LingvallaPrivacy policy
Last updated: 24 October 2026
This policy explains what personal data Lingvalla collects, why, who it is shared with and what your rights are. It covers the Lingvalla apps for Android and iPhone, the web app at app.lingvalla.com and this website. We've tried to keep it plain.
Who we are
Lingvalla is run by Brian Vilhelmsen, [Postal address to be confirmed] ("we", "us"). We are the controller of your personal data. For anything about your data, email brian@lingvalla.com.
What we collect and why
| Data | What it's for | Legal basis |
|---|---|---|
| Account: email, display name, password (stored only as a one-way hash), interface language | Your account and signing in | Contract |
| Learning data: your languages and level, the stories written for you, the words you tap, quiz answers and review history, sentences you write to have checked, weekly goals | Providing the service: stories, your word hoard and training | Contract |
| Profile (optional): age range, occupation, where you live, family, hobbies, favourite genres and anything you write about yourself | Making stories about your life. Every field is optional; leave out anything you'd rather not share. | Contract |
| Workouts and voyages: routines, sessions and points; for outdoor voyages, if you allow location access, the GPS route (positions, times, altitude) and distance | The Forge, Voyage and your voyage log with routes | Contract; location only with your permission, which you can withdraw in your phone's settings |
| Voice commands during a voyage | Hands-free control. Your phone's built-in speech recognition (by Google or Apple) turns speech into text; we receive only the text, and longer commands are sent to OpenAI to interpret. We don't receive or store recordings. | Contract |
| Technical data: IP address, device and app version, request logs | Security, rate limiting, fixing errors. Logs are kept briefly and overwritten. | Legitimate interest in running a secure service |
| Beta sign-up: email and phone type | Inviting you to test the app and telling you about the launch | Consent, which you can withdraw at any time |
| Subscriptions: plan, status and renewal dates | Giving you what you paid for. Payments are made through Google Play or the App Store; we never see your card details. | Contract |
We don't sell your data, show ads or use advertising trackers.
Who we share it with
We use a small number of service providers who process data for us under data processing agreements:
- DigitalOcean hosts our servers and databases, in London, United Kingdom. The UK is recognised by the EU as providing adequate data protection.
- OpenAI (United States) writes the stories, narrates them and interprets longer voice commands. For this it receives your languages and level, words from your hoard, the profile details you've chosen to share, sentences you ask to have checked, and story text. Under OpenAI's API terms this data is not used to train their models and is kept for up to 30 days for abuse monitoring. Transfers to the US are protected by the European Commission's Standard Contractual Clauses.
- Google and Apple distribute the apps, process subscription payments and, on your phone, provide speech recognition, under their own privacy policies.
- Websupport / Active24 (European Union) hosts our email.
We'll update this list before adding a new provider. We may also disclose data where the law requires it.
Cookies and local storage
The web app sets one cookie, which keeps you signed in. The apps store your sign-in token and an offline copy of your stories and hoard on your device. This website sets no cookies, and we use no analytics or tracking. Fonts are served from our own server, not a third party.
How long we keep it
- Account, learning and workout data: for as long as you have an account. When you delete your account, it is erased from our live systems straight away and from our backups within 14 days.
- Beta sign-ups: until the app has launched or you ask us to remove you, whichever comes first.
- Server logs: a few days at most.
- Audio narration is stored by sentence text so it isn't generated twice. It contains no account information.
Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format. Where we rely on consent, you can withdraw it at any time. Email brian@lingvalla.com and we'll answer within a month. You can delete your account yourself; see Delete your account.
If you think we've mishandled your data, you can complain to the data protection authority where you live, or to ours: the Czech Office for Personal Data Protection (ÚOOÚ).
Security
All connections are encrypted (HTTPS). Passwords are stored only as Argon2 hashes, and sign-in sessions only as hashes, so a copy of our database wouldn't reveal them. Our databases are not reachable from the internet.
Children
Lingvalla is for people aged 16 and over. We don't knowingly collect data from younger children; if you believe a child has given us data, contact us and we'll delete it.
Changes
If we change this policy in a way that matters, we'll tell you in the app or by email before it takes effect. The date at the top shows the latest version.