against abuse | Not stored. It lives in the server's memory for a few seconds and is never written down |
Reminders
In the phone app
Reminders are local: the app sets alarms on the device itself for the coming days, and only for days when something is actually due. No request leaves the device, and the server learns neither what you study nor when you studied.
In the browser version
Here the reminder is sent by the server, so it has to store the delivery address issued by your browser, the chosen hour, your time zone, your language, and two markers — when the next word falls due and when you last studied. The last two exist so you are not woken up when there is nothing to review or you have already practised.
This record contains no words, no translations and no email address. Turning reminders off in the app's settings deletes it.
Artificial intelligence
When you ask the app to parse a list, check your sentence or talk with you, the text you entered (and, for recognition, the photo of your list) goes through our server to the model provider neuroapi.host, which forwards the request to the chosen model — Google Gemini or OpenAI. Our server only attaches an access key and passes the request along, storing neither the request nor the reply.
The provider and the model owner process the data under their own terms, which we cannot influence. So: do not enter anything you would not want a stranger to see — passwords, documents, other people's personal data, medical details.
Who the data is shared with
| Recipient | What they receive | Why |
|---|---|---|
| Cloudflare, Inc. | Everything stored on the server: email, password hash, synced words, reminder subscriptions | Hosting the server and its storage |
| neuroapi.host, and through it Google or OpenAI | Only the text and photos you send yourself | Running the language model and recognition |
| Apple | Purchase and installation records, under App Store rules | Distributing the app |
The data goes to nobody else. We do not sell it, trade it or disclose it, except where the law requires.
Where the data is processed
Cloudflare's servers and the model provider's servers sit in various countries, including outside your own. By sending data you agree to that transfer. We choose providers that publicly commit to data protection requirements, but we cannot control their infrastructure.
What we do not do
- No advertising and nothing passed to ad networks
- No tracking across apps or websites, no advertising identifier
- No analytics services and no profiling
- No automated decisions affecting your rights
- No selling of data and no sharing it for someone else's gain
- No storing of your photos and no audio recording — the app needs no microphone
Security
All communication with the server runs over an encrypted connection. The password is kept only as an irreversible hash with an individual salt, and the comparison is done in a way that reveals nothing through timing. Password guessing is blocked after a few failed attempts. The model access key lives on the server only and never reaches the app.
No system is perfectly secure, and we cannot guarantee absolute safety of your data.
Children
The app is rated 12 and over and is not intended for younger children. We do not knowingly collect data about children. If you are a parent and believe a child has given us their data, write to us and we will delete it.
Retention and deletion
Data on the device lives until you delete the app or clear its data. The cloud copy exists as long as the account does.
You can delete everything yourself, from inside the app: Settings → Account → "Delete account and cloud data". The email, password hash, tokens and synced words are erased immediately and permanently, beyond recovery. The cards on the device itself remain — removing the app clears those.
Records with a fixed lifetime (the sign-in token, the counters) are deleted automatically once the period listed in the table above has passed.
Your rights
You have the right to:
- Know what data is processed about you and receive a copy of it: Settings → "Download a backup" exports everything there is as a file
- Correct inaccurate data — directly in the app
- Erase your data — with the button in settings, as described above
- Restrict processing or object to it
- Take your data with you in a machine-readable form — the same backup file
- Withdraw consent at any time: turn off reminders, stop sending text and photos to the AI, delete the account. Withdrawal does not affect the lawfulness of processing before it
- Lodge a complaint with the supervisory authority in your country if you believe your rights have been breached
To exercise a right that is not covered by a button in the app, write to the address at the bottom of this page. We answer within 30 days.
Changes to this policy
If this policy changes we will update the date at the top. Material changes will also be announced inside the app, and where they affect something you consented to, we will ask for consent again.