Privacy Policy

1. What we collect

When you use Haylingua, we collect:

• Account info — email, name/username, and password (hashed — we never store it in plain text). If you sign in with Google, Facebook, or Telegram, we receive your name, email, and profile picture from that provider.
• Learning data — lessons completed, exercise answers, streaks, XP, hearts, gems, and review history, so the app can track your progress and schedule reviews.
• Profile content you add — bio, avatar, banner image, and any public profile settings you choose.
• Usage & device data — pages visited and basic interaction events (via Umami, a privacy-focused analytics tool) and session behavior (via Microsoft Clarity) so we can see what's confusing or broken. Neither tool sells data or builds cross-site ad profiles from it.
• Payment data — if you subscribe to Premium, our payment provider processes your card details directly; we receive only confirmation of payment, not your full card number.

2. How we use it

• To run the app: save your progress, calculate streaks, schedule spaced-repetition reviews, and show your position on leaderboards
• To communicate with you: account verification, password resets, streak reminders, and product updates (you can turn off non-essential emails in Settings)
• To improve Haylingua: understanding which lessons or exercises people struggle with or drop off on
• To keep the app safe: detecting abuse, fraud, or violations of our Terms & Conditions

3. Who we share it with

We don't sell your personal data. We share it only with the services that help us run Haylingua, each bound to use it only for that purpose:

• Brevo — sends transactional emails (verification, password reset) and, if you haven't opted out, product/marketing emails
• Our payment provider — processes Premium subscription payments (Visa, Mastercard, ArCa, Telcell)
• Umami & Microsoft Clarity — anonymized/aggregated product analytics
• Google, Facebook, Telegram — only if you choose to sign in with one of them

We may also disclose data if required by law, or to protect the rights and safety of Haylingua and our users.

4. Cookies and local storage

We use cookies and browser local storage to keep you logged in, remember your theme (light/dark) and preferences, and power analytics. See our Cookie Policy for the full breakdown and how to control them.

5. Data retention

We keep your account and learning data for as long as your account is active. If you delete your account, we remove your personal data within a reasonable period, except where we're required to keep certain records (e.g. payment history) for legal or accounting purposes.

6. Your rights

You can, at any time:

• Access or update your profile information directly in the app
• Request a copy of your data
• Request deletion of your account and associated data
• Opt out of marketing emails (a link is in every marketing email, or turn it off in Settings)

To exercise any of these, email [email protected] or use our contact form.

7. Children and Haylingua Kids

A child can only have a Haylingua account if a parent or guardian creates it for them, from a Family plan. Children can't sign up on their own — the normal sign-up needs an email address and is for people aged 13 and over.

What we collect about a child. A username and, if the parent gives one, a first name and year of birth. There's no email address on a child's account: we create a placeholder internally so the account works, and we never send email to it. Beyond that we hold the same learning data as for anyone else — lessons finished, XP, streaks, answers and achievements.

What the parent controls. The parent creates the account, sets and resets its password, sees the child's progress, chooses whether the child is visible to other learners, and can remove or delete the account at any time. Removing a child from a plan keeps their account and progress; deleting erases it. A parent can export everything we hold about their children from Settings, alongside their own data.

Being seen by other learners. When the account is created, the parent chooses separately whether the child appears to other learners — on leaderboards, on a public profile, in the forum and in chat. This is on by default and can be changed at any time from the family dashboard. With it off, the child still learns normally but isn't publicly visible.

Marketing. We never send marketing email to a child, and reports about a child go to the parent's address. We don't build advertising profiles of children or use their data to target ads.

A parent can ask us to show, correct or delete anything we hold about their child, or withdraw their consent, by emailing [email protected]. Withdrawing consent means we delete the child's account.

8. Security

We use industry-standard measures — encrypted connections (HTTPS), hashed passwords, and access controls on our systems — to protect your data. No system is 100% secure, but we take reasonable steps to keep yours safe.

9. Changes to this policy

If we make material changes to how we handle your data, we'll notify you in the app or by email before the change takes effect.

10. Contact

Questions about this policy or your data? Reach us at [email protected] or via our contact page.