Privacy Policy
lingoXpress respects your privacy. This policy explains what data we collect, why we collect it, how it is used, and the rights you have over it — wherever in the world you live.
What we collect
We collect only the data needed to run the service: - Account data — your email address and password (hashed), display name, and the languages you have selected to learn. Provided by you at sign-up. - Learning progress — your scores, streaks, bookmarks, completed lessons, and spaced-repetition state. Generated as you use the service. - Device and usage data — IP address, browser type, operating system, referrer, pages visited, and approximate location derived from your IP. Collected automatically. - Communications — emails you send to us, and Word-of-the-Day subscription preferences. We do not collect biometric data, government identifiers, financial account numbers, or precise GPS location.
Third-party services
We share data with the following third parties strictly to operate the service: - Google AdSense (advertising, publisher ID pub-1606880962684914) — serves the ads that fund the free version of lingoXpress. Consent is gathered through Google Funding Choices in regions where prior consent is required. - Google Analytics 4 (measurement, property G-37R0P5S5NR) — anonymous usage metrics. Loaded only after analytics consent is granted, with IP anonymisation enabled. - Microsoft Clarity (session-replay analytics, project wq9oji696h) — anonymised session replays to diagnose UX problems. Loaded only after analytics consent is granted. - Google reCAPTCHA — abuse protection on sign-in and account creation. Subject to Google's Privacy Policy and Terms of Service. - OpenAI — powers the lingoXpress Chat feature. Conversation content you send to Chat is transmitted to OpenAI under their standard data-processing terms. - Amazon Web Services (Lambda, DynamoDB, SES) — backend hosting, database, and transactional email delivery. - Cloudflare Workers — edge hosting, CDN, and DDoS protection. We never sell personal information for money. "Sharing" for cross-context behavioral advertising — as that term is defined under the California Consumer Privacy Act — occurs only through Google AdSense, and only where you have not opted out via Global Privacy Control, the Funding Choices consent dialog, or the "Do Not Sell or Share" link below.
Legal basis for processing
Where the General Data Protection Regulation applies, we rely on: - Consent — for advertising cookies, analytics cookies, and email newsletter sign-ups. - Contract — to provide the account features you have asked us to provide. - Legitimate interests — to keep the service secure, prevent fraud and abuse, and improve the product. - Legal obligation — to respond to lawful requests from regulators and law-enforcement authorities. You may withdraw consent at any time using the Manage cookie preferences button below or by emailing info@lingoxpress.com.
Data retention
We retain your account information for as long as your account is active, plus a short grace period to allow you to recover deletions or change your mind. After that, your personal data is deleted or anonymised. Aggregated and de-identified usage data — which cannot reasonably be linked back to you — may be retained indefinitely to track service performance over time. Backups are rotated on a 30-day schedule; deletions propagate through backups within that window.
Your rights under the GDPR (EEA, UK, Switzerland)
If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation and equivalent local law: - The right to be informed about the processing of your personal data. - The right of access to a copy of the personal data we hold about you. - The right to rectification of inaccurate personal data. - The right to erasure ("the right to be forgotten") in the circumstances set out in Article 17. - The right to restrict processing. - The right to data portability — to receive your data in a structured, machine-readable format. - The right to object to processing based on legitimate interests, including profiling. - The right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. - The right to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. - The right to lodge a complaint with your national supervisory authority. To exercise any of these rights, email info@lingoxpress.com. We will respond within one month.
US state privacy rights
If you are a resident of California (CCPA/CPRA), Colorado (CPA), Connecticut (CTDPA), Virginia (VCDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Iowa, Tennessee, Delaware, New Jersey, New Hampshire, Maryland, Minnesota, Rhode Island or Indiana, you have the following rights: - The right to know what categories of personal information we have collected about you, the sources, the purposes, and the categories of third parties with whom we share it. - The right to access a copy of the specific pieces of personal information we hold. - The right to correct inaccurate personal information. - The right to delete personal information, subject to the exceptions in the applicable statute. - The right to opt out of the sale or sharing of your personal information for cross-context behavioral advertising — see the "Do Not Sell or Share" section below. - The right to limit the use of sensitive personal information (CCPA/CPRA). - The right to non-discrimination for exercising any of these rights. - The right to appeal a denial of any privacy request (most US state laws). We verify identity using your account email address before fulfilling any request. To exercise these rights, email info@lingoxpress.com.
Do Not Sell or Share My Personal Information
Residents of California, and of any other US state or jurisdiction that grants you a right to opt out of the sale or sharing of your personal information for cross-context behavioral advertising, may exercise that right at any time. To opt out: - Click the "Do Not Sell or Share My Personal Information" button below. - Or enable the Global Privacy Control signal in your browser (Brave, Firefox, DuckDuckGo). We honor it automatically at the network edge. - Or email info@lingoxpress.com with the subject "Do Not Sell or Share". We will not discriminate against you for exercising any of your privacy rights.
Global Privacy Control
When your browser sends the Sec-GPC: 1 request header — the Global Privacy Control signal — lingoXpress treats it as a valid opt-out under the California Consumer Privacy Act and the comprehensive privacy laws of Colorado, Connecticut, Montana, Oregon, Delaware, New Jersey, New Hampshire, Maryland, Minnesota and the other US states that recognise universal opt-out mechanisms. When GPC is detected, advertising and analytics cookies are not set, personalised advertising is disabled, and your visit is processed with all Consent Mode v2 signals denied.
Quebec (Law 25)
If you are in Quebec, Loi 25 (the Act respecting the protection of personal information in the private sector, as amended in 2021) gives you the right to be informed of the collection of your personal information, the purposes for which it is collected, the means used to collect it, the rights of access and rectification, and your right to withdraw consent. You may also request that your information be ceased to be disseminated, de-indexed, or re-indexed. You can exercise these rights by emailing info@lingoxpress.com. You may also file a complaint with the Commission d'accès à l'information du Québec.
Brazil (LGPD)
If you are in Brazil, the Lei Geral de Proteção de Dados Pessoais (LGPD) gives you the right to confirm whether we process your data, to access it, to correct incomplete or out-of-date data, to anonymise, block or delete unnecessary data, to data portability, to information about who we have shared your data with, to revoke consent at any time, and to lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD). We do not transfer Brazilian users' personal data outside the legal bases set out in articles 33–36 of the LGPD.
South Africa (POPIA)
If you are in South Africa, the Protection of Personal Information Act (POPIA) gives you the right to be notified that personal information about you is being collected, to access your personal information, to request correction, destruction or deletion of your personal information, to object to the processing of your personal information, and to complain to the Information Regulator. The responsible party for POPIA purposes is Edward Leoni, contactable at info@lingoxpress.com.
South Korea (PIPA)
If you are in South Korea, the Personal Information Protection Act (PIPA) gives you the right to be informed about the processing of your personal information, to consent to or refuse processing, to access, correct, delete and suspend the processing of your personal information, and to claim damages for harm caused by a violation. You may lodge a complaint with the Personal Information Protection Commission (PIPC). We ask for explicit, informed consent before setting any non-essential cookies on devices located in South Korea.
Children's privacy
lingoXpress is a general-audience educational service. It is not directed at children under 13 (under 16 in the European Economic Area and the United Kingdom), and we do not knowingly collect personal information from such children. If you are a parent or guardian and believe your child has provided personal information to us without your consent, please contact info@lingoxpress.com and we will delete the information promptly.
International data transfers
Our backend services run on Amazon Web Services in the Asia Pacific (Sydney) region; static content is served globally through Cloudflare's edge network. If you are visiting from outside Australia, your personal data will be transferred to and processed in Australia. For transfers from the European Economic Area, the United Kingdom or Switzerland we rely on the European Commission's Standard Contractual Clauses, supplemented by appropriate technical and organisational measures including encryption in transit and at rest.
Security
We use HTTPS exclusively, hash passwords with bcrypt, scope database access by least privilege, and store secrets in AWS Secrets Manager / Cloudflare Worker bindings — never in source control. No system can be guaranteed perfectly secure. If you believe your account has been compromised, change your password immediately and email info@lingoxpress.com.
Contact and complaints
For any privacy-related question, request, or complaint, contact: Edward Leoni (data controller for lingoXpress) Email: info@lingoxpress.com Residents of the European Economic Area and the United Kingdom have the right to lodge a complaint with their national supervisory authority. Residents of California, Quebec, Brazil, South Africa and South Korea have analogous rights with their respective regulators.
Changes to this policy
We may update this Privacy Policy from time to time to reflect changes to our services, the technologies we use, or to comply with new legal requirements. When we make material changes we will revise the "Last updated" date at the top of this page and, where appropriate, notify you through the service. We encourage you to review this page periodically to stay informed about how we protect your information.