Privacy
Privacy Policy
This notice explains how Lingomatia handles personal data when you use the iOS app, visit this website, request support, or when information about you appears in learning text submitted by someone else.
Lingomatia is designed to work without a name, email address, advertising profile, or visible account. It nevertheless processes pseudonymous identifiers, learning content, purchase information, and technical information. Pseudonymous data can still be personal data. We do not sell personal data or add advertising trackers to the app or website.
Who is responsible
The controller is [controller's full legal name], established at [complete postal address and country] (“Lingomatia”, “we”, “us”). Contact us at privacy@lingomatia.app.
Data protection officer: [name/contact details, or a verified statement that appointment is not required].
European Union representative, if Article 27 GDPR applies: [representative and contact details, or a verified statement that Article 27 does not apply].
Whose data this covers
This notice covers app users, website visitors, people who contact support, and people who may be identified in text that a user types, pastes, photographs, or scans. For the last group, the source of the information is the Lingomatia user who submitted the text. We normally receive only the passage selected by that user and may not know how to contact a person mentioned in it.
We obtain information directly from your app or correspondence, automatically from the service and network when it operates, from Apple in signed app/purchase events, and by generating linguistic and study results from the content and activity described below.
Information we process
| Category | Examples |
|---|---|
| Private profile and security | Internal UUID, session information, recovery-credential hashes, device-verification information, and a keyed digest derived from an Apple AppTransaction identifier. A digest is pseudonymous, not anonymous. |
| Preferences and learning records | Interface and learning languages, saved words, example sentences, translations, lesson state, review history, quiz prompts and answers, and spaced-repetition progress. |
| Content you choose to analyse | The text displayed in the editor when you tap Analyze, including text you type or paste and text recognised from a photo, together with selected languages and generated linguistic results. |
| Purchases | Apple-signed application and transaction information, product and transaction identifiers, subscription status, entitlement state, and notification identifiers. |
| Feedback and support | Feedback comments, the word or generated result concerned, correspondence, and information you choose to include in a support request. |
| Technical and security information | IP address or a rate-limit key derived from it, timestamps, requested endpoint, application errors, security events, model/cost metadata, and diagnostic information if production diagnostics are enabled. |
| Website delivery | IP address, request headers, date and requested page that the web server or hosting provider may need to deliver and protect this static website. The website itself contains no analytics script, advertising tracker, remote font, or non-essential cookie. |
Photos, typing, and AI analysis
Photo text recognition uses Apple Vision on your device. Lingomatia does not upload the photo for OCR. After recognition, the text is placed in an editable field. When you tap Analyze, the text shown in that field—not the photo—and your selected languages are sent to Lingomatia's server and to the AI provider described below. Review and redact the text before continuing.
Use only text you are comfortable sending for analysis. Do not include names, addresses, contact details, account or identity numbers, credentials, private messages, or confidential information. Do not submit personal data about another person unless you are lawfully permitted to do so.
Sensitive and third-party information
Lingomatia does not ask for, and the service is not intended to receive, personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or identifying biometric data, health, sex life or sexual orientation, or information about criminal allegations or convictions. A generic learning word about one of these topics is not necessarily personal data; a sentence connecting it to an identifiable person may be.
A user's service contract does not automatically provide a legal basis for processing personal data about someone else. For ordinary third-party data, our basis, necessity, Article 14 approach, safeguards, and rights handling are: [verified third-party-data assessment and public explanation].
Do not deliberately submit such information about yourself or anyone else. A warning does not remove our legal responsibilities if sensitive information appears unexpectedly in free-form text. Our prevention, rejection, deletion, and Article 9 or 10 handling for accidental sensitive content are: [verified sensitive-data handling and legal assessment].
Why we process information
| Purpose | Data | GDPR basis |
|---|---|---|
| Create, secure, restore, and operate the private profile and app session | Private profile and security information, languages | Article 6(1)(b), steps requested by you and performance of the service contract |
| Analyse text and return a requested lesson | Submitted text, languages, generated analysis, usage needed to enforce the service limits | Article 6(1)(b), to provide the analysis you request |
| Save and synchronise learning progress you choose to retain | Preferences, vocabulary, examples, quizzes, and review history | Article 6(1)(b), to provide saved study and synchronisation features |
| Provide and restore paid features | Apple purchase, transaction and entitlement information | Article 6(1)(b); Article 6(1)(c) applies only to records required by a specifically identified law: [applicable law and record categories, or verified not applicable] |
| Protect accounts, enforce limits, investigate abuse, prevent silent recreation of a deleted profile, and keep the service reliable | Identifiers, keyed AppTransaction deletion record, IP/rate-limit data, security and error information | Article 6(1)(f), our legitimate interests in security, fraud prevention, service integrity and respecting deletion. Our balancing assessment and relevant safeguards are: [approved LIA public summary and date] |
| Respond to support, feedback, and rights requests | Correspondence, feedback and the data needed to investigate the request | Article 6(1)(b) where needed to provide support; Article 6(1)(f) for product feedback and efficient request handling, subject to this balancing assessment: [approved LIA public summary and date]; Article 6(1)(c) where handling a GDPR request is legally required |
| Deliver and protect the website | Network and request information | Article 6(1)(f), our legitimate interests in providing and securing the site. Our balancing assessment and safeguards are: [approved LIA public summary and date] |
We do not make optional analytics, advertising, or marketing a condition of using Lingomatia. If these activities are introduced, this notice and any required consent controls must be updated before they are enabled. We do not treat acceptance of this policy as consent.
What you need to provide
You do not have to provide a name, email address, contact list, or visible account. The private profile, session, security information, and language choices are needed to operate the core service; without them Lingomatia cannot create a private learning space or securely connect requests to it. Text and selected languages are required only when you ask for analysis; without them that analysis cannot be returned. Saving a lesson, sending feedback, contacting support, using iCloud synchronisation where available, and purchasing Premium are optional. Apple may require information under its own terms when you use App Store or iCloud services.
Where information goes
We disclose personal data only where needed for the purposes above. Production vendor settings and contracts must match this table.
| Recipient | Reason and data | Service and location details |
|---|---|---|
| OpenAI | Processes submitted text, selected languages, and generated results to perform AI language analysis. We do not intentionally send the source photo. | [contracting entity, processor role, API data-control setting, retention, processing locations, and DPA date] |
| Apple | Distributes the app, processes purchases, provides signed transaction information, and may provide private CloudKit and iCloud Keychain synchronisation under your Apple Account settings. | [verified Apple services, contractual roles, relevant terms, and locations] |
| Wikimedia/Wiktionary services | May receive a selected dictionary term and languages to return public dictionary information. Private sentences should not be sent for lookup. | [verified endpoints, recipient role, logs/retention and locations] |
| Infrastructure and backup provider | Hosts the API, PostgreSQL, Redis, worker, website, operational logs, and backups. | [provider, services, processor role, regions, retention, and DPA date] |
| Error-monitoring provider, if enabled | Receives filtered error and diagnostic events. Content-route request and response bodies must be excluded. | [disabled, or provider, region, fields, retention, and DPA date] |
| Email provider | Processes privacy and support correspondence. | [provider, processor role, regions, retention, and DPA date] |
We may also disclose information to professional advisers, courts, regulators, or public authorities when lawfully necessary. Lingomatia does not sell personal data or disclose it for cross-context behavioural advertising.
International transfers
Some recipients may process information outside the European Economic Area. We use the safeguard actually in force for each transfer—such as an adequacy decision or the European Commission's Standard Contractual Clauses—together with necessary supplementary measures. Our transfers and safeguards are: [countries, recipient, transfer mechanism, transfer assessment date, and how to request a copy].
How long information is kept
We apply a deletion period to each system and do not keep information merely because it may be useful later. The current periods, including deletion propagation and rolling backups, are below.
| Information | Retention period |
|---|---|
| Normal text-analysis request and response on Lingomatia's server | [transient-processing rule and maximum technical-buffer period] |
| Onboarding preview content | [verified stateless design or implemented maximum period] |
| Learning data saved on device, private CloudKit, or server | [period/criterion and deletion propagation time] |
| OpenAI input, output, and abuse-monitoring data | [actual production API control and endpoint-specific period] |
| Rate-limit, Redis/Celery, security, web, and application logs | [period for each system] |
| Feedback and support correspondence | [period after closure and any legal hold rule] |
| Purchase, entitlement, and App Store notification records | [period and applicable legal requirement] |
| Keyed AppTransaction deletion record | [justified period, review interval, and deletion trigger] |
| Backups | [rotation period and restore-time deletion procedure] |
Deleting a Lingomatia profile does not cancel App Store billing. Subscription cancellation is managed through Apple. Legal holds, where applicable, suspend only deletion of the records covered by the hold and are documented and reviewed.
Your rights
Depending on the circumstances, GDPR gives you rights to access a copy of your personal data, correct it, erase it, restrict its use, receive portable data you provided, and object to processing based on legitimate interests. If processing ever relies on consent, you may withdraw that consent without affecting earlier lawful processing. These rights are not absolute, and we will explain any lawful limitation.
The app provides controls to remove learning data and the private profile. The Data & Backup export should not be assumed to be a complete Article 15 access response unless its screen expressly says so. For any rights request, email privacy@lingomatia.app. Because Lingomatia does not require a name or email account, we may ask for limited information from the app that lets us verify control of the relevant private profile; we will not ask for unnecessary identity documents. We normally respond within one month, subject to the extensions permitted by law.
If your information may appear in text submitted by another user, tell us the relevant passage, approximate date, and enough context to locate it without sending additional sensitive information.
You may complain to [lead supervisory authority name and complaint URL] or to the supervisory authority where you live, work, or believe an infringement occurred.
Automated analysis
Lingomatia uses automated systems to analyse language, generate explanations and examples, and schedule practice. These functions can be inaccurate. They are not used to make decisions that produce legal effects or similarly significantly affect you within Article 22 GDPR.
Children
Lingomatia's audience, minimum-age rule, and any parental-authorisation process are: [verified minimum age, target audience, country analysis, and any parental-authorisation process].
Security
Lingomatia uses measures including encrypted network transport, Keychain-backed credentials, signed sessions, access controls, pseudonymous identifiers, and on-device photo recognition. No service is completely secure. Our security, access, backup, processor, incident-response, and deletion controls are reviewed in proportion to the risks of the processing.
Changes to this notice
We will update the effective date when this notice changes. Material changes will be communicated through [verified in-app, website, or other notice channel and advance-notice rule] where required. Earlier versions and the reason for each change will be retained in the internal policy register.
Contact
Email privacy@lingomatia.app or write to [privacy postal address]. Please do not email passwords, recovery credentials, identity documents, full payment details, or unrelated sensitive information.