Czytaj po polsku

LangPal Privacy Policy

Effective date: 1 October 2026
Version: 2.0

For accounts created before 1 October 2026, this document applies from 15 October 2026; until then the previous version applies.

This Policy explains what personal data we process when you use LangPal — the web app (app.langpal.ai), the iOS and Android apps, the browser extension and the langpal.ai website (together, the “Service”). We have written it to be read: it names every company we entrust data to and does not rely on documents you cannot see.

1. Who is the data controller

The controller of your personal data is:

CodeYourBrand Sp. z o.o.
Al. Jerozolimskie 109/70, 02-011 Warsaw, Poland
Tax ID (NIP): PL5273088516, National Court Register (KRS): 0001073645
Contact for privacy and all other matters: support@langpal.ai

We have not appointed a data protection officer, as we are not required to. Please use the address above for any privacy request.

2. What data we process

2.1. Account data

• email address;
• password — stored only as an irreversible hash; when you sign in with Google or Apple we never receive your password, only a confirmation of identity from that provider (an identifier, your email and, for Google, your name and profile picture URL);
• the display name you choose;
• your native language, the languages you learn, your self-declared level (A1–C2) and the language variety you chose (for example, American English);
• your daily study goal in minutes, chosen when you create the account (15 minutes by default);
• your decision about AI features: consent or refusal, the version of the consent text, and the date.

2.2. Content you create

• folders, sets and categories (their names and structure);
• an optional description of a set (for example, “preparing for a job interview”) which, if you enter it, is included in AI requests about that set;
• vocabulary entries: the term, its base form and part of speech, language variety, translations, definition, category, synonyms, antonyms, example sentences (affirmative, negative, interrogative), your note, an explanation of the form, and a memory aid;
• the source of an entry: when you capture a word from a web page or a video, we store the address of that page and the sentence the word appeared in, so that you can return to the context. We do not store any other content of the pages you visit, nor your browsing history.

Some fields (definitions, sentences, explanations, memory aids) may be generated by AI at your request or — once you have consented — automatically as part of your study routine.

2.3. Study history

• the memory state of each entry (separately for recognition and recall) and review due dates;
• a review log: rating, question format, date and response time;
• the days on which you completed your study, and your streak;
• review-algorithm parameters fitted to your answers.

The Service uses this to build your daily study session. This is personalisation of learning content; we do not use it to make decisions that produce legal effects concerning you or similarly significantly affect you.

2.4. Subscription data

• plan, subscription status, billing period, currency and amount;
• your customer and subscription identifiers at the payment processor;
• the date of your consent to the immediate start of the service (see the Terms).

We do not receive or store your payment card details or billing address — you give them directly to the payment processor (Stripe).

2.5. AI usage data

• a monthly counter of AI operations, broken down by operation type (for example translation, pronunciation) — needed to apply plan limits;
• AI content reports: if you report an AI-generated utterance as inappropriate, we store its text (up to 1,000 characters), the language and the date.

2.6. Other data

• tokens of public links, if you share a set (section 5.3);
• access you have granted to external AI assistants (section 5.4);
• when you sign in with Apple: a token used solely to revoke the link with Apple when you delete your account;
• correspondence you send us.

2.7. Technical data

Our application server does not record IP addresses, device information or the content of your requests. The server log records errors and billing events together with an internal account identifier.

IP addresses and basic connection data are, as with any online service, visible to the infrastructure providers we use (hosting, the database with its sign-in module) and may be briefly logged by them for security purposes.

We use no analytics, advertising or tracking tools. The Service contains no Google Analytics, advertising pixels, third-party crash reporting tools or ad-network SDKs. We do not track you across other companies’ apps and websites. This applies to the langpal.ai website too: it carries no analytics scripts and no analytics cookies.

The only element of the langpal.ai website that comes from another company is the video on the page for teachers, played through Cloudflare. The player loads only after you click the play button — until you do, your browser does not connect to Cloudflare.

3. What we do not store

• Recordings of your voice. When you answer by voice in Conversation mode, the recording is sent to the speech-recognition provider solely to be turned into text. On our server it exists only in working memory for the duration of a single request. We store neither the recording nor its transcript.
• Conversations from Conversation mode. The conversation is kept only on your device (for up to 12 hours, so that it survives an accidental refresh) and is sent to the AI model with each turn. Nothing remains on the server — except an utterance that you choose to report (section 2.5).
• Addresses of pages you open in the Service for reading — the address is used once to fetch the text. It is stored only as the source of an entry if you capture a word from the page (section 2.2), and locally on your device in your materials history.

4. Data stored on your device

The Service stores locally — in browser, app or extension storage — data it needs to work: your sign-in session, interface settings (language, theme), the history of materials you read and the position at which a video was left, a working copy of a conversation, a queue of answers given while offline and, in the mobile app, a copy of your data for offline use (up to 7 days; removed on sign-out). The browser extension stores your session and the list of words you know, which it needs to highlight them.

These mechanisms are strictly necessary to provide the Service you request. We do not use cookies or similar technologies for analytics or marketing, which is why we do not display a cookie consent banner.

Notifications. Study reminders are scheduled locally on your device. We do not use server-sent push notifications and do not collect device identifiers for that purpose.

Backups. In the Android app, system backup of app data is disabled so that your sign-in session is not carried over to other devices.

5. Features that need a closer explanation

5.1. AI features and your consent

Translations, generation of entry content, explanations, pronunciation, speech recognition, Conversation mode and subtitle translation require sending the content of your request to external providers (section 7). Before this happens for the first time we ask for your explicit consent, naming those providers. We share only the content of the request — the word, the context sentence, the set description, your level and language pair, the conversation so far, the voice recording — and never your account details (email, name, identifier).

You can withdraw consent at any time in settings (“AI features”). The Service works without it — without AI features.

Every request to language models carries a technical restriction that admits only providers that do not use request content to train models.

5.2. Shared cache

To keep the Service fast and affordable, the results of some operations are shared between users:

• translations and dictionary content — we store the looked-up term with the AI answer and, if the request included a context sentence, that sentence too. These records contain no user identifier and expire: after 30 days (term only), 3 days (term with a context sentence) or 90 days (memory aids);
• pronunciation recordings — a file with a synthetic voice reading a given text. One file serves every user who listens to the same text; it is not linked to any account and is kept indefinitely. Lines spoken by your partner in Conversation mode are not stored.

Because this data is not attributed to a person, it is not deleted together with your account. Do not look up or select for translation any text that would by itself identify you.

5.3. Sharing sets

You can create a public link to a set. Anyone who has the link can see the set’s content (without your account details) and copy it to their own account. You can revoke the link at any time.

5.4. External AI assistants

On the Pro plan you can connect LangPal to an AI assistant of your choice (for example Claude or ChatGPT). Connecting requires you to sign in and give explicit consent on the authorisation screen. The assistant can then read and write your vocabulary. Further processing of that data by the assistant’s provider is governed by its own privacy policy — you decide on this disclosure and you can revoke it.

5.5. Browser extension

The extension runs on the pages you visit so that you can capture a selected word and see the words you already know highlighted. Page text is processed only locally, in your browser. Our server receives only what you select and save or translate: the word, the sentence it appeared in, and the page address. The extension does not collect your browsing history.

Translation of video subtitle lines is performed directly from your device through the public Google Translate service — Google then receives the text of the line and, as with any connection, your IP address.

5.6. YouTube videos

When you open a video in the mobile app, we display the original YouTube page with our overlay for capturing words from subtitles. YouTube (Google) then processes your data under its own rules, including its own cookies — the YouTube Terms of Service and the Google Privacy Policy apply.

5.7. Mobile app permissions

• Microphone — only to answer by voice in Conversation mode (section 3).
• Notifications — local study reminders (section 4).
• Local network (iOS) — connecting to a computer on the same network; not used to collect data.

The app does not request access to your camera, photos, location or contacts.

6. Purposes and legal bases

Providing data is voluntary, but an email address (or a Google/Apple account) is required to create an account. We send no newsletters or marketing messages; our emails concern only your account (for example, address confirmation) and payments.

7. Who we entrust data to

We use the services of the following companies. Each receives only the data it needs.

We may also disclose data to advisers (such as a law firm or an accounting office) and to public authorities where the law requires it. We do not sell personal data, and we do not share it for cross-context behavioural advertising.

8. Transfers outside the European Economic Area

Some of our providers are based in the USA. Data is transferred on the basis of the European Commission’s adequacy decision for the EU–U.S. Data Privacy Framework (for certified companies) or the Commission’s standard contractual clauses. You can obtain a copy of the safeguards by writing to support@langpal.ai.

9. How long we keep data

• Account data, content and study history — until you delete your account.
• Shared cache — translations for 3, 30 or 90 days (section 5.2); pronunciation recordings indefinitely (they are not data about you).
• Billing records — for the period required by tax and accounting law (as a rule, 5 years from the end of the year in which the tax payment deadline passed); the payment processor keeps them too.
• Correspondence and data needed to defend claims — until the limitation periods expire.
• Infrastructure providers’ technical logs — according to their short retention periods.

10. Deleting your account

You can delete your account yourself at any time:

• in the app: Settings → Account → Delete account;
• on the web: https://app.langpal.ai/delete-account;
• if you cannot sign in — by writing to support@langpal.ai from the address linked to the account.

Deletion is immediate and irreversible. It covers the account, all content, study history, counters, reports and subscription data in our database. An ongoing subscription bought on the website is ended with immediate effect, and the link with your Apple account is revoked.

After deletion, only the following remain: shared-cache records (with no user identifier, until they expire), shared pronunciation recordings, and billing records that the law requires us to keep.

11. Your rights

You have the right to access your data and obtain a copy, to rectification, erasure, restriction of processing, data portability, to object to processing based on legitimate interests, and to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal).

You can correct or delete most data yourself in the app. To receive a copy of your data in a machine-readable format, write to support@langpal.ai — we reply without undue delay and within one month at the latest.

You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) — or with the authority in your country of residence.

12. Children

The Service is intended for people aged 16 or over. We do not knowingly collect data from anyone younger. If we learn that an account was created by a person under 16, we will delete it. If you are a parent or guardian and believe your child has created an account, write to support@langpal.ai.

13. Security

Connections to the Service are encrypted. Access to data in the database is restricted, row by row, to the account it belongs to. Keys to external services are held only on the server — never in the app or the extension. Payment details do not pass through our systems.

14. Changes to this Policy

We will tell you about material changes — in particular new providers or new kinds of data being shared — in the Service or by email before they take effect. A change to the list of AI providers or to the scope of data shared with them means we ask for your consent again. Earlier versions of the Policy are available on request.

15. Contact

support@langpal.ai
CodeYourBrand Sp. z o.o., Al. Jerozolimskie 109/70, 02-011 Warsaw, Poland